Legal

Privacy Policy

How FeedGraph collects, uses, stores, and shares personal data — and what you can ask us to do with it. The people this policy is about are the people who use FeedGraph, not your store’s customers.

Last updated 2026-09-29

Who this covers

FeedGraph is a commerce data and performance platform at feedgraph.ai. This policy applies to the marketing website, early-access and contact forms, and the FeedGraph application.

FeedGraph’s data subjects are the people who use it — merchant and agency staff. The product handles a merchant’s product catalogue, not their customers’ orders. There is no orders table and no end-customer list. Advertising metrics we pull from Google and Meta are aggregate, keyed by campaign and SKU.

The one place an identifiable person who is not a FeedGraph user can appear is a product photograph. That is covered by the in-app AI rights terms, not by treating your shoppers as FeedGraph users.

Controller and processor

For accounts, sign-in, billing references, consent records, and this website, FeedGraph is the controller: we decide how that personal data is processed. Under Indian law (the DPDP Act) we are the Data Fiduciary for that same set — personal data you give us directly.

For catalogue, feed, and advertising data you connect, FeedGraph is your processor. You decide what to import, enrich, and publish. You are the Data Fiduciary for that data; we process it on your instructions. That processing is described in the Data Processing Agreement.

What we collect

We collect only what the product needs to run. Personal data falls into these categories:

Identity and contact
Email, display name, and user id. Workspace membership, role, and invitations (including the invited email and who sent it).
Authentication
Sign-in methods (email one-time codes, Google sign-in), hashed passwords where used, session records, and optional MFA secrets. One-time codes are hashed; we also keep the IP that requested them, briefly, for abuse investigation.
Device and activity
IP address and user agent on the security trail. What someone did in the workspace — catalog edits, approvals, report runs — so a change can be attributed, reviewed, and reversed.
Content you type
Assistant prompts and replies, in-app feedback (including a screenshot if you attach one), and AI reports you generate.
Billing
Credit grants, purchases, and usage attributed to the person who triggered them. Stripe customer and subscription references. Card numbers never touch FeedGraph.
Credentials held for you
OAuth tokens and API secrets for Shopify, Google, and Meta, stored encrypted, so the workspace can stay connected. These belong to the workspace, not to an individual staff member.
Marketing-site forms
Name, email, company, phone number (early access), and whatever you write in a contact or early-access request. Used only to reply to you and arrange a demo — not added to a marketing list. These submissions reach us as an email notification to our team inbox; they are not stored in the product database, so the product retention classes below do not apply to them. See “How long we keep it”.

What we do not collect

We do not import Shopify customer records or order PII. Product catalogue fields, inventory, and images are commercial data about goods.

We do not sell merchant data. We do not use your catalogue to train a shared model. Data is shared only with the infrastructure and AI subprocessors required for features you have switched on.

Where it comes from

You, when you create an account, invite a teammate, submit a form, or type into the assistant.

Connected platforms, when you grant OAuth access: Shopify for catalogue and inventory; Google Ads, Merchant Center, and Meta for feeds and aggregate performance.

Automatically, from running the service: sessions, audit events, job records, and hashed API keys you create.

Why we use it

Each purpose maps to a lawful basis under GDPR Article 6 and, where Indian law applies, to a valid basis under the DPDP Act. Optional purposes go through the in-app consent register (Settings → Privacy). Absence of consent is treated as refusal. Required purposes are recorded as notice, not as a fake optional toggle. How you grant and withdraw consent is in “Consent”.

Provide the service (contract)
Accounts, workspaces, Shopify sync, feed generation, and the activity needed to operate them. Hosting, database, and sign-in email are on this path.
AI processing of catalogue content (consent)
Sending product titles, descriptions, and attributes to AI providers so FeedGraph can write, fix, and categorise them. Catalogue content only — never account login details. Optional; the workspace can refuse it.
Image rights and model consent (consent)
Your confirmation that you hold rights in source photographs, including consent from anyone depicted, before we generate images or video. Optional until you generate.
Distribution to ad platforms (consent)
Publishing your catalogue to Google Merchant Center, Google Ads, Meta, and other connected channels.
Security and service integrity (legitimate interest)
One-time codes, MFA, audit trails, and abuse investigation. You can object; some of this cannot be switched off without ending the account.
Legal obligation
Billing records, consent proof, data-subject request logs, and who approved a spend-affecting write to a live ad account.
Product emails and extra analytics (consent)
Optional feature emails, and optional usage analytics beyond the activity log security and billing already require.

Consent

Where this policy marks a purpose as consent, that processing does not run until you agree. We also process personal data on other bases the law recognises — contract, legitimate interest, or legal obligation — as listed under “Why we use it”. Those are not optional toggles.

You may withdraw consent at any time. Withdrawal stops that purpose going forward. It does not undo processing that was lawful before you withdrew, and it is not the same as an erasure request. Ask for erasure separately if you want that.

