AskRate Privacy Policy

Last updated: September 10, 2026

AskRate ("the App") is developed and operated by Commerslab ("we", "us"). This policy explains what data the App collects when installed on a Shopify store, how it's used, and how it's handled per Shopify's and applicable data protection requirements (including GDPR).

Data we collect

• Store data: shop domain, installed plan, and app settings (moderation mode, appearance configuration, banned-word list).
• Product data: product ID, title, and image, read via the Shopify Admin API to display reviews and questions against the right product.
• Reviews and questions: the reviewer's or asker's name, email address, star rating, review/question text, and any uploaded photos, submitted directly through the storefront widget.
• Trendyol data (optional): if a merchant connects a Trendyol seller account, we import that account's product reviews and customer questions so they can be shown alongside Shopify reviews. Trendyol credentials are stored encrypted and used only to fetch this content.
• AI moderation data (optional): if a merchant supplies their own OpenAI API key, review and question text is sent to OpenAI for toxic/risky content flagging and, on request, to draft a suggested reply. No AI output is published automatically — a merchant must review and approve it first.

How we use this data

• To display reviews, ratings, and Q&A on the merchant's storefront.
• To let merchants moderate, reply to, and manage submitted content from the AskRate admin panel.
• To sync ratings onto Shopify product metafields so themes can render them on product and collection pages.
• To operate paid subscription plans via Shopify Managed Pricing.

We do not sell reviewer or asker personal data, and we do not use it for advertising.

Data storage and security

All merchant data (reviews, questions, settings) is stored in a PostgreSQL database, scoped per store. Uploaded review photos are stored with Cloudinary or an S3-compatible provider. Sensitive credentials (e.g. Trendyol API keys, OpenAI keys) are encrypted at rest.

Data retention and deletion

• If a merchant uninstalls the App, their data is retained for a short period in case of reinstall, then permanently deleted once Shopify's shop/redact webhook is received (typically 48 hours after uninstall).
• On a Shopify customers/redact request, that customer's name and email are scrubbed from any reviews or questions they submitted on the affected store.
• On a Shopify customers/data_request, the merchant can view all reviews and questions tied to that customer's email directly in the AskRate admin.

Third parties

The App shares data with the following third-party services, only as needed to provide the features above:

• Cloudinary / S3-compatible storage — for hosting uploaded review photos.
• OpenAI — only if the merchant provides their own API key, for content moderation and draft reply suggestions.
• Trendyol — only if the merchant connects a Trendyol seller account, to import that account's reviews and customer questions.

Contact

Questions about this policy or your data can be sent to info@commerslab.com.