Effective date: 22 October 2026
This policy explains what data the Cobiro app for Shopify ("the App") collects, why, who we share it with, how long we keep it and what rights you have. It applies to the App only. Our general privacy policy covers cobiro.com and Cobiro accounts created outside Shopify.
-
Who we are
The App is provided by Cobiro ApS, company registration number (CVR) 37518336, Gammel Kongevej 60, 1850 Frederiksberg C, Denmark ("Cobiro", "we", "us"). For the data described here, Cobiro is the data controller. You can reach us through our contact form.
-
What we collect
When you install the App, Shopify grants it only these permissions: read products, write products and write files. The App cannot read your orders, your customers or your store analytics, and it does not collect data about your shoppers.
Kategoria What it contains Where it comes from Store details Store domain, store name, currency Shopify, at install Store owner contact First and last name, email, phone number, business address Shopify, at install, to create your Cobiro account Product catalogue Titles, descriptions, handles, product type, vendor, tags, status, SEO fields, images, variants (SKU, barcode, price, compare-at price, inventory quantity, availability, options, weight) Shopify Admin API Content you create Prompts you type, AI-optimised text, generated images and videos, feed settings You, inside the App Account and billing Plan, subscription status, credit usage and balance Shopify billing and the App Technical data IP address, browser user agent, login and request logs, error reports Your browser when you use the App We do not collect payment card details. Shopify bills you for the App and handles payment.
-
How we use it and our legal basis
Purpose Data used Legal basis (GDPR) Create and run your Cobiro account Store details, owner contact Contract (Article 6(1)(b)) Sync your catalogue, optimise text, assign product categories, score feed quality Product catalogue Contract Generate images and videos and save the ones you approve back to Shopify Product catalogue, content you create Contract Build product feeds and send them to channels you connect, such as Google Merchant Center Product catalogue, feed settings Contract Meter credit usage and report it to Shopify for billing Account and billing Contract Send service emails (account, billing, feed alerts) Owner contact Contract Keep the App secure, prevent abuse and fix errors Technical data Legitimate interest (Article 6(1)(f)) Improve the App using anonymised, aggregated statistics Aggregated data with no store or person identifiers Legitimate interest Comply with tax, accounting and legal requests Account and billing Legal obligation (Article 6(1)(c)) We do not sell your data. We do not use your product data or prompts to train AI models, and our AI providers are contractually bound not to train on it.
-
International transfers
Some subprocessors are outside the EU and the EEA, including in the USA. Where a provider is certified under the EU-US Data Privacy Framework, we rely on that. Otherwise we use the European Commission's Standard Contractual Clauses. You can ask us for a copy of the safeguards.
-
How long we keep it
Data Retention Product catalogue, store connection, owner phone and address Removed when you uninstall the App, and erased when Shopify sends the shop redaction request 48 hours later Shopify access tokens and sessions Deleted on uninstall Your Cobiro login, team and credit balance Kept after uninstall so you can reconnect, until you ask us to delete the account. Erased 30 days after deletion AI prompts 180 days Request logs 180 days. Login logs 90 days, login attempts 30 days Billing records As long as Danish bookkeeping law requires (5 years) Anonymised statistics Indefinitely, because they identify no one -
Shopify privacy webhooks
We respond to Shopify's mandatory privacy webhooks. Because the App holds no data about your customers, customer data requests and customer redaction requests have nothing to return or erase. A shop redaction request erases your store connection, catalogue and owner contact details.
-
Your rights
Under the GDPR you can ask us to access, correct, delete or export your personal data, to restrict or object to its use, and to withdraw consent where we rely on it. Write to us through our contact form and we will answer within one month. You can also complain to the Danish Data Protection Agency (Datatilsynet) or to the authority where you live.
-
Security
Data is encrypted in transit with TLS. Access tokens for your store are stored only on our servers, and feed and media tokens are stored as one-way hashes. Staff access is limited to the people who need it to run the service.
-
Children
The App is for businesses and is not directed at anyone under 16.
-
Changes
We will post changes on this page and update the effective date. If a change materially affects how we use your data, we will tell you by email or in the App before it takes effect.
-
Kontakt
Cobiro ApS, Gammel Kongevej 60, 1850 Frederiksberg C, Denmark. Write to us through our contact form.