Privacy Policy

Last updated: April 10, 2026

Overview

Brand Studio ("the App") is a Shopify app that helps merchants generate brand-consistent product and collection imagery. This policy explains what data we collect and how we use it.

What We Collect

When you install the App, we collect information necessary to provide the service:

• Shop domain — your store's myshopify.com address
• Access token — to interact with your store via the Shopify Admin API
• Plan and usage data — your subscription tier and monthly generation count
• Generation history — prompts and timestamps of images you've generated, for your own reference
• Uploaded and generated images — temporarily stored in our secure cloud storage to process generations
• Custom API keys (optional) — if you provide your own Gemini or OpenAI API keys for the BYOK feature, they are stored encrypted and only used for your generations

What We Do NOT Collect

We do not collect, store, or process any personal data about your customers. The App only interacts with product data and the merchant account.

How We Use Your Data

• To provide image generation services
• To enforce subscription limits
• To save generated images to your products via the Shopify API
• To provide support and improve the App

Third-Party Services

We send your uploaded images and prompts to AI providers (Google Gemini, optionally OpenAI/DALL-E) to generate the requested artwork. These providers process the images according to their own privacy policies and do not retain them after generation.

Data Retention

• Active merchants: We retain your data for as long as you have the App installed.
• After uninstall: We automatically delete all your data (merchant record, generation history, images, presets) within 48 hours of uninstalling, per Shopify's GDPR webhook requirements.

Your Rights (GDPR)

You have the right to access, correct, or delete your data. If you are based in the EU, you can request a copy of your data or its deletion at any time by contacting us. Uninstalling the App also triggers automatic deletion within 48 hours.

Security

All data is transmitted over HTTPS. API keys and access tokens are encrypted at rest in our database (Supabase). Image storage is access-controlled via signed URLs that expire after 1 hour.

Contact

Questions about this policy? Email contact@dreamstate.dk.