Privacy Policy
English · Deutsch · Français · Español · Italiano · Português (Brasil) · 日本語
This policy has two parts. Part 1 covers the navaal.ai website and the free Bilby store scan — what our own, first-party beacon records when you visit, and what a scan keeps. Part 2 explains what data Navaal: AI SEO, AEO & GEO (the "App"), built by Navaal, accesses from your Shopify store, why we access it, where it is stored, and the rights you have over it.
In short: we access the store content you ask us to optimise, we send the specific content you choose to generate to Anthropic's Claude API to produce drafts, we never use your data to train AI models, and we delete your store's data when you uninstall.
Part 1 — The website and the free Bilby scan
No third-party trackers
navaal.ai loads no third-party analytics, advertising pixels, tag managers or chat widgets. The only measurement on this site is a small script we wrote ourselves, which sends a few facts about each page view to our own server. There is no cookie: the script keeps a random session id and any utm_ tags in your browser's session storage, which your browser discards when the tab closes. Nothing is shared with, or read by, any other company.
What the beacon records
The page you viewed and the time.
Where you came from — the referring site's hostname (for example google.com or chatgpt.com) and any utm_ tags in the link, so we can tell search, an AI assistant, a listing, our own emails and direct visits apart. We never see what you searched for.
A coarse location — the country, and at the moment you start a scan the region and city, read from headers our CDN adds to the request. We do not look your address up with any geolocation service, and we do not store your IP address with your page views.
A device class (phone, tablet or desktop) worked out from your browser's user-agent string; the string itself is not kept.
What you did on the site — ran a scan, opened a report, clicked a pricing button — recorded as event names, never as form contents or free text. Email addresses are stripped from event data before it is written.
These records are kept for thirteen months so we can compare a month with the same month a year earlier, then deleted automatically.
What a free scan keeps
When you run a free Bilby scan, we keep the scan itself: the store address you entered, the pages Bilby walked, their screenshots and load times, the findings and the evidence for each, and the store's name as its own home page title states it. Your IP address is recorded on the scan for abuse control (rate limits on the free scan) and is not shown in the report. If you choose to give an email address to receive the report, we keep it with that scan. Reports are the product — they are not deleted on a schedule — but you can ask us to delete any scan of a store you own at any time.
How we join this up
For each store domain that is scanned we keep one store record that brings the above together: the domain, the store name, the platform (Shopify or other), when it was first and last scanned, how many findings the last scan found, the country and city the scan was started from, how that visit reached us, and an email address if one was given. Its purpose is to let us see which stores are trying Bilby and how far they get (visited → scanned → email known → signed up → trial → paying). It describes a store, not a person, and it is not sold, shared or enriched from any outside data broker.
Whether we will email a store
Leaving an email for a report does not put you on a marketing list: that address receives that report and, if you ticked the box, the monthly check-up you asked for — nothing else. Separately, Navaal may write once to a store whose scan found a real problem, but only through our outreach system, which applies the law of the store's own market (Australian Spam Act, US CAN-SPAM, UK PECR, Canadian CASL; EU stores are never cold-emailed), uses only a business contact the store publishes itself, sends at most one note and one follow-up, and honours a permanent one-click unsubscribe. There is no other path from a scan or a visit to an email from us. Every such note carries a one-click unsubscribe that is honoured permanently; to stop Bilby walking your store at all, see BilbyBot & opt-out.
Your choices
You can browse with the beacon blocked (any content blocker that stops requests to /api/tools/event does it; the site works without it). You can ask us to show, correct or delete anything above — the store record, a scan of your store, an email address — by writing to hello@navaal.ai, and to stop Bilby walking your store at all by following navaal.ai/bilby/bot.
Who processes it for the website, and where
Navaal operates from Australia. Some of the companies that run the website and the scan are outside Australia, so data we send them leaves the country. For each one we rely on the transfer basis it publishes, linked here:
Cloudflare (Global) — Cloudflare's Customer Data Processing Addendum, which incorporates standard contractual clauses: www.cloudflare.com/cloudflare-customer-dpa/.
Fly.io (Sydney, Australia) — a United States company whose machines for this site run in Sydney; its Data Privacy Framework certification and privacy terms: fly.io/legal/data-privacy-framework/.
