Skip to content
ShipLensGet ShipLens for Shopify

Privacy Policy

Effective date: October 24, 2026

1. Introduction

ShipLens – Shipping Estimator (“ShipLens”, “the app”) is a Shopify app provided by Smallworks Studio (“we”, “us”). It helps merchants estimate the weight and package dimensions of their products, and flags potential shipping risks, using AI. This policy explains what information the app collects, how it is used and shared, and the choices you have. It applies to merchants who install ShipLens and to visitors of this website.

ShipLens is built for merchants. It does not collect personal information about your customers, and it does not read your orders or customer records.

2. Information we collect

We collect only what is needed to provide the app:

  • Store information: your store’s myshopify.com domain, the Shopify plan name, the app permissions (scopes) granted, and when the app was installed or uninstalled.
  • Authentication data: the access tokens and session records Shopify issues so the app can securely read your products on your behalf.
  • Product information: the details of the products you choose to analyse (see section 3), and the estimates produced for them.
  • Usage records: for each analysis, the AI model used, the number of tokens processed and the estimated cost, together with a reference to the product.
  • Feedback: any message you send through the in-app feedback form, and an optional product reference.
  • Website feedback: if you use the feedback form on our Support page, we store your message, your email address if you choose to give one, and a time stamp. You do not need a Shopify account to use the form. To limit abuse we also store a keyed (hashed) form of your IP address, which we use only for rate limiting and cannot read back as an address. Please do not put passwords, access tokens or other sensitive information in your message.
  • Technical logs: our servers keep operational logs, such as the request path, response status, IP address and timing, to run the service, fix errors and protect it from abuse. We design our logging to avoid sensitive content: application logs redact fields that look like secrets or tokens, truncate long text, and are not intended to contain product descriptions or feedback text, and web access logs record the request path without the query string. These are safeguards, not guarantees, and a log entry could occasionally include information we did not intend to record.
  • Emails you send us: if you contact support, we keep your message and email address so we can reply.

This website (the public pages) does not use cookies or third-party analytics or advertising trackers. The embedded app uses the cookies and storage that Shopify’s admin and session mechanisms require to work.

3. Shopify store and product information

ShipLens requests a single read-only permission, read_products. It cannot change your products, and it does not request access to orders, customers or payments.

When you ask ShipLens to analyse a product, it reads this product information from your store:

  • title, vendor/brand, product type, category, tags and the collections the product belongs to;
  • the product description (the first 3,000 characters are used);
  • options and variants: variant names, SKU, price, and whether the variant requires shipping;
  • selected product attributes (metafields) in the custom, specs and import_information namespaces;
  • customs-related fields such as the HS code and country of origin, when present;
  • product image links (up to four images per product);
  • the weight and dimensions fields you have recorded in Shopify, which are read so the app can show how an estimate compares with them.

The weight and dimensions fields recorded in Shopify are used for that on-screen comparison and are not sent to the AI provider as separate values. However, the text we send is not filtered for measurements: if a product’s title, description, options, variant names or selected attributes mention a weight or size, that wording is included in the request, and a short summary of any such mentions is added to help the model.

4. How we use information

  • to generate and display weight, dimension and shipping-risk estimates for the products you select;
  • to save results so you do not need to analyse the same unchanged product again;
  • to authenticate you and keep the app connected to your store;
  • to monitor reliability, investigate errors, prevent abuse and keep the service secure;
  • to review the cost of AI processing and the quality of estimates;
  • to respond to support requests and feedback, including feedback sent through the website form, and to limit spam and abuse of that form;
  • to meet legal obligations, including Shopify’s data-protection requirements.

We do not sell your information, and we do not use it for advertising.

5. AI processing and third-party services

To produce an estimate, ShipLens sends the product information described in section 3 to an AI provider. ShipLens uses either OpenAI or Anthropic, depending on our server configuration, which we may change. For each analysis, product information is sent only to the one provider selected at that time, never to both.

The request contains the product text and variant details listed in section 3 and links to the product images, which the provider retrieves from Shopify’s image servers. We do not send access tokens, the weight and dimensions fields recorded in Shopify, or any customer or order data.

