Privacy Policy

Effective date: October 8, 2026 | Last updated: October 8, 2026

This Privacy Policy explains how Jisku (jisku.seoark.com, shown in the product as AOJUAI; "the Service", "we", "us") collects, uses, shares, retains and protects personal information when you use:

  • the Jisku web workspace (product sourcing, product library, AI-assisted localization and translation, image processing, store theme design, pushing products to Shopify, and related features);
  • the Jisku Shopify app embedded in the Shopify admin (https://jisku.seoark.com/shopify-app);
  • the Jisku browser extension and this public website (including the "Contact us" form).

This policy is published in Chinese and English; both versions have the same content.

1. Who we are (controller) and how to contact us

The Service is operated by Magetech ecommerce service limited. We are the controller of your account data and of website visitor data. For the data of a merchant's store customers that we process through the Service (see Section 6), we act as a processor (service provider) on behalf of that merchant, who is the controller.

For privacy questions, requests or complaints, email [email protected] with "Privacy" in the subject line.

2. Information we collect

2.1 Information you provide

  • Account data: username and password (stored only as a one-way bcrypt hash — we never see your password), plus, depending on your workspace's settings, optional or required nickname, email address, phone number, avatar and profile bio. Verification codes used to bind an email address or phone number are stored only as salted hashes.
  • Tenant / team data: tenant (service provider) name, contact name, phone and email, and your teams, organization structure, members and permissions.
  • Business content you upload or create: product data and images, pricing rules, store profile (brand, store policies, etc.), themes and store design content, content pages, templates, and your conversations with the in-app AI assistant.
  • Purchase and credit data: credit balance and transaction history, purchase orders (plan, amount, currency, payment method, payment reference) and, if you choose an offline bank transfer, the payment receipt you upload.
  • Third-party credentials: API keys or tokens you enter for sourcing, AI or notification channels, stored encrypted.
  • Contact and support: the name, email, company, subject, message and order reference you submit through the "Contact us" form or a support ticket.

2.2 Information collected automatically

  • Sign-in and security data: sign-in time, consecutive failed sign-in count and lockout status (5 consecutive failures lock the account for 30 minutes).
  • Operation logs: for write operations (create, update, delete, sign-in, registration, top-up, etc.) we record user ID, username, module and action, request path and method, IP address, browser user agent, result status, duration, and sanitized request parameters (fields such as passwords, tokens, keys and cookies are masked).
  • Application logs: server logs may contain username, user ID and IP address (e.g. sign-in events) for troubleshooting and security auditing.
  • Browser extension: device name, extension version, a hashed installation ID, last-used time and IP; extension tokens are stored only as hashes.
  • Cookies and local storage: see Section 9.

2.3 Information from Shopify (when you install the Jisku Shopify app or connect a store)

With your authorization we access your store through the Shopify Admin API using these access scopes:

  • Required scopes: read_products, write_products (products), read_orders (orders), write_files (files / images), write_themes (themes), write_online_store_pages (online store pages).
  • Optional scopes (requested only when you turn on the matching feature in your store settings; off by default): write_publications (sales channel publishing), write_inventory and read_locations (inventory sync), read_all_orders (order history), write_merchant_managed_fulfillment_orders and write_assigned_fulfillment_orders (fulfillment and tracking updates).

As a result we obtain and store:

  • Shop information: shop ID, shop name, myshopify and primary domains, currency, time zone and the granted scopes.
  • Access tokens: the offline access token and refresh token issued by Shopify, stored encrypted in our main database (the embedded app also keeps a copy in its server-side session store to complete Shopify authentication) and used only to call the Shopify API on your behalf.
  • Product, theme and page data needed for syncing, publishing and store design: products, variants, inventory, images, theme files and pages.
  • Order data and personal information of your store's customers: see Section 6.
  • Shopify session data: the embedded app stores Shopify's standard session record (shop domain, access token, scopes and expiry); if Shopify includes staff-user details in a session (user ID, name, email, locale), they are stored with it. The link between your Jisku account and a Shopify store is kept only as an opaque identifier.

2.4 Data from public sources

At your direction, the Service collects product information (titles, images, prices, specifications, sales and ranking data) from publicly available marketplace and storefront pages for product sourcing and your product library. This collection targets products, not people; we do not aim to collect personal information.