Stripe (United States) — Stripe's Data Processing Agreement, which incorporates standard contractual clauses: stripe.com/legal/dpa.
Resend (United States) — Resend's Data Processing Addendum and its EU-US Data Privacy Framework certification: resend.com/legal/dpa.
If a processor changes, this list and this section change with it and the date at the top changes too. This page describes what we do; it is not legal advice.
| Company | What it does | Where |
|---|---|---|
| Cloudflare | The CDN in front of the site, which is where the country header comes from. | Global |
| Fly.io | Hosts the website and the scan's database. | Sydney, Australia |
| Stripe | Billing for Bilby plans — we never see card numbers. | United States |
| Resend | Sends the report and outreach emails described in Part 1. | United States |
Part 2 — The Navaal: AI SEO, AEO & GEO app
The short version
Navaal: AI SEO, AEO & GEO reads your Shopify product catalogue, writes SEO content for it, and stores what it wrote so you can review, publish and roll it back.
We do not store your customers' personal data. We never request Shopify's customer or order scopes — the app asks only for write_products and write_content, so we cannot read your customers or orders even if we wanted to.
We do not sell data. We do not use your content to train AI models.
What we store
Everything this app keeps, in plain words. Rows marked personal can contain information about a person rather than a shop.
| Where | What it holds | Type |
|---|---|---|
Session | Your shop domain and the access token Shopify issues us. If Shopify sends us the details of the staff member who installed the app, that can include their name and email address. | personal |
Shop | Your shop domain, when you installed, how you found us, your plan milestones (including when you first opened the app, first approved and published content, and first came back on a later day — timestamps only), your store's SEO score over time, and — if you choose to add them — your own AI provider key and your own Bing Webmaster API key, each encrypted. | shop only |
BrandVoice | The brand voice settings you type in: store name, tone, audience, what makes you different, phrases to avoid. | shop only |
GeneratedContent | The product descriptions, titles, meta descriptions, FAQ content and image alt text this app generated for your products, and their review status. | shop only |
ContentVersion | Previous versions of that content, so you can roll back. | shop only |
ContentTemplate | Generation presets you save. | shop only |
CollectionVoice | Per-collection tone overrides you set. | shop only |
BlogPost | Blog posts this app drafted for you. | shop only |
GenerationJob | Bulk jobs you started: which products, what was requested, whether it finished. | shop only |
Plan | Your plan name, status, and the Shopify subscription id. We never see or store card details. | shop only |
UsageRecord | One row per generation: what was generated, how many credits it cost, and the token counts it used. | shop only |
ProductScore | Each product's SEO score before and after we worked on it. | shop only |
GrowthState | Whether you have completed setup steps such as enabling the theme embed, and your answer to the one check we ask you to make yourself in Search Console — whether Google's AI features are switched off for your site — with its date; and the numbers you choose to type in from the two AI-visibility reports we teach you to read (Google's generative-AI report and Bing's AI Performance), with their dates. | shop only |
UpgradePrompt | Which upgrade prompts you were shown, so you are not shown the same one repeatedly. | shop only |
ReviewRequestAttempt | Whether we have asked you to review the app, so we do not ask twice. | shop only |
SupportRequest | Questions you send us through Get help: the email address you give for a reply, your subject and message. | personal |
ProductWatch | A daily snapshot of each product's title, URL handle, status, description length, whether it has a product type and alt text, what we noticed changed, which fields an AI shopping surface asks for that the product lacks, what its public page says about indexing (sitemap membership, robots directives, canonical address, redirects), and whether you told us a product has no barcode by design — so we can tell you the day something in your catalogue needs you. | shop only |
CrawlExperiment | When you turn on Bing crawl-time measurement: one record per batch of changed product pages, the random seed used to split them into a submitted half and a withheld half, and the result. | shop only |
CrawlExperimentUrl | For each page in such a batch: its address, which half it was in, when it changed, when it was submitted to Bing, and when Bing reported first crawling it. | shop only |
CrawlerAccess | A daily record of whether search and AI crawlers can reach your storefront, and what your robots.txt allowed. | shop only |
GDPRRequest | A record that Shopify sent us a privacy request, with identifiers only — never the customer email or phone in the payload. | shop only |
LogEvent | Operational logs: warnings and errors, with your shop domain. Kept 30 days. | shop only |
What we send to our AI provider
To generate content we send Anthropic your product titles, descriptions, product types, vendors, tags and prices; the URLs of product images when you ask for alt text; and the brand voice settings you have entered.
