Privacy Policy — Urassist

Last updated: 2026-07-21 · Effective: 2026-07-22

1. Data controller

This app ("Urassist", "we") is operated by Şeymanur Yaman (sole proprietorship).

Address: Fatih Mah. Aladağ Sk. A13 Blok No: 2 A, İç Kapı No: 10, Arnavutköy / İstanbul
Contact: support@urassist.app

2. Whose data we process

Urassist is a B2B tool; our users are Shopify merchants and the agencies serving them. Two data categories exist:

App user (agency/merchant) data — stored by us directly.
Store data (products, collections, orders, etc.) — processed via the Shopify Admin API, not persistently stored (see below).

3. Data we collect

3.1 Directly from you / your account

Account: email, password (hashed — bcrypt/argon2), name.
Connected store: shop domain, Shopify access token (stored encrypted, AES-256-GCM).
Usage records: scrape history, AI generation logs, error/log data.
Integration credentials: Trendyol seller API keys (encrypted).

3.2 Accessed via Shopify Admin API (not persistently stored)

Product, inventory, collection, theme, content, online store page/navigation data.
Store (shop) metadata (the store's own contact/billing address, for the SEO panel and theme footer).

Important: Urassist does not process or store the store's end-customers' personal data (name, email, address, phone). The app does not access Shopify Order or Customer data — it does not request scopes such as read_orders/read_customers. This is the basis of our data-minimization stance.

4. Purposes and legal basis

Purpose	Data	Basis (GDPR)
Account management & auth	Account data	Contract performance
Store management features	Store data	Contract performance
AI description/SEO generation	Product text	Legitimate interest / consent
Security, debugging	Log data	Legitimate interest

5. Sub-processors

Sub-processor	Purpose	Location
Shopify Inc.	Store platform / API	Canada / EU
Vercel Inc.	Hosting	EU (Frankfurt)
Neon Inc.	Database (Postgres)	EU
Anthropic PBC	AI (Claude) — text generation	USA
Microlink	Screenshots (scraper)	EU/US
Trendyol	Marketplace integration (optional)	Türkiye

Transfers to US-based providers (Anthropic, Microlink) rely on those providers published data processing terms and Standard Contractual Clauses (SCCs). Hosting and the database remain within the EU (Frankfurt).

6. Retention

Account data: for the life of the account + deleted 30 days after closure.
Access token: while the store is connected; deleted 48h after uninstall (via the shop/redact webhook).
Log/scrape/AI output: 90 days (suggested).
Statutory retention obligations apply.

7. Your rights (GDPR Art. 15–22)

Access, rectification, erasure, restriction, portability, and withdrawal of consent. Requests: support@urassist.app. End-customers route requests through their store owner; we comply with Shopify's mandatory customers/data_request, customers/redact, shop/redact webhooks.

8. Security

All transfers encrypted with TLS (in-transit).
Access tokens and credentials encrypted at rest with AES-256-GCM.
Staff access is least-privilege; access to protected customer data is logged.

9. Changes

We may update this policy; users are notified of material changes.

10. Contact

Questions: support@urassist.app — Fatih Mah. Aladağ Sk. A13 Blok No: 2 A, İç Kapı No: 10, Arnavutköy / İstanbul.