Privacy Policy
Last updated: October 13, 2026
This Privacy Policy explains what information the smartshare.social app for Shopify and this website (together, the “Service”) collect, why, who else processes it, and how long it is kept. We collect what we need to pick products, create posts and publish them for you, and nothing about your customers beyond what section 2 lists.
1. Who we are
The Service is operated by Legasoft Limited (“we”, “us”), a company registered in England and Wales under company number 12142132, with its registered office at 31a Long Acre, Covent Garden, London, England, WC2E 9LA. We are the controller of the information described here.
For anything about your privacy, write to [email protected].
2. Information we collect
Your store
When you install the app, Shopify gives us your store's .myshopify.com domain, Shopify id, name, contact e-mail address, country, currency and timezone, and access tokens limited to the permissions you approved (products, inventory and orders, read-only). We store the tokens encrypted. We also keep the settings you choose in the app, your plan and your credit balance.
Products
We read your product catalog and keep the details we need to choose and present products: titles, prices, photos, stock levels, product types, vendors, collections and tags.
Orders
We read orders for two purposes: to rank your products by their sales, and to show you the sales a post brought in. This is all we keep of them:
- Sales totals. How many units of each product sold on each day, to rank best sellers, trending and slow-moving products. No order number, price or customer detail is kept with them.
- Sales from a post. When an order arrives through a link in one of your posts, the order's Shopify id, its total and its currency, kept with that post to show you the revenue it brought in.
- Shopify's message about each new order. Before it is saved it is stripped of everything but the order's Shopify id, its total and currency, and, when the order came through a link in one of your posts, which post. It is deleted 30 days after it has been processed.
- Orders in a customer's erasure request. When a customer asks for their data to be erased, Shopify tells us which of your orders are theirs. We delete the record that ties such an order to a post, and keep the orders' Shopify ids so that this record is not made again by a message that arrives late. A message about such an order that is still waiting to be processed is emptied, if it is among your store's 10,000 oldest waiting messages; any other message about such an order (already processed, beyond those, or arriving later) stays as in the item above until 30 days after it has been processed.
We do not store your customers' names, e-mail addresses, postal addresses or phone numbers, or the web address a buyer arrived through.
Instagram (Meta)
When you connect Instagram, we receive your professional account's id, username and profile picture and an access token, which we store encrypted. We use it to publish posts, carousels and Reels to that account for you and to read the performance figures of the posts we published (such as reach, likes, comments and saves). We do not read or store direct messages, and we do not collect information about the people who view or follow your account.
What the Service creates for you
The images, videos and captions generated for your posts, their schedule and status, and the notifications we send you.
Technical records
Short-lived operational logs of requests to the Service (time, the function called, the result, and the store it concerned), used to keep it running and to investigate faults, and a record of key events in your use of it (installing, connecting Instagram, a post published, a plan or credit purchase). This website sets no advertising or tracking cookies.
3. How we use it
- To provide the Service: choose products by your rules, create posts, publish them to Instagram, show you how they performed, and bill you through Shopify. This is necessary to perform our agreement with you.
- To keep the Service secure, prevent abuse and fix faults, which is our legitimate interest.
- To send you the notifications the Service relies on, by e-mail and in the app.
- To meet legal obligations.
We do not sell your data, we do not use it for advertising, and we do not use it to train AI models.
4. AI-generated content
The Service generates images and videos with AI models, from your product photos and details; a carousel also carries your own product photos. Captions are generated too, except where caption generation is switched off or a caption could not be generated (the caption then comes from your own caption template or from the product's title), and you can edit or replace any caption before it is published. To generate content, your product photos and details are sent to the AI providers named in section 5; nothing about your customers is sent to them. Where the file format allows, generated images carry metadata that marks them as AI-generated.
5. Who else processes it
We share data only with the companies needed to deliver the Service. Each processes it for us, for the purpose shown:
| Provider | What it does for us | What it receives |
|---|---|---|
| Cloudflare, Inc. | Hosting: runs the app, its database, file storage and queues, and serves this website. | Everything the Service stores (listed in section 2). |
| Google LLC (Gemini API, paid tier) | Plans the scene for a post, writes its caption, and checks a generated image or video against your product photo before it can publish. | Your product photos, product details such as title and price, your brand and content settings (store name, tone of voice, the content rules you set), and the images and videos generated from them. |
| fal.ai (Features & Labels, Inc.) | Generates the images and videos, with the image and video models it hosts (models from Google, OpenAI, ByteDance and Black Forest Labs). | Your product photos, the scene instructions written for the post (which can name the product), and, for a Reel, the generated image its video is made from. |
| Meta Platforms (Instagram) | Publishes your posts to the Instagram account you connected, and returns their performance figures. | The image or video and the caption of each post we publish for you. |
| Resend, Inc. | Sends our e-mails to you (posts waiting for approval, problems with an account or an automation, reports). | Your store's contact e-mail address and the content of the e-mail. |
Shopify is the platform the app runs on: your store data comes from it, and billing goes through it under Shopify's own terms and privacy policy. These companies are based in, or may process data in, the United States and other countries outside your own.
We may also disclose information when the law requires it, or to a successor if the Service changes hands, who would remain bound by this policy.
6. How long we keep it
| Data | Kept for |
|---|---|
| Store account, settings, posts, generated images and videos, connected Instagram accounts | While the app is installed. After an uninstall, until Shopify's store-erasure request reaches us (Shopify sends it 48 hours after the uninstall), when all of it is erased. Reinstalling before then keeps it. |
| The index of your products and the per-product daily sales totals | While the app is installed; deleted at the uninstall. The product details a post was made from stay with that post. Sales totals cover the 60 days before the latest sales sync; syncs run while an automation that ranks by sales is active, and without one the totals stay as they are until the next sync or the uninstall. |
| Shopify ids of orders named in a customer's erasure request | Until your store's data is erased. They are kept so that an erased order is never tied to a post again. |
| Instagram access token | Deleted the moment you disconnect the account or its store data is erased. |
| Instagram account id, username and profile picture of a disconnected account | 29 days after the disconnect, so that reconnecting the same account restores its posts and automations; then deleted. |
| History of a post's performance figures | 90 days. The latest figures stay with the post. |
| Notifications we sent you | 90 days. |
| Messages Shopify sends us (webhooks), after they are processed. Of an order's message: its id, total and currency. Of a customer's privacy request: the orders it names. Of a store-erasure request: the store's domain. | 30 days. The erasure request for your store is kept for 30 days after the erasure it asked for, as the record that it was carried out. |
| Messages Instagram sends us about your account, reduced before they are saved to the kind of event, its time and a count (never a username, a comment or a message) | 30 days. |
| Records of background work that failed (which post or message it was, and the error) | Until the failure is resolved, then 90 days. |
| Database backups and point-in-time recovery | Backups older than 30 days are removed at our next release, except the three most recent, which are kept until newer ones replace them. Point-in-time recovery covers the last 30 days. Erased data can remain in these copies until then. |
Besides the copies above, three things remain after your store is erased:
- A one-way keyed hash of your
.myshopify.comdomain and the date your one-time welcome credits were granted. We keep it solely to stop the same store from claiming that one-time offer again by reinstalling (fraud prevention