Privacy Policy

Effective date: September 4, 2026

CutoutGuard is operated by Emre MUTLU. This policy explains how the app handles information when a merchant installs and uses it.

Information handled

• Shop and authorized staff information needed to authenticate the app, including shop domain, access scopes, session tokens, and Shopify user details supplied during authentication.
• Product, collection, SKU, media, and image metadata needed to plan and perform merchant-requested image operations.
• Run history, generated-media markers, restore points, settings, and technical error information needed to operate and support the app.

The app does not request customer or order scopes and does not collect customer or order records.

How information is used

Information is used to authenticate merchants, show eligible catalog media, execute confirmed image operations, prevent duplicate work, support recovery, maintain security, and troubleshoot failures. A dry run does not send images to the background-removal provider and does not modify Shopify media.

Service providers

The app uses Shopify for commerce APIs, Vercel for application hosting, a managed PostgreSQL provider for app data, and Photoroom for current Shopify background processing. When a merchant confirms a live run, the selected product image is sent to Photoroom for processing. Generated-image backups may be stored in Cloudflare R2 when that optional service is enabled.

Retention and deletion

Operational records are retained while needed to provide run history, duplicate protection, and recovery. Verified Shopify privacy webhooks are honored. Shop-scoped database records are deleted when Shopify sends a shop redaction request after uninstall. A merchant may also request access or deletion by contacting support; verified requests are handled within 30 days unless retention is legally required.

Security and international processing

Reasonable technical and organizational safeguards are used, including encrypted HTTPS transport, restricted service credentials, signed internal worker requests, and least-privilege Shopify access scopes. Service providers may process information in countries outside the merchant's own jurisdiction under their applicable safeguards.

Contact

Privacy questions and requests can be sent to me@emre-mutlu.com.tr.