Privacy Policy

This Privacy Policy describes how TGAI Automation (“we”, “us”, or “our”) collects, uses, stores, and protects information when you use GhostCode, a Shopify application that detects and removes residual code (“ghost code”) left behind by uninstalled apps in your Shopify theme files. By installing GhostCode, you agree to the practices described in this policy. If you do not agree, please uninstall the app.

2.1 Information Accessed Through Shopify APIs

GhostCode requests the following Shopify API access scopes:

• read_themes — to read your theme files and scan them for ghost code
• write_themes — to remove identified ghost code from your theme files upon your request

Through these scopes, we access:

• Theme file names and content — temporarily processed during scans to detect ghost code fragments
• Theme metadata — theme names and IDs to identify which theme is being scanned

2.2 Information Generated and Stored by the App

• Shop domain — your myshopify.com URL, used to associate your data with your store
• Scan results — details of detected ghost code (file paths, code snippets, severity, associated app names)
• Theme backups — copies of theme files modified during cleanup, stored for restoration purposes
• Audit logs — records of actions performed (scans initiated, cleanups executed, backups restored)
• Language preference — your selected interface language
• Health score snapshots — historical health score metrics for your theme

2.3 Information We Do NOT Collect

GhostCode does not collect, store, or process:

• Customer personal data (names, email addresses, phone numbers, shipping or billing addresses)
• Order or transaction data
• Product or inventory data
• Payment or financial information
• Data about your store's visitors or customers
• Browsing behavior or analytics data

We have no access to any customer-facing data. Our API scopes are strictly limited to theme files.

We use the information described in Section 2 solely to:

• Scan your themes for ghost code left by uninstalled apps
• Display scan results so you can review findings and decide what to clean
• Create backups of theme files before making any changes, so you can restore them if needed
• Remove ghost code from your theme files when you request a cleanup
• Maintain audit logs for your reference, so you can review what actions were taken
• Display health metrics and scan history on your dashboard
• Deliver the app interface in your preferred language

We do not use your information for marketing, advertising, profiling, analytics, or any purpose other than providing the GhostCode service.

For merchants in the European Economic Area (EEA), the United Kingdom, or Switzerland, we process your data based on the following legal grounds:

• Contract performance — Processing is necessary to fulfill the service you requested by installing GhostCode (Article 6(1)(b) GDPR).
• Legitimate interest — Processing is necessary for our legitimate interest in providing, maintaining, and improving the app, and ensuring the security and integrity of the service (Article 6(1)(f) GDPR).

We do not sell, rent, trade, or share your data with any third parties.

The only parties with access to your data are:

We may disclose information if required by law, regulation, or legal process (e.g., a court order or subpoena).

6.1 Where Your Data Is Stored

Your data is stored in a PostgreSQL database hosted by Render.com on servers located in the United States.

6.2 International Data Transfers

If you are located in the EEA, the UK, or Switzerland, your data is transferred to the United States. This transfer is conducted in compliance with applicable data protection laws, including through standard contractual clauses or other lawful transfer mechanisms as provided by our hosting provider.

6.3 Security Measures

We implement the following security measures to protect your data:

• Encryption in transit — All data exchanged between your browser, Shopify, and our servers is encrypted using TLS/SSL
• Authentication — We use Shopify's session token authentication; no third-party cookies are used
• Access control — Each merchant can only access their own data; ownership checks are enforced on every request
• Webhook verification — All incoming Shopify webhooks are verified using HMAC signatures
• Input validation — Custom regex patterns are validated against denial-of-service patterns before execution
• Parameterized queries — All database queries use parameterized inputs to prevent SQL injection

7.1 Deletion on Uninstall

When you uninstall GhostCode, all of your data is permanently deleted, including scan results, backups, audit logs, health snapshots, and your shop record. This process is automatic and immediate.

7.2 Shopify Compliance Webhooks

We respond to all mandatory Shopify data privacy webhooks:

• customers/data_request — Since we do not store any customer data, we acknowledge the request and confirm no customer data is held.
• customers/redact — Since we do not store any customer data, no action is required. The request is acknowledged.
• shop/redact — All data associated with your shop is permanently deleted.

All webhook requests are processed and acknowledged with a successful response.

GhostCode does not use cookies, tracking pixels, analytics tools, or any other tracking technologies. Authentication is handled entirely through Shopify session tokens, which are managed by Shopify's embedded app framework. No data is stored in your browser's local storage or cookies.

9.1 Rights Under GDPR (EEA, UK, Switzerland)

If you are located in the EEA, the UK, or Switzerland, you have the right to:

• Access — Request a copy of the data we hold about you
• Rectification — Request correction of inaccurate data
• Erasure — Request deletion of your data (you can also simply uninstall the app)
• Restriction — Request that we restrict processing of your data
• Data portability — Request your data in a structured, machine-readable format
• Object — Object to processing based on legitimate interest
• Complaint — Lodge a complaint with your local data protection supervisory authority

9.2 Rights Under CCPA/CPRA (California, USA)

If you are a California resident, you have the right to:

• Know what personal information we collect, use, and disclose
• Delete your personal information
• Opt-out of the sale or sharing of your personal information — we do not sell or share your personal information
• Non-discrimination — Exercise your privacy rights without receiving discriminatory treatment

9.3 Rights Under Other Privacy Laws

We respect the privacy rights granted by applicable state, provincial, and national privacy laws worldwide, including but not limited to the Virginia Consumer Data Protection Act (VCDPA), the Colorado Privacy Act (CPA), and the Singapore Personal Data Protection Act (PDPA).

9.4 How to Exercise Your Rights

To exercise any of your privacy rights, please contact us at: [email protected]

We will respond to your request within 30 days. You may also uninstall the app at any time to permanently delete all of your data.

GhostCode does not use automated decision-making or profiling that produces legal or similarly significant effects. Ghost code detection is a technical analysis tool that provides recommendations for your review — all cleanup actions require your explicit approval.

GhostCode is a business tool designed for Shopify merchants. It is not directed at individuals under the age of 16. We do not knowingly collect personal data from children.

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by updating the “Last updated” date at the top of this policy. We encourage you to review this policy periodically. Your continued use of GhostCode after changes are posted constitutes your acceptance of the revised policy.

If you have questions or concerns about this Privacy Policy or our data practices, please contact us at: