Privacy Policy

1. Data controller

The data controller is RIPLI LTD, a company registered in England and Wales (Company No. 17120779), with its registered office at 128 City Road, London, EC1V 2NX.

Contact: admin@ripli.ai

2. Data we collect

• Account data: Name, email address, and authentication credentials when you create an account.
• Uploaded content: Product images, logos, packaging photos, and other media you upload for AI processing.
• Shopify app data: Shop domain, Shopify shop ID, granted app scopes, product and media IDs, selected product metadata, app installation state, Shopify billing state, and webhook delivery metadata needed to operate the embedded Shopify app.
• Usage data: Generation history, credit usage, feature interactions, and session analytics.
• Payment data: Processed by Stripe for direct Ripli billing and by Shopify Billing for Shopify-installed merchants. Ripli does not store your card number, CVV, or full card details on our servers.
• Communications: Emails and support messages you send to us.

3. Shopify embedded app

If you install Ripli from Shopify, Shopify provides app installation and session data so the app can open inside Shopify Admin, load selected products and media, publish generated media back to products, and bill subscriptions or credit top-ups through Shopify Billing.

Ripli currently requests the narrow Shopify scopes read_products, write_products, and write_files for product access, product media updates, and file uploads. Ripli does not request protected customer data scopes such as orders or customer records for the current app experience.

Shopify privacy webhooks are processed at /api/v1/shopify/app/webhooks. Customer data request and redaction webhooks are scrubbed during processing. Shop redaction removes or redacts Shopify installation data, staff user records, channel mappings, publish job records, imported Shopify media references, and Shopify billing mirrors within 30 days unless a longer retention period is required for legal, fraud-prevention, accounting, or dispute purposes.

4. Lawful bases for processing

• Contract performance: Processing your data to provide the Ripli service, generate outputs, and manage your account.
• Legitimate interest: Analytics, fraud prevention, service improvement, and maintaining platform security.
• Consent: Marketing emails and optional communications. You can withdraw consent at any time.

5. AI processing and your content

Ripli does not use your uploaded content to train AI models. Your images and media are processed solely to generate the outputs you request. Generated outputs are stored in your account and are not shared with other users or used for model training.

AI model providers process your content only to fulfil generation requests and do not retain your data for their own training purposes under our data processing agreements.

6. Third-party processors

• Stripe: Payment processing. See Stripe's privacy policy.
• Shopify: Embedded app installation, authentication, Admin API access, app billing, and mandatory privacy webhooks for Shopify-installed merchants.
• AI model providers: Image, video, and creative generation. Providers may include OpenAI, Anthropic, Google/Gemini/Veo, Black Forest Labs/fal.ai, xAI/Grok, Qwen, Venice, Sora, and similar providers depending on the selected workflow.
• Hosting and storage providers: Cloud infrastructure for serving the platform and storing uploaded or generated outputs.
• Analytics: Privacy-respecting analytics to understand how the platform is used.

7. International data transfers

Your data may be processed outside the United Kingdom by AI model providers and cloud infrastructure services. Where transfers occur, appropriate safeguards are in place, including standard contractual clauses or adequacy decisions recognised by the UK Government.

8. Data retention

• Account data: Retained while your account is active and for a reasonable period after closure for legal and operational purposes.
• Uploaded content: Retained while your account is active. Deleted upon account closure unless required for legal compliance.
• Generated outputs: Retained while your account is active. Available for download during your subscription period.
• Shopify app data: Retained while the app is installed and redacted or deleted after Shopify privacy webhooks, uninstall, or written deletion request, subject to the 30-day Shopify privacy webhook window and legal/accounting retention needs.
• Payment records: Retained as required by UK tax and accounting regulations (typically 6 years).

9. Your rights

Under UK GDPR, you have the right to:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Request correction of inaccurate personal data.
• Erasure: Request deletion of your personal data ("right to be forgotten").
• Portability: Request your data in a structured, commonly used, machine-readable format.
• Objection: Object to processing based on legitimate interests.
• Restriction: Request restricted processing in certain circumstances.

To exercise any of these rights, contact us at admin@ripli.ai. We will respond within one month.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

10. Cookies

Ripli uses essential cookies required for the platform to function (authentication, session management). We use privacy-respecting analytics that do not require cookie consent under UK regulations. We do not use third-party advertising cookies.

11. Changes to this policy

We may update this privacy policy from time to time. Material changes will be communicated via email or a notice on the platform. The "Last updated" date at the top of this page indicates when the policy was last revised.

Contact

For any questions about this privacy policy or your data, contact:
RIPLI LTD
128 City Road, London, EC1V 2NX
admin@ripli.ai