Last updated: 28 June 2026
This Privacy Policy explains what data the Blog Smith Shopify app ("Blog Smith", "we", "us") accesses, why, how it is stored, and your rights. Blog Smith is a content-creation tool that runs inside your Shopify admin.
Blog Smith is classified at Protected Customer Data (PCD) Level 0. It does not request the read_orders, read_customers, or any order/customer scope, and it never reads, stores, or processes any order, customer, or shopper personal data. The app structurally cannot access that data because it never requests the scopes required to read it.
Blog Smith requests the minimum scopes needed to do its job:
| Scope | Why we need it |
|---|---|
| read_products | Read product and collection handles to suggest internal-link slots in a content brief and provide catalog grounding for drafts. We do not read inventory, costs, or customer-specific data. |
| read_content | Read your existing blogs and articles so drafts avoid duplicating content you already have. |
| write_content | Publish an article you have explicitly approved to your store blog (a new blog post with SEO meta). Granted via the app configuration; you re-consent on install/update. |
We request no other scopes. We never request read_orders, read_customers, read_all_orders, or any protected-customer-data scope.
On our servers (hosted on a dedicated EU/EEA-region server, see §6) we store only:
We store no order data, no customer data, and no shopper personal data of any kind.
When you use a paid plan to draft an article, the content brief, your brand name, and any grounding facts you supply are sent to Anthropic (our AI provider) to generate the draft. These prompts contain only your own catalog/brief data — never customer or order data. We operate under Anthropic's zero-data-retention terms: Anthropic does not retain your inputs or outputs to train models, and we do not log prompt or response bodies on our side.
If you use Bring Your Own Anthropic Key (Agency plan), drafting runs on your own Anthropic account under your own agreement with Anthropic. Your key is encrypted at rest (AES-256-GCM) and is never returned to your browser or to any third party.
We use the data above only to: build briefs, draft and scrub articles, publish approved articles to your blog, enforce your plan's token budget, show you analytics of your own production (briefs/drafts counts, sizing, keyword coverage), and bill you correctly. We do not sell your data, and we do not use it for advertising.
No other third parties receive your data.
shop/redact webhook (sent ~48 hours after uninstall), all of your Blog Smith data is permanently deleted from our database.customers/data_request and customers/redact webhooks truthfully report there is nothing to return or redact.Blog Smith implements Shopify's mandatory compliance webhooks (customers/data_request, customers/redact, shop/redact). As a merchant you may request access to, correction of, or deletion of the data we hold about your shop at any time by contacting us (§10). Uninstalling the app triggers deletion of your shop's data as described in §7. Our hosting is in the EU/EEA.
Access tokens and any BYOK key are encrypted at rest with AES-256-GCM. All traffic is served over TLS. We log only coarse, non-content metadata (model id, token counts, latency, request id) — never your content, prompts, or responses.
For any privacy question or data request: support@syncerp.work (or the support email listed on the app's App Store page). We respond within 30 days.