In the product
A workspace admin grants or withdraws optional purposes in Settings → Privacy. That register is the source of truth. A withdrawal is stored as a new row, not by deleting the original grant.
On this website
Optional cookies: the banner, or Cookie preferences in the footer. Contact and early-access forms: the notice on the form. We use those details only to reply and arrange a demo — not a marketing list unless we ask first.
How to withdraw
Use the same screens, or write to privacy@feedgraph.ai / feedgraph.ai/contact. We may need to verify who you are before we act.

How long we keep it

Inside the product, retention is classed in the data inventory and aged out by an automated job. A workspace can shorten a class, never extend it past the ceiling. “Keep forever” is not an option.

Data you send us through a form on this website is the exception: it arrives as email, is kept in a team inbox, and is cleared by hand. It is listed first below so the difference is not buried.

Marketing-site enquiries
Up to 24 months in the team inbox that receives them, then deleted. These are handled by hand rather than by the automated job below, because they arrive as email and never enter the product database. Ask us and we will delete yours sooner.
Sign-in codes
1 day.
Operational queue and invite records
90 days after they stop being useful.
AI assistant conversations
180 days.
In-app feedback
365 days. The reporter’s identity is cleared on erasure; the ticket can remain.
Activity and security trail
730 days (two years).
Consent proof and rights-request logs
2555 days (seven years). A withdrawal is a new row, not a deleted grant.
Billing and credit ledgers
2555 days (seven years), then aged out.

Your rights

You can ask for a copy of what we hold about you, to correct identity and contact fields, or to be erased. In the app this is Settings → Privacy → Data-subject requests. Workspace admins act on their own workspace only. The screen shows a preview — which tables will be exported, deleted, anonymised, or refused — before anything runs.

Erasure is not a blanket DELETE. Audit and approval records keep the event and clear the person (name, email, IP, user agent) so the history of what happened survives without naming who. Some rows are refused with a reason: shared workspaces, hash-chained consent, billing state, and the register of the request itself.

Rectification is a closed list: email and display name on the account, and email on linked sign-in identities. It does not rewrite the audit trail, change a role, or move credits.

If you do not have an account, use the contact form on this site. We will need enough to find you (usually the email you used).

Access, correction, erasure
As above. We answer within one month. We may need to verify your identity first.
Withdraw consent
Where processing is based on consent, withdraw it as described under “Consent”. Withdrawal does not affect processing that was lawful before you withdrew.
Nominate someone (DPDP)
Under Indian law you may nominate another person to exercise these rights if you die or become incapable. Tell us in writing at privacy@feedgraph.ai.
Grievance
Raise a DPDP grievance as described under “How to reach us”. You may also complain to the Data Protection Board of India where that route applies.

Who else sees data

Active subprocessors — the parties this deployment actually sends data to — are listed in the Data Processing Agreement. Planned vendors that are not processing yet are not listed here, because naming a transfer that is not happening is as wrong as omitting one that is.

AI providers (Anthropic, Google Gemini/Veo, OpenAI when the image fallback is on) receive catalogue content for the job you ran, not your login. Shopify, Google, and Meta receive catalogue and feed data you chose to publish. Stripe receives billing contact and customer references. Resend receives email addresses for sign-in codes, invitations, and form replies.

International transfers

Several subprocessors process in the United States. Where GDPR requires a transfer tool, we rely on the vendor’s Standard Contractual Clauses (or an adequacy decision where one applies).

Cookies and sessions

The application uses a server-side session cookie so you stay signed in and in the right workspace. API keys you create are stored as SHA-256 hashes.

On this marketing website we ask for cookie consent before anything optional runs. Necessary cookies keep the site working and remember the choice you made. Analytics cookies stay off until you allow them. We do not run advertising pixels.

Accept all, reject all, or manage categories on the banner. Change that later with Cookie preferences in the footer. Rejecting analytics is treated as refusal — those cookies do not run anyway.

Strictly necessary
Required for the site to load, remember your theme, keep forms working, and store your cookie choice. These cannot be switched off.
Analytics
Optional. Help us see which pages are useful. Blocked until you accept that category. We do not load an analytics script until then.

Children

FeedGraph is a business product. It is not directed at children. We do not knowingly collect personal data from anyone under 16 (GDPR) or under 18 (DPDP). If you believe a child has given us data without the authorisation the law requires, write to privacy@feedgraph.ai and we will delete it where we must.

How to reach us

Use the contact form at feedgraph.ai/contact, or the Privacy screen in your workspace. Security issues can also be sent to security@feedgraph.ai — see feedgraph.ai/.well-known/security.txt. We aim to acknowledge vulnerability reports within 48 hours.

Privacy and data requests
privacy@feedgraph.ai, or feedgraph.ai/contact. We answer within one month, as GDPR Article 12(3) requires.
Grievance redressal (India, DPDP)
privacy@feedgraph.ai. Indian law gives you the right to a defined complaints route before approaching the Data Protection Board, and this is it. Tell us it is a DPDP grievance and we will treat it as one.
Security reports
security@feedgraph.ai. Acknowledged within 48 hours.

This page describes how FeedGraph actually operates. It is written in plain language and pending external legal review. If something here conflicts with a signed order form or data processing addendum, the signed document wins.