Privacy Policy

Last updated: September 27, 2026

TrueView AI ("the App", "we", "us") is a Shopify application that helps merchants display AI-generated aggregate reviews of real customer reviews and public web discussions on their storefronts. This policy explains what data we collect, how we use it, who we share it with, and your rights.

1. Who this policy applies to

This policy covers two groups:

• Merchants — Shopify store owners and staff who install and use the App in the Shopify admin.
• Shoppers — end customers of those stores who visit product pages where the App's widget is displayed.

2. Data we collect

From merchants (through Shopify)

• Shop domain (e.g. your-store.myshopify.com).
• Your store’s name, contact email and country, as provided by Shopify.
• A Shopify-issued OAuth access token scoped to the permissions you granted at install (read/write products, read locales, read/write translations).
• Product metadata (titles, descriptions, status) fetched on demand to power the admin UI. We do not copy your product catalog. For products you generate a review for, we store the product’s title and, for some products, a short excerpt of its description.
• Plan/subscription status and usage counters (how many AI reviews were generated in the current billing cycle).
• Session information required by the Shopify App Bridge (stored by the Shopify session-storage library).

Review data we collect about each product

The core purpose of the App is to find what people publicly say about the merchant's products and produce a short AI review. Source material enters the App in two ways:

• Public web research (primary). TrueView AI sends the product's title as a search query to a third-party web-search provider (Tavily), which returns publicly available results about the product — for example discussions, articles, and reviews from across the web. We store the returned result snippets (short text excerpts plus the source domain and URL) and pass the relevant ones to our AI provider to generate the AI review. TrueView AI retrieves these results through the search provider's API over publicly available content; it does not log in to source sites or bypass paywalls.
• Optional merchant import. A merchant who already owns their review data may import it into the App through a connected review platform (for example, Judge.me) via an authenticated integration. For each imported review we store the review text and rating, the source name and URL (when present), the reviewer's displayed name (when present), the review date, and the language.

For reviews, we do not store reviewers’ email addresses, IP addresses, phone numbers, or any identifiers that aren't part of a publicly displayed review.

From shoppers

The storefront widget does not collect personal data, set cookies, fingerprint devices, or track behavior. It reads product metafields rendered server-side by Shopify and displays them. No analytics beacons are sent from the widget.

3. How we use the data

• To authenticate merchants with Shopify.
• To search for publicly available information about the merchant's products via a third-party web-search provider, and to store the returned public snippets used to generate the AI review.
• To pass product titles, short product-description excerpts and the collected review text to our AI providers: Groq, to generate the aggregate AI review and to translate it into a merchant-selected language; and Anthropic, to check that an AI review describes the product it will be shown with. Only product and review text is sent; merchant identity and shopper identity are not.
• To enforce quota limits and process subscription billing.
• To comply with Shopify's GDPR data-request and redact webhooks.

4. Third parties we share data with

We do not sell personal data. We do not share data with advertisers.

5. How we generate AI reviews

TrueView AI produces short aggregate AI reviews for each product using large language models.

• Grounded in real sources. Every AI review is based on material TrueView AI actually holds — public web result snippets found via the search provider, and/or customer reviews imported by the merchant. We instruct the model not to invent features, benefits, or claims not present in that source material.
• No invented ratings. When the AI review is based on imported customer reviews, the star rating and review count shown on the storefront are computed from those actual reviews — never generated by the AI model. For web-research reviews, TrueView AI shows a qualitative cue instead — for example "mixed opinions across public sources", a descriptive "% positive across N sources" proportion, or an average of numeric ratings published by named third-party publications when those exist. The App never fabricates a star rating.
• Disclosed on every product page. The storefront widget renders a clear and conspicuous disclosure with the AI review — for example "AI review of 18 public sources" — together with a statement that it is an AI-generated summary and not a verified customer review. This supports compliance with the FTC 2024 rule on AI-generated reviews, the EU Digital Services Act, and the UK DMCC Act.
• Minimum-data threshold. The App refuses to produce an AI review without enough source material — at least three collected customer reviews (reviews mode) or five quality web sources (web research).

6. Data retention

• Store settings, subscription and usage counters, connected apps and login sessions: deleted when you uninstall the App.
• Customer reviews you imported (including reviewers’ displayed names) and your generation history: deleted 48 hours after you uninstall.
• AI reviews built from public web research, and the research behind them: kept after you uninstall, with the link to your store removed 48 hours after uninstall. They summarise what is published about products and contain no personal data. We keep them in a shared research database and may reuse them for other stores selling the same or similar products. The same applies when you delete a product. When you delete a review in the App, it is removed from your store.
• AI reviews written only from your imported customer reviews: deleted with those reviews, 48 hours after you uninstall.
• Web search results, records of products we couldn’t review, and review-sync logs (each linked to your store): deleted automatically after 90 days.
• Product-type records (a product’s title, a short description excerpt, and the kind of product we identified): kept to improve the App, with the link to your store removed 48 hours after you uninstall.
• Uninstall record: when you uninstall, we keep a record of your store’s domain, name and country, how long you used the App, how many reviews you generated and published, and the reason you gave for leaving, if any. Your email is removed from it 48 hours after uninstall.
• Messages you send us through the App (“Tell us”, “Report a problem”), with your store’s domain: kept so we can follow up and improve the App. Your email is removed from them 48 hours after uninstall.
• Trial-usage record: your store’s domain is kept after uninstall to enforce one free trial per store, and deleted 48 hours after uninstall.
• Billing and system records: plan-change history, with your store’s domain, is kept for accounting; internal alerts and system health logs, which may include your store’s domain and contact email, are kept for up to one year; GDPR compliance logs are kept indefinitely as the audit trail proving we honored data-request and redact webhooks, and contain your store’s domain and, for shopper requests, the Shopify customer ID — never an email, phone number or address.

Note: if you cancel your subscription or downgrade your plan, the AI reviews TrueView AI placed on your products are removed from your storefront.

7. Your rights (GDPR / CCPA)

Shoppers who want a copy of their data, or want it deleted, should ask the store they bought from. TrueView AI has no access to the store’s customer records, so Shopify does not pass these requests on to us. The only shopper data the App can hold is reviews a store imports into it (for example from Judge.me), with the reviewer’s name as it was shown publicly. A store that receives such a request can email us at yuval@thewhales.co.il, and within 30 days we will send a copy of, or delete, the imported reviews under that name. Reviews imported from Judge.me are also held by Judge.me, which handles its own requests.

Uninstalling the App deletes your store’s settings within minutes and your imported customer reviews within 48 hours. AI reviews built from public web research are kept without any link to your store, and other records are kept or deleted as described in section 6. To ask us to delete anything else we hold about your store, email us at yuval@thewhales.co.il.

8. Security

Data is transmitted over HTTPS. Credentials are stored as environment variables on Railway, not in the codebase. Database access is restricted to the app's server. We do not access merchant data except as required to operate the App.

9. Children

The App is sold to businesses. It is not directed at children under 16 and we do not knowingly collect personal data from them.

10. Changes to this policy

We will update the "Last updated" date above when we make material changes. Continued use of the App after an update constitutes acceptance.

11. Contact

Questions, requests, or complaints: yuval@thewhales.co.il.