Last updated: 23 October 2026

AgentLink processes Shopify shop configuration (including the shop and primary domains), encrypted merchant credentials and BYOK AI keys, agent-profile settings, policy declarations, readiness-audit results, operational traffic metadata, replay-hash evidence, telemetry, and data required to answer Shopify privacy requests. It does not intentionally store payment card data.

​

Permissions and scopes

When you install AgentLink through Shopify you grant the minimum scopes this app reads: read_products (catalog readiness checks and schema feeds), read_inventory (inventory drift), and read_legal_policies (Shopify-hosted policy checks). Scopes are kept to the minimum the service actually reads.

​

Storage, encryption, and isolation

Shop tokens and merchant OpenAI BYOK keys are AES-GCM encrypted before storage. Tenant isolation is enforced at the database level with forced row-level security, and tenant backups are held as encrypted R2 snapshots. Encrypted replay bodies and their hashes are retained as operational evidence.

​

Telemetry and email

We use product telemetry (PostHog), error reporting (Sentry), and log events (Datadog) to secure, meter, and improve the service. Where integrations are enabled we send operational email (for example privacy-export links) and support correspondence through our monitored inbox.

​

Retention, access, and deletion

These periods apply to live operational stores and privacy-export objects. Privacy exports expire after 7 days; expiry removes both the R2 object and its database row. Encrypted replay bodies are cleared after 30 days. Schema drift is deleted after 90 days; audit events and readiness audits after 365 days; usage and metering records (including traffic metadata and integration request ledgers) after 400 days. Age is measured from creation. An hourly lifecycle job removes eligible data; failures remain retryable. Expired privacy downloads are denied immediately. Uninstall records retain the existing shop/redact deletion path; no new uninstall expiry is introduced. Encrypted tenant-backup snapshots retain the existing shop/redact purge path; restoring a backup must remove expired and redacted data before serving it.

Shopify privacy webhooks support access and deletion requests: customers/data_request produces a downloadable export, customers/redact purges matching customer data and artifacts, and shop/redact deletes a shop’s stored data and encrypted R2 snapshots on a positive uninstall signal.

​

Subprocessors

AgentLink uses Shopify, Cloudflare Workers/KV/R2/Durable Objects, Hyperdrive with PostgreSQL (Azure Database for PostgreSQL Flexible Server), OpenAI, and optional providers (ElevenLabs, Resend, Twilio, Sinch, Auth0, Daytona, PostHog, Sentry, Datadog) as subprocessors where a code path uses them. Data is processed to provide the service.

Contact support for access, correction, deletion, or privacy questions.