Last updated: November 6, 2026 · Rtlize
This policy covers the Rtlize Shopify app and the rtlize.com website. We comply with Israel's Privacy Protection Law, GDPR principles, and Shopify's privacy requirements.
Personal data of a store's shoppers (cancellation requests, back-in-stock/price-drop signups, accessibility reports) is stored inside the merchant's own Shopify store, not on our servers. The merchant is the data controller; we act solely as a processor to power the features the merchant enabled.
Store domain, feature settings, subscription plan, merchant support messages, and anonymous aggregate usage counters. When a merchant connects their own email provider for alerts, its key is stored encrypted and used only for that store's emails. We never store payment card details — all billing is handled by Shopify.
We access store data only through Shopify's official scopes and only as needed per feature — including orders limited to the last 60 days (cancellation validation and Israeli postal-code correction).
AI translation runs in the merchant's browser: the model files are downloaded from the model host (Hugging Face), and store content is sent neither there nor to any AI service. Store texts reach our server only to be looked up in our human-translation dictionary and to save the translations to the store through Shopify.
Image description (ALT text) suggestions are made in the merchant's browser too: an image model is downloaded from the same model host, and the images are read straight from Shopify. Images are sent neither to us nor to any AI service. The description the merchant saves goes through our server to the store on Shopify.
On uninstall, all shop data is deleted automatically when Shopify's redaction webhook arrives (~48h). Shopper deletion requests are honored automatically via Shopify's GDPR webhooks. Manual requests: info@rtlize.com.
We never sell or rent personal data, never use one store's data for another, and never advertise to a store's shoppers.
Data goes only to parties needed for a feature the merchant turned on, and only the minimum that feature needs:
Services we call without any personal data: Hebcal (Shabbat and holiday times, by city name only) and the AI model host (translation and image descriptions).
All traffic is TLS-encrypted and server access is restricted to authorized personnel with strong authentication. Data-loss prevention: automated daily backups with an encrypted off-site copy and periodically tested restores; test and production environments are fully separated, including separate databases. In the event of a security incident affecting personal data, we will act immediately to contain it and notify affected merchants by email without undue delay, including the nature of the incident and the steps taken. We operate as a data processor for the merchant under this policy and under Shopify's API and data protection terms, which apply to every app on the platform.
Our website analytics are self-hosted, cookieless, and shared with no third party. Merchants may request access, correction, or deletion at info@rtlize.com; shoppers should contact the store they purchased from. We may update this policy; the current version always lives at this page.