3. How we use information

  • To provide, operate and maintain the Service: sign-in, product sourcing and management, AI translation and copywriting, image processing, theme design, pushing products to your store, and syncing inventory and order information;
  • To process purchases, calculate and deduct credits, and review offline payments;
  • To send service notifications you enable (e.g. task completion, alerts) by email or through WeCom, WeChat, Feishu / Lark channels you connect;
  • To provide customer support and respond to your requests;
  • To keep the Service secure: authentication, brute-force protection, access control, auditing and fraud / abuse prevention;
  • To comply with legal obligations and to establish, exercise or defend legal claims.

We do not sell your personal information, do not use it for cross-context behavioral advertising, and do not use store customer data to train AI models.

4. Legal bases for processing (GDPR / UK GDPR)

  • Contract: to provide the Service you signed up for (account, sourcing, product management, publishing, billing);
  • Legitimate interests: securing the Service, preventing abuse, improving reliability and troubleshooting, where these are not overridden by your rights;
  • Legal obligation: e.g. keeping accounting and tax records and responding to lawful requests from authorities;
  • Consent: e.g. notification channels you choose to connect; you can withdraw consent at any time without affecting earlier processing.

For store customer data, we process on the merchant's instructions under our contract with the merchant; the merchant, as controller, determines the legal basis.

5. Sharing and processors

We share information only as needed to provide the Service, with the following categories of third parties, who are required by contract or their service terms to protect it:

  • Shopify: to perform the store operations you authorize and to process in-app one-time purchases through Shopify Billing.
  • AI model providers: to generate translations, product copy and images we send product content (titles, descriptions, attributes, images) to OpenAI-compatible model APIs. Depending on the platform's or your tenant's configuration, providers may include OpenAI, Google (Gemini), Alibaba Cloud (Qwen / DashScope), Zhipu AI, DeepSeek and OpenRouter; tenants may also configure their own provider. Voice features may use speech APIs from OpenAI, Google, Alibaba Cloud, Zhipu AI and Xiaomi MiMo. Store customers' personal information is never sent to AI providers.
  • Stock media: Pexels (searching commercially usable photos / videos; only search keywords are sent).
  • Sourcing services: our own product-sourcing service and product-data collection services, used to obtain product information from public e-commerce sources.
  • Communications: email (SMTP) delivery, and WeCom, WeChat, Feishu / Lark messaging channels you choose to connect.
  • Exchange rates: Frankfurter (European Central Bank data) and open.er-api.com — only exchange rates are requested; no personal information is sent.
  • Hosting and infrastructure: server and database hosting (data is stored on servers under our control; files use local storage).
  • Legal and compliance: where required by law, to protect our or others' rights and safety, or in a merger, acquisition or asset transfer (the recipient will be required to honor this policy).

We do not handle payment card data: in-app purchases are processed by Shopify, and we never receive or store card numbers.

6. Merchants' store customer data (Shopify orders and customers)

To display orders read-only in the workspace and to support fulfillment and tracking updates, the Service syncs your store's orders using the read_orders scope:

  • Order data: order number, dates, status, currency and amounts, line items, discounts, shipping, refunds, fulfillments and tracking numbers. By default we sync recent orders (the read_orders window); your full order history is synced through read_all_orders only if you turn it on.
  • Customer personal information: once Shopify approves this app's access to protected customer data, we receive with each order the customer's name, email, phone, order note, and shipping and billing addresses. We do not call Shopify's Customers API and do not request the read_customers scope.
  • Safeguards: customer personal information is stored separately from order data and encrypted field by field; it is masked in the interface by default; only users who hold a dedicated permission and are bound to that store can reveal it in plain text, and every reveal is recorded in an audit log (which itself contains no personal information).
  • Purpose limitation: used only to show you your orders and help with fulfillment and tracking — never for marketing, profiling, sale or AI training.
  • Retention: customer personal information is deleted automatically 180 days after an order is completed or cancelled by default (configurable per store from 1 to 3,650 days); non-personal order statistics may be kept for your business reports.
  • If you turn off the orders feature or Shopify does not grant protected customer data access, we do not collect customer personal information.

How we handle Shopify's mandatory compliance webhooks

  • customers/redact: we erase all personal information from that customer's orders and keep a tombstone that contains no personal information, so later syncs do not capture that customer's personal information again; non-personal order lines are kept.
  • shop/redact: once the app has been uninstalled, we delete the store's synced orders, order lines, customer personal information, store products and mappings, sync state and account bindings, wipe all stored credentials and tokens, and anonymize the store record. If the store has reinstalled the app in the meantime, nothing is deleted.
  • customers/data_request: we log the request, manually compile any data about that customer held in the Service, and provide it to the requesting merchant within 30 days so the merchant can respond to its customer.

