Draft updated: October 16, 2026
Vistolist helps Shopify merchants prepare product images, listing content, and Shopify Draft products. This draft explains the data used to provide that service.
Data we process
- Your Shopify store domain, installation status, authorized scopes, and encrypted Shopify access token.
- Product photographs, merchant-entered product facts, generated images and content, SKUs, and Shopify product references.
- Operational records such as generation counts, errors, and timestamps needed to run and secure the service.
How data is used
We use this data to authenticate your store, generate requested content, create or update Shopify Drafts, provide downloads, prevent duplicates, meter usage, and maintain service security. The current PUBLIC app policy states that the app does not read or retain Shopify customer records; that scope must be re-confirmed for the Vistolist release.
Service providers
Product photographs and relevant product facts may be sent to OpenAI to generate and evaluate requested images and listing content. Hosting and storage providers may process encrypted or access-controlled application data on our behalf. The complete Vistolist subprocessor list must be confirmed before launch. We do not claim to sell merchant or customer data.
Security and retention
The current PUBLIC application encrypts Shopify tokens at rest and isolates store product data. A precise general retention schedule is not yet approved for this Vistolist policy. When Shopify requests deletion of store data, app records—including credit balances—are removed. Final language must still define any other data-specific periods and limited legal or security exceptions.
Your choices
The current PUBLIC workflow allows a merchant to delete local app products without deleting the corresponding Shopify Draft. Uninstalling disconnects Vistolist from the store. Automatic credit recovery after Shopify-requested deletion is not currently supported. Contact support@vistolist.com about unused purchased credits before uninstalling. Shopify privacy requests are handled through mandatory compliance webhooks.
Contact
Privacy and deletion questions may be sent to support@vistolist.com with “Privacy request” in the subject.