We do not send customer data, order data, or anything Shopify has not given us access to under the two scopes above.
Anthropic processes this to produce the content and, under their commercial terms, does not use it to train their models.
If you add your own Anthropic key on the Professional plan, the same content goes to Anthropic under your account instead of ours. Your key is encrypted with AES-256-GCM before it is stored, is never written to a log, and is never sent back to your browser — not the key, not part of it, not its length.
If you turn on Bing crawl-time measurement
You can add your own Bing Webmaster Tools API key. With it, and only after you switch measurement on, we send Bing the addresses of product pages whose content we published — a random half of each batch — and read back when Bing first crawled each page. Nothing else is sent to Bing, and nothing is sent for a store that has not switched it on.
The key is stored exactly like the Anthropic key: encrypted, never logged, never returned to your browser. Remove it in Settings and measurement stops.
While measurement is on, we send one email a week to your store's contact address, only in a week that has a result to report, with links to the screens that show it.
Who else processes it
These companies process data on our behalf. Each does one job.
| Company | What it does | Where |
|---|---|---|
| Anthropic | Generates the content. Receives your product text, images for alt text, and your brand voice settings. | United States |
| Fly.io | Runs the application. | Sydney, Australia |
| Neon | Hosts the database. | United States |
| Upstash | Queues background jobs. | United States |
| Cloudflare R2 | Stores encrypted nightly database backups. | Global |
| Resend | Delivers operational email, including your support questions. | United States |
| Sentry | Receives error reports, which can include a shop domain. | United States |
International transfers
Navaal operates from Australia. Some of the companies above are outside Australia, so data we send them leaves the country. For each one we rely on the transfer basis it publishes, linked here:
Anthropic (United States) — Anthropic's Data Processing Addendum, which incorporates standard contractual clauses: www.anthropic.com/legal/data-processing-addendum.
Fly.io (Sydney, Australia) — a United States company whose machines for this app run in Sydney; its Data Privacy Framework certification and privacy terms: fly.io/legal/data-privacy-framework/.
Neon (United States) — Neon's Data Processing Agreement, which incorporates standard contractual clauses: neon.com/dpa.
Upstash (United States) — Upstash's Data Processing Addendum, which incorporates standard contractual clauses: upstash.com/static/trust/dpa.pdf.
Cloudflare R2 (Global) — Cloudflare's Customer Data Processing Addendum, which incorporates standard contractual clauses: www.cloudflare.com/cloudflare-customer-dpa/.
Resend (United States) — Resend's Data Processing Addendum and its EU-US Data Privacy Framework certification: resend.com/legal/dpa.
Sentry (United States) — Sentry's Data Processing Addendum, which incorporates standard contractual clauses: sentry.io/legal/dpa/.
If a processor changes, this list and this section change with it and the date at the top changes too. This page describes what we do; it is not legal advice.
How long we keep it
Your content and settings are kept while the app is installed.
When you uninstall, Shopify sends us a shop redaction request (usually within 48 hours) and we delete your content, settings, plan, usage records and sessions. A small record of the shop survives so that a reinstall does not reset your free trial or your free-tier allowance — it holds your shop domain, timestamps and counters, and no content.
Operational logs are kept 30 days. Privacy-request audit records are kept two years and then pruned.
Encrypted database backups are retained on a rolling basis for disaster recovery.
Your rights
Ask us for a copy of what we hold, or ask us to delete it, at hello@navaal.ai. Uninstalling the app also triggers deletion via Shopify.
If Shopify asks us for a customer's data or asks us to erase it, we respond — and our answer is that we hold none, because we never had access to it.
Changes
15 September 2026: the website's Part 1 (the first-party beacon, the free Bilby scan, the per-store record and the outreach rules — previously a separate page on navaal.ai) joined this page, so one policy covers everything Navaal does.
If we change what we collect or who processes it, this page changes and the date at the top changes with it.