7. International data transfers

Our servers are hosted by cloud and hosting providers we select. Some of our providers (such as Shopify, OpenAI and Google) are based in the United States or other countries, so your information may be processed outside your country. For transfers from the European Economic Area, the United Kingdom or Switzerland, we rely on applicable transfer mechanisms (such as the European Commission's Standard Contractual Clauses or equivalent safeguards offered by our providers) and transfer only the data needed to provide the Service.

8. Retention and deletion

  • Account and business data: kept while your account exists. You can ask us by email to delete your account (tenant administrators can also disable or remove member accounts); we will then delete or anonymize the related data within 30 days, except records we must keep to meet accounting, tax or other legal obligations (e.g. purchase orders and credit transactions) for the legally required period.
  • Product recycle bin: deleted products move to a recycle bin and are permanently purged after 30 days by default (configurable from 1 to 365 days).
  • Store customer personal information: see Section 6 (by default 180 days after order completion or cancellation).
  • Application logs: general logs are kept for 7 days and error logs for 30 days.
  • Operation audit logs: kept for security and auditing; you may ask us to delete records about you where this does not conflict with security or legal obligations.
  • Browser extension tokens: expire after 180 days.
  • After you uninstall the Shopify app: we immediately revoke and delete the store's access and refresh tokens, wipe the stored store credentials, disconnect the store and delete the app sessions, and we stop accessing the store. Synced store data is deleted when Shopify sends the shop/redact request (usually about 48 hours after uninstall), or earlier under the retention periods above. Your own product library, templates and other content in the Jisku workspace are not affected by uninstalling and remain in your Jisku account until you delete them or delete your account.

9. Cookies and similar technologies

The Service uses only strictly necessary cookies and browser storage. We do not use advertising cookies or third-party analytics / tracking cookies:

  • aoju_access_token / aoju_refresh_token: sign-in credentials; HttpOnly, Secure over HTTPS, SameSite=Lax; valid for 3 hours and 7 days respectively;
  • Browser local storage (localStorage / sessionStorage): stores your session profile, interface language, light / dark theme, sidebar state, list filters, drafts and similar preferences, used only in your browser;
  • The embedded Shopify app authenticates with session tokens provided by Shopify.

You can clear or block cookies in your browser, but you will then be unable to sign in and some features will not work.

10. Security

We use reasonable technical and organizational measures, including HTTPS for all traffic; bcrypt password hashing; encryption of Shopify access tokens, third-party credentials and store customer personal information in our main database; restricted server access; HMAC verification of Shopify webhooks and internal requests; tenant data isolation; role-based access control; lockout after repeated failed sign-ins; and audit logs for sensitive operations and plain-text reveals of personal information. No system is perfectly secure; if a security incident affects your personal information, we will notify you and the authorities as required by law.

11. Your rights

Depending on where you live (for example the EU / UK GDPR, the California CCPA / CPRA and other US state laws, or China's Personal Information Protection Law), you may have the right to:

  • Access: know whether and what personal information we process about you, and get a copy;
  • Rectification: correct inaccurate or incomplete information (most profile data can be edited in your account settings);
  • Erasure: ask us to delete your personal information or your account;
  • Restriction and objection (including objecting to processing based on legitimate interests);
  • Portability: receive data you provided in a structured, commonly used, machine-readable format;
  • Withdraw consent where processing is based on consent;
  • Non-discrimination: you will not be treated differently for exercising these rights;
  • Lodge a complaint with your local data protection authority.

How to exercise your rights: email [email protected] describing your request and your account username. To protect your account we may need to verify your identity; you may also use an authorized agent (proof of authorization required). We will respond within 30 days, or within the period required by applicable law.

If you are a customer of a merchant's store: we process your data on that merchant's behalf, so please contact the merchant first; we will help the merchant respond and we carry out erasure requests forwarded by Shopify.

CCPA notice: in the past 12 months we have collected the following categories of personal information: identifiers (e.g. username, email, phone, IP address), commercial information (purchase records), internet activity information (operation logs) and, as a service provider, merchants' customer information (names, contact details, addresses), for the purposes listed in Section 3. We do not sell and do not "share" personal information for cross-context behavioral advertising.

12. Children

The Service is intended for businesses and merchants and is not directed to children under 16. We do not knowingly collect children's personal information. If you believe we have collected such information, contact us and we will delete it.

13. Changes to this policy

We may update this policy from time to time. We will revise the "Last updated" date on this page and, for material changes, notify you in advance by in-app notice or email. Continuing to use the Service after a change means you acknowledge the updated policy.

14. Contact us

中文版本：隐私政策（中文）

Privacy Policy — Jisku