Privacy Policy

What we collect

We collect only what a scan and your account need:

• What you give us. The store address you ask us to scan, any competitor addresses you add, the email you enter to receive the report or book a consultation, and — only if you choose those features — a domain you ask to verify and traffic logs you upload.
• What the scan reads. The publicly accessible content of the pages we crawl on the address you submit, screenshots (crops) of those pages, the technology we detect, and the result of each check. We crawl only the address you give us.
• Technical data. Your IP address, browser and basic usage. Every page loads Google Analytics 4 and Google Tag Manager, and Tag Manager loads Ahrefs Web Analytics. Google Analytics records the pages you visit and a few events: a scan starting or finishing, a report unlocked, a consultation requested, a result shared, an llms.txt draft generated. Each event carries the page and the form it came from, never your email. A share also carries the scanned store’s domain. If a link fills in the scan field for you, we take the store address out of the page address before Google Analytics records the visit. The Cookie Policy lists the cookies this sets.

How we use it

• To run the scan you requested and produce its report.
• To email you the report, and to contact you about a consultation you asked for.
• To operate, secure, measure and improve the service.
• To comply with the law and to enforce our terms.

We do not sell your personal data, and we do not use it for advertising.

AI processing

Some checks send the content of the scanned pages to our AI provider (Anthropic) to grade them. This is done through their API for processing only; your data is not used to train AI models. We send page content and check context — never your account password or payment details, which we do not have.

How the scan behaves on the site it reads

A scan is deliberately bounded, and the same limits protect the scanned site and its visitors: we read robots.txt first and obey it, keep each scan to a fixed request budget that the crawler’s code enforces, send no more than 2 requests a second to any one host, and never log in, pay, solve a challenge or upload a file on the scanned site. We send at most one read-only JSON-RPC tools/list request per scan, and only to the MCP endpoint the store’s own UCP profile declares, which may be on another domain. We check the specification links in that profile only on ucp.dev, shopify.dev and pay.google.com. You are responsible for having the right to scan the address you submit (see the Terms of Service).

When you ask the llms.txt builder to generate a draft, we send the address you type to our server, which reads that site’s sitemaps and the public pages the draft lists, about 100 at most, four a second at most, obeys its robots.txt and keeps the draft for a day.

How long we keep it

• Screenshots and page crops are deleted 30 days after the scan.
• Scan results and the report are kept so you can return to them, and removed on request.
• Your email is kept until you ask us to delete it.

Who we share it with

We share data only with the service providers who help us run Storewalk:

• Cloud hosting and storage for the application and the scan artifacts.
• Our AI provider (Anthropic), as described above.
• Email delivery, to send you your report and consultation messages.
• Google (Tag Manager and Analytics 4) and Ahrefs (Web Analytics), to measure how the site is used. See the Cookie Policy.

We may also disclose data where the law requires it, or to protect our rights, users or the public. If we are ever part of a merger or acquisition, we will tell you before your data becomes subject to a different policy.

International transfers

We are a Ukrainian organization and our providers operate across borders, so your data may be processed outside your country. Where that happens we rely on appropriate safeguards for the transfer.

Your rights

You can ask us to access, correct, export or delete your personal data, or to stop processing it. Write to info@storewalk.ai and we action removals within 24 hours. You may also complain to your local data-protection authority.

Children

Storewalk is a tool for businesses and is not directed at children. We do not knowingly collect data from anyone under 16.

Changes and contact

We may update this policy; we will change the date above and, for material changes, give notice. Questions or requests: info@storewalk.ai.