Vibe SEO Meta — Privacy Policy

This privacy policy explains how Vibe SEO Meta (the "App"), a Shopify app operated by Vibebun, Thailand ("we", "us"), collects, uses, stores and deletes information when a merchant ("you") installs and uses the App on a Shopify store.

This policy covers the App only. Our website, vibebun.com, has its own privacy policy.

1. Information the App accesses

When you install the App you grant it these Shopify permissions: read and write products and read and write online store content. The App uses them only to show and edit SEO information. Through the Shopify Admin API it reads:

• Products and collections: title, handle, description, SEO title and SEO description, and image URLs and image alt text.
• Pages and blog articles: title, handle, description or summary, and the SEO title and description stored in their SEO metafields.

The App writes back only the fields you choose to edit: SEO titles, SEO descriptions and image alt text.

The App does not request access to your customers, orders or payments. It does not read or store any customer personal information. Shopify's app listing may say that these permissions give access to store owner contact details or blog contributor details. The App does not read or store either.

2. Information we store

Your store content is read live from Shopify whenever you use the App, and your edits are written directly to Shopify. The App does not keep a copy of your store content. We store only the following:

Payments are processed by Shopify through Shopify Billing. We never receive or store your card or bank details.

3. How we use information

We use the information above only to provide the App's features: displaying and editing your SEO data, generating AI suggestions, enforcing plan limits, and billing through Shopify.

We do not sell your information, use it for advertising, or build profiles from it. We do not use your store content to train AI models.

4. AI suggestions and third parties

When you ask the App for an AI suggestion, we send the AI provider only what it needs to write the suggestion:

• the item's name and type (for example "product");
• its existing description;
• your custom prompt, if you have set one;
• for image alt text, the image's Shopify CDN URL.

Which provider receives this depends on your plan:

• Built-in AI (Free, Pro and Agency plans): we send the request to the provider we have configured, which is one of Anthropic (Claude), OpenAI or Google (Gemini). That provider processes the data under its own API terms and privacy policy.
• Your own key (Pro + BYOK plan): the request goes to the provider or OpenAI-compatible endpoint you configured, using your account. Your agreement with that provider governs how it handles the data.

We also rely on:

• Shopify, which hosts your store data and processes billing;
• Vibebun, which hosts the App's server and database in Thailand.

We share no information with anyone else, except where the law requires it.

5. Customer data and Shopify privacy requests

The App does not access or store information about your customers. When Shopify forwards a customer's data request or erasure request (the customers/data_request and customers/redact webhooks), we hold no data about that customer, so there is nothing to return or delete.

6. Retention and deletion

• When you uninstall the App, we delete all information listed in section 2 for your store as soon as Shopify notifies us of the uninstall.
• 48 hours after uninstall, Shopify sends a shop erasure request (shop/redact), and we run the deletion again to confirm nothing remains.
• Backups: our database backups may hold copies of this information for up to 30 days before they are overwritten.
• Server logs may contain your shop domain and technical error details. They are kept for up to 7 days.

You can also ask us to delete your information at any time by contacting us (section 10).

7. Security

• All traffic between Shopify, the App and AI providers is encrypted with HTTPS.
• AI provider keys you give us are encrypted at rest with AES-256-GCM. They are decrypted only at the moment a request is sent, and they are never shown back in full. Only the last 4 characters are shown, so you can recognise the key.
• The App signs in through Shopify's OAuth and session tokens and uses expiring access tokens.
• Access to the App's server and database is limited to the people who operate the App.

8. Your rights

Depending on where you live, you may have the right to access, correct, delete or export your information, or to object to its processing. Examples are the EU/UK GDPR and the California Consumer Privacy Act. To use any of these rights, contact us (section 10). We will respond within 30 days.

The App's server and database are located in Thailand, outside the EU and UK. If you are in the EU or UK, your information is therefore transferred to Thailand when you use the App. It is protected in transit with HTTPS, access to it is limited to the people who operate the App (section 7), and AI provider keys are encrypted at rest. You can ask us for more detail on these safeguards by contacting us (section 10).

9. Cookies and tracking

The App runs inside your Shopify admin. It does not use analytics, advertising or tracking cookies.

10. Contact

Questions or requests about this policy or your data:

Vibebun
Email: info@vibebun.com
Thailand

11. Changes to this policy

We may update this policy when the App changes. We will post the new version on this page with a new effective date. If we make a significant change, we will also let you know in the App.