When using OpenAI we set its store option to false, which asks OpenAI not to keep the response for later retrieval. This does not guarantee that OpenAI retains no data: OpenAI and Anthropic process requests under their own terms and privacy policies and may keep request data for a period, for example for abuse and safety monitoring. Please review their policies. You choose which products are analysed, and product information is sent only when you start an analysis.

Other service providers that handle data on our behalf:

  • Shopify, which hosts your store and provides sign-in and the data we read;
  • Our hosting provider, which runs the server that stores the data described in this policy;
  • Cloudflare, which provides DNS, network protection and email routing for our domain, and so handles traffic to this site.

We share information with these providers only as needed to run the service, or where required by law. We do not sell it or share it for advertising.

6. Data storage and security

Data is stored in a PostgreSQL database that runs on the same server we operate. Traffic to the app is served over HTTPS, the application connects to the database through a local connection on that server rather than over the internet, and secrets such as API keys and database credentials are kept in the server’s environment configuration with restricted file permissions rather than in source code. Shopify webhooks are verified using Shopify’s signature before they are processed.

Shopify access tokens are stored in our database so the app can read your products. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a breach affecting your data, we will notify you as required by law.

7. Data retention

We keep data for as long as the app is installed on your store and it is needed to provide the service:

  • Session and token records are kept while the app is installed and are deleted when we process Shopify’s uninstall notification (see section 8).
  • Saved predictions, usage records and feedback are kept while the app is installed, and until deleted as described in section 8. We do not apply a fixed expiry date to them.
  • Server logs are kept for a limited period and then removed by automatic log rotation. We do not promise a specific retention period, and logs may exist until they are rotated out.
  • Website feedback submitted through the Support page is kept until we delete it. It is not linked to a Shopify store, so it is not removed by the uninstall or shop/redact notifications; you can ask us to delete it by email. We do not apply a fixed expiry.
  • Support emails are kept for as long as needed to handle your request and for a reasonable time afterwards.
  • Data held by AI providers is retained according to their own policies (section 5).

8. App uninstall and data deletion

Deletion relies on notifications (webhooks) that Shopify sends to us:

  • Uninstall. When you uninstall ShipLens, Shopify notifies us. When we have processed that notification successfully, your sessions and access tokens are deleted and your store record is marked as uninstalled. Your saved predictions, usage records and feedback remain in our database temporarily after uninstall, and are deleted when the shop/redact notification below is processed successfully.
  • Store data erasure. Shopify later sends a store-data erasure notification (shop/redact), typically about 48 hours after uninstall. When we have processed it successfully, we delete your store record and, with it, all predictions, usage records and feedback associated with your store.

If a notification is not delivered or cannot be processed, the corresponding deletion does not happen until it is retried or handled manually. Shopify retries failed webhook deliveries, and you can ask us to delete your data directly at any time.

ShipLens does not store customer personal data. When Shopify sends customer data requests or customer erasure requests, we acknowledge them, and there is no customer data for us to return or delete.

To request deletion, email [email protected] from an address associated with your store, naming your myshopify.com domain. Feedback you sent through the website form can be deleted on request if you tell us the email address you used or quote part of your message. Data in server logs and in provider or database backups is removed as those expire or rotate, and data already sent to AI providers is handled under their policies.

9. Your rights as a merchant

Depending on where you live, you may have the right to access, correct, delete or export the personal information we hold about you, to object to or restrict certain processing, and to complain to your local data-protection authority. To exercise these rights, contact us at [email protected]. We may need to verify that you are the owner of the store before acting on a request.

10. International data processing

We and our service providers, including OpenAI and Anthropic, may process and store information in countries other than your own, including the United States, which may have different data-protection laws. Where required, we rely on appropriate safeguards for these transfers.

11. Children’s privacy

ShipLens is a business tool for merchants and is not directed at children. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us information, contact us and we will delete it.

12. Changes to this policy

We may update this policy from time to time. We will post the updated version on this page and change the effective date above. If a change is material, we will take reasonable steps to let merchants know, for example by notice in the app or by email.

13. Contact us

Smallworks Studio
Email: [email protected]