Privacy Policy

1. Information we collect

Account information

Your name and email address, and your authentication method (Google, Shopify or email code).

Store data

When you connect Shopify, we read your products, collections, pages, blog articles and related metadata so we can audit and optimise them. We also write content back to your store on your instruction.

Order data (for sales attribution)

To show you which sales came from search engines and AI assistants, we read order-level data from your store: the order's traffic source and referrer, its total and currency, and the order date. We use this only to attribute revenue to the work we do for you. We do not request, store or use your customers' names, email addresses, phone numbers or shipping addresses.

Search and analytics data

If you connect Google Search Console and Google Analytics 4, we read performance data (impressions, clicks, positions, organic sessions and conversions) to measure results and prioritise work. We request read-only access for analytics purposes.

Payment information

Subscription payments are processed by Razorpay. We receive the subscription status, payment identifiers and billing period. We never receive or store your full card details.

Usage data

Logs of actions taken in the app, errors, and operational metrics used to keep the Service reliable.

2. How we use your information

• To provide the Service: audits, keyword research, content creation, publishing and reporting.
• To measure outcomes and improve the recommendations we make for your store.
• To process payments and manage your subscription.
• To send service communications (onboarding, reports, billing and important notices).
• To secure the Service, prevent abuse, and meet legal obligations.

We do not sell your personal data, and we do not use your data to advertise to you.

3. AI processing

To generate content and analysis, we send relevant inputs (such as keywords, your store's public product information, and your brand voice settings) to AI providers including Anthropic and Google. We send only what is needed to produce your output. We do not send your customers' personal data or your payment details to these providers.

4. Service providers we share data with

• Supabase: database and authentication
• Vercel: application hosting
• Shopify: your store platform
• Google: Search Console and Analytics (with your authorisation)
• Anthropic, Google: AI content and analysis
• DataForSEO: keyword, competitor and SERP data
• Razorpay: payment processing
• Resend: transactional email

Each processes data on our behalf under their own terms and security commitments.

5. Data security

• Access tokens for your connected accounts are encrypted at rest.
• Every tenant's data is isolated at the database level, so one customer can never read another's data.
• Secrets are held server-side only and are never exposed to the browser.
• Access to production systems is restricted and logged.

No system is perfectly secure, but we take these safeguards seriously and review them regularly.

6. Data retention

We keep your data for as long as your account is active. After cancellation we retain it for a limited period so you can return without losing history, after which it is deleted. Records we must keep for legal, tax or accounting reasons are retained for the required period.

7. Your rights

You may request to:

• access the personal data we hold about you;
• correct inaccurate data;
• delete your account and associated data;
• disconnect Shopify or Google access at any time from your dashboard; and
• export the content produced for you.

Email admin@pokra.in and we will respond within a reasonable period.

8. Cookies

We use strictly necessary cookies to keep you signed in and to keep the app secure. We do not use advertising cookies.

9. Children

The Service is intended for businesses and is not directed at anyone under 18.

10. Google user data and Limited Use

This section describes exactly how Pokra handles data obtained through Google APIs, in line with the Google API Services User Data Policy.

• What we access. Read-only access to your Google Search Console data (webmasters.readonly) and your Google Analytics 4 data (analytics.readonly): search impressions, clicks, average position and queries per page, and organic sessions and conversions. We never request write or delete access, so we can never change or remove anything in your Google account.
• How we use it. Only to power features you see in your dashboard: showing your search and traffic performance, deciding which pages and keywords to prioritise, and measuring whether our changes improved your results. Where this data informs AI-generated analysis, it is used solely to produce your own recommendations and reports.
• How we share it. We do not sell your Google data and we do not transfer it to any third party for that party's own purposes. It is processed only by the infrastructure providers that runPokra on our behalf (listed in section 4), and it is never used for advertising.
• How we protect it. Your Google access tokens are encrypted at rest, every customer's data is isolated at the database level so no one else can read it, and secrets stay server-side only (see section 5).
• Retention and deletion. You can disconnect Google at any time from your dashboard; this immediately revokes our access and deletes the stored Google tokens. When you delete your account, all associated data, including performance data derived from Google, is deleted, except records we must retain for legal reasons.

Pokra's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use your Google user data (raw or derived) to develop, train, or improve generalised or foundational artificial-intelligence or machine-learning models. We do not allow humans to read your Google data except with your consent (for example, for support), where required for security or to comply with law, or on data that has been aggregated or anonymised.

11. Changes to this policy

We may update this policy. Material changes will be notified by email or in the dashboard, and the “last updated” date above will change.

12. Contact

For any privacy question or request, email admin@pokra.in or see our Contact page.