Privacy Policy | ParticleSearch

ParticleSearch ("we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains what data we collect, how we use it, and what rights you have. We've written this in plain language because we believe you deserve to understand exactly what's happening with your data. By installing or using ParticleSearch, you agree to this policy.

01. 1. Who This Policy Covers

This policy covers two groups of people:

Merchants: Shopify store owners who install and use ParticleSearch.
End Customers: Shoppers who use the search bar on a ParticleSearch-powered Shopify store.

We handle these two groups very differently. Merchants interact with our systems directly. End customers interact only with the search widget embedded in your store, and we treat their data with strict minimalism.

02. 2. What Data We Collect

2.1 Merchant Data

When you install ParticleSearch via Shopify OAuth, we collect and store the following:

Store URL and Shopify domain
Access token (used to sync your product catalog)
Product data: titles, descriptions, prices, variants, SKUs, images, tags, metafields, and inventory status
Email address (if you contact support or subscribe to updates)
Shopify OAuth Scopes: We request the following permissions from your Shopify store:
read_products : to sync your product catalog
read_themes : required by Shopify for embedded apps to function properly

We do NOT collect your Shopify admin password, customer records, order history, payment information, or any personally identifiable information about your customers.

2.2 End Customer Data (Shoppers on Your Store)

When a shopper uses the ParticleSearch widget on your store, we process and log:

Search queries (the words they type into the search bar)
Search results and clicks (to provide merchants with analytics)
Timestamps and session data (aggregated by store, not by individual shopper)

Search analytics are provided to merchants to help improve their product catalog and merchandising. This data is never linked to individual shoppers by name, email, or any personally identifiable information. We do not build user profiles or track shoppers across sessions. ParticleSearch does not set cookies on end-customer devices.

2.3 Technical & Usage Data

We collect standard technical data to operate and improve the service:

API request logs are retained by our hosting provider for a limited time (typically 7-30 days) for debugging and security purposes, then automatically deleted
Error logs (to diagnose issues)
Search analytics (search queries, results, clicks — linked to your store for reporting and internal use)
Performance metrics (query response times, sync latency) are aggregated, anonymized, and retained.
Search analytics are linked to your store and provided to you for reporting purposes. This data is never linked to individual shoppers. We may aggregate and anonymize search analytics across multiple stores for service improvement, industry benchmarking, and research purposes.
API request logs and error logs may contain merchant identifiers (such as store URLs) and are retained by our hosting provider for a limited time (typically 7-30 days) for debugging and security purposes, then automatically deleted.

03. 3. How We Use Your Data

We use merchant data for the following purposes:

To sync your Shopify product catalog with our search index
To deliver search results to your customers in real-time
To send product update notifications to your search index when inventory or prices change
To provide search analytics to merchants
To respond to support requests
To send service-related communications (billing, security notices, updates)

We do NOT sell your data. We do NOT use your data to train AI models. We do NOT share your data with advertising networks.

04. 4. How We Store and Protect Your Data

4.1 Security Standards

All data in transit is encrypted using TLS 1.3
Shopify OAuth tokens are stored securely in an encrypted database with access restricted to authorized systems only
Access to production systems is restricted to authorized personnel
We use anti-abuse rate limiting to prevent unauthorized access

4.2 Data Location

Your product catalog data is stored and indexed on our infrastructure. Search queries are processed in real-time and are aggregated by store for analytics purposes. We use third-party infrastructure providers (including cloud hosting and Typesense for our search engine). These providers are contractually bound to protect your data and process it only on our instructions.

4.3 Retention

Product catalog data: retained while your account is active, deleted within 30 days of account termination
API logs: retained for 30 days, then deleted
Search analytics: retained while your account is active. Aggregated, anonymized analytics may be retained indefinitely for service improvement, industry benchmarking,research, and other purposes.
Email addresses: retained until you unsubscribe or request deletion
OAuth tokens: deleted immediately upon uninstall

05. 5. Shopify Integration

ParticleSearch connects to your Shopify store via OAuth 2.0. We request the minimum necessary scopes to operate the service:

read_products : to sync your product catalog
read_themes : required by Shopify for embedded apps

We do not request write access to your products or any other sensitive store data. We cannot modify your products, orders, customers, or any other store data. We cannot process payments or access customer personal information stored in Shopify. When you uninstall ParticleSearch from your Shopify store, your OAuth token is immediately invalidated and deleted from our systems. Your product data is removed within 30 days.

6. Third-Party Services

We use third-party services to operate ParticleSearch. A current list of sub-processors is available at particlesearch.com/subprocessors. Key sub-processors include:

Typesense: Our search engine. Product catalog data is indexed in Typesense to power search queries. Typesense processes data only on our instructions and does not use it for any other purpose.
Cloud Infrastructure: We use industry-standard cloud providers for hosting and data storage. These providers are SOC 2 compliant and bound by data processing agreements.
Payment Processing: Shopify billing system or other authorized payment processors

We do not use advertising networks, analytics companies that build user profiles, or any service that would share your data with third parties for marketing purposes.

You may object to new sub-processors by contacting support@particlesearch.com within the notification period.

7. Your Rights

You have the following rights regarding your data:

Access

You can request a copy of the data we hold about you and your store.

Correction

If any data we hold is inaccurate, you can ask us to correct it.

Deletion

You can request deletion of your data at any time. Uninstalling the app triggers automatic deletion of OAuth tokens and initiates product data deletion within 30 days.

Portability

You can request an export of your data in a machine-readable format.

Objection

You can object to specific uses of your data (e.g., analytics, communications).

To exercise any of these rights, contact us at: support@particlesearch.com. We will respond within 5 business days.

8. GDPR & International Data Transfers

If you are located in the European Economic Area (EEA), United Kingdom, or Canada, you have additional rights under applicable data protection laws (including GDPR). Our legal basis for processing merchant data is:

Contract performance : processing your product catalog is necessary to deliver the service you've purchased.
Legitimate interests : for service improvement, security monitoring, and abuse prevention.
Consent : for optional communications (you can withdraw consent at any time).

For end customers in the EEA: we do not store personal data about individual shoppers. Search queries are aggregated at the store level for analytics. We do not set cookies on end customers' devices. If you have questions about international data transfers, contact us at support@particlesearch.com.

9. Children's Privacy

ParticleSearch is a B2B service designed for Shopify merchants. We do not knowingly collect any data from individuals under the age of 18. If you believe a minor has provided us with personal information, please contact us immediately.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will:

Update the 'Last Updated' date at the top of this document
Make reasonable efforts to send an email notification to merchants with an active account at least 14 days before changes take effect
We may make changes immediately without advance notice if required for security, legal compliance, or to prevent abuse. In such cases, we will notify merchants as soon as reasonably practicable after the change.

For non-material changes (such as clarifications or corrections), we will update the 'Last Updated' date only. Your continued use of ParticleSearch after changes are posted constitutes your acceptance of the updated policy.

11. Contact

If you have questions, concerns, or requests related to this Privacy Policy:

Email: support@particlesearch.com

Website: particlesearch.com

We take privacy seriously and will respond to all inquiries within 5 business days.