Privacy policy

Who we are

lunalink.ai (the trade name of 12824574 Canada Inc.) operates Descriva, a Shopify app published under the lunalink.ai brand. This policy explains what data Descriva accesses, why, and how it's handled. Questions: hello@lunalink.ai.

What Descriva accesses (Shopify permissions)

• Write products — to publish the descriptions, SEO titles, meta descriptions, handles, tags, image alt text and structured data you approve, and to read your products to do so.
• Write content — to publish the blog posts you approve.
• Write online store navigation — to create and edit URL redirects.
• Write files — to upload the Bing IndexNow key file and replacement images you approve to Shopify Files.
• Read themes — to check your live theme for leftover demo content and broken references. Descriva never writes to your theme.
• Read reports (optional) — only if you turn on AI assistant traffic and allow it in Shopify's permission dialog: to read the visits, orders and sales that Shopify attributes to AI assistants, as totals per assistant. You can stop it in Settings → Data & retention.

Descriva does not request access to customers, orders or payments. The optional reports permission returns sales totals grouped by AI assistant; Descriva never asks it for an individual customer or order.

What we store

In Descriva's database we keep: your shop domain, shop name, contact email and session; your settings (brand name and voice, target keywords, tone and length defaults, and competitor domains you track); monthly usage counts (to enforce plan limits); your generation history (the text Descriva produced and published, by product, so you can restore it) and the original text it replaced; bulk-job records and their results; AI visibility check results (the shopper questions asked and which assistants named your store); store-audit and theme-check results; blog posts and collection copy you generate; any support conversations you start in-app; your latest setup score, so Shopify Sidekick can answer without checking your store again; and your billing state (your plan). If you connect them, we also keep a Google Search Console access token, a Google indexing key, a Bing IndexNow key, and your storefront password (used only to audit a password-protected store). Images sent for alt text are not stored by Descriva.

What we do not collect

Descriva does not collect or store your customers' personal information — no names, emails, addresses, or order history. It works only with your product content and the settings you provide.

AI processing

Descriva uses OpenAI to write descriptions, SEO fields, alt text and blog posts, and to answer the in-app support assistant. What's sent is your product content (titles, descriptions, tags, prices and images), your brand voice and instructions, and — for support — your conversation. Never customer data. OpenAI does not use API data to train its models.

AI visibility checks ask the assistants themselves — ChatGPT (OpenAI), Perplexity, Claude (Anthropic) and Gemini (Google), directly or through DataForSEO — shopper-style questions that name your product category and brand. When you ask for an AI-generated replacement image, your brand, product titles and a style prompt go to OpenRouter, which uses a Google image model.

Shopify Catalog, Sidekick and AI assistant traffic

When you run Agent view, Descriva reads your store through Shopify's public agent endpoints: which of your products Shopify Catalog includes and what it holds for them, what your store's catalogue search returns, and your store's policy answers. It reads only your store, only when you ask, and keeps no copy.

If you ask Shopify Sidekick about Descriva, Sidekick asks Descriva for the answer: your AI visibility results, setup score, autopilot status, drafts waiting for review and AI credit usage. Nothing is published or changed from Sidekick, and no customer data is in the answers.

AI assistant traffic totals (the optional reports permission above) are held in the app server's memory for up to an hour so they can be shown to you. They are never written to our database or passed to the providers below.

Sub-processors

Descriva shares data with these providers only as needed to operate:

Data retention

Generation history is kept for 90 days by default and bulk-job records for 30 days (you can change both in Settings → Data retention); after that they're archived for 30 days, then deleted. Support conversations are kept for up to a year, or the shorter period you set. Agent view results and AI assistant traffic totals are never stored. When you uninstall, Shopify sends a shop/redact request about 48 hours later, and we delete all of your shop's data: settings, history, usage, bulk jobs, check results, stored keys and support conversations.

Your rights and data deletion

You can request access to or deletion of data we hold. Because Descriva stores no customer personal data, Shopify's customers/data_request and customers/redact webhooks have nothing customer-related to return or erase, and we respond accordingly; shop/redact removes your shop's data as described above. To make a request directly, email hello@lunalink.ai.

Data location and security

Descriva's data is stored in the United States on Render infrastructure, encrypted at rest and in transit. Access is limited to the running application and the maintainers who operate it.

Billing

Billing is handled by Shopify. Descriva does not see or store your payment-card details.

Changes

We'll post any changes to this policy on this page and update the date above.

Contact

hello@lunalink.ai