Privacy Policy

This policy explains what information the Civet Shopify app and website at getcivet.com ("Civet", "we", "us") process, why, who we share it with, how long we keep it, and your rights. Civet is operated by Civet in the United States (privacy@getcivet.com).

In short: Civet processes your store's content (products, collections, and similar catalog fields) to translate it. Civet does not access your customers' personal information, orders, or payment details. We don't sell data, and we don't use your content to train AI models.

1. Who this applies to

• Merchants who install Civet. For the store content Civet processes, the merchant controls the data and Civet processes it on the merchant's instructions (acting as a "processor" or "service provider"). For merchant account and support contact information, Civet acts as the data controller.
• Website visitors and waitlist signups at getcivet.com. When you browse our website, run the free multilingual readiness check, or submit the early-access waitlist form (when open), we act as the data controller for the information processed.
• Store customers. Civet doesn't request access to customer or order data through Shopify, so we don't hold information about your customers. See §6 for how we handle Shopify's automated customer privacy webhooks anyway.

2. What we process

What we don't process: customer names, emails, addresses, or orders. Payment card data (Shopify handles all app billing). Shopify "protected customer data".

Note: product content you write could contain personal information (for example, a maker's name in a product description). We process it only as part of your catalog content on your instructions.

3. Why we process it (and legal bases under GDPR)

We don't sell or "share" personal information for cross-context behavioral advertising, as those terms are used in the CCPA/CPRA, and we don't use your content to train AI models.

4. Sub-processors (who we share data with)

We share data only with infrastructure and service providers that help us run Civet, under terms that limit their use of it.

AI provider details: Anthropic processes the catalog text we send to return translations. Under Anthropic's commercial API terms, API inputs and outputs aren't used to train Anthropic's models, and are retained only briefly for trust and safety enforcement.

We'll update this page before adding a new sub-processor that handles merchant data.

5. How long we keep data

6. Privacy requests (GDPR, UK GDPR, CCPA/CPRA, and similar laws)

Store customers: Civet doesn't access or store your customers' personal data. When a customer makes a privacy request to a merchant, Shopify forwards it to us automatically via HMAC-signed webhooks:

• `customers/data_request` (access request): we verify the signature and confirm that Civet holds no customer personal data.
• `customers/redact` (deletion request): we verify the signature and confirm that no customer personal data is held.
• `shop/redact` (store deletion, 48 hours after uninstall): we permanently delete all data for that store from our database, as described in §5.

We complete these within 30 days, as Shopify requires.

Merchants, staff, and website visitors: you can ask to access, correct, delete, or export your personal information, or object to or restrict processing, by writing to privacy@getcivet.com. If you have installed the app, you can also delete all of your store's Civet data by uninstalling the app in Shopify. We'll respond within the time required by law (generally 30 days under GDPR and 45 days under CCPA). We won't discriminate against you for exercising your privacy rights. You may also lodge a complaint with your local data protection authority.

California residents: in the last 12 months we have processed the categories described in §2 (store account identifiers, commercial plan information, and internet/application usage activity) solely for the business purposes in §3. We do not sell or share personal information, and we don't use or disclose sensitive personal information.

7. International transfers

Civet and its primary infrastructure providers (Fly.io, Vercel, and Anthropic) operate in the United States. When personal data from the EEA, the UK, or Switzerland is transferred outside those regions, we rely on Standard Contractual Clauses and, where a sub-processor is certified, the EU-US Data Privacy Framework (and UK/Swiss extensions).

8. Security

We encrypt all traffic in transit (HTTPS/TLS), send security headers (including protection against framing by other sites) on the app and website, and store our production database on an encrypted volume. We verify every Shopify webhook with constant-time HMAC-SHA256 checks, request only the minimal Shopify scopes Civet needs (read_products, read_locales, read_markets, read_translations, write_translations — never write_products or customer scopes), and isolate data per shop. No method of transmission or storage is 100% secure; if a security breach affects your data, we will notify affected merchants and regulators as required by law.

9. Children

Civet is a business-to-business tool for Shopify merchants and is not directed at children under 16.

10. Changes

We'll post updates on this page with a new "Last updated" date, and we'll notify merchants in the app or by email before material changes take effect.

11. Contact

Civet, United States — privacy@getcivet.com (or hello@getcivet.com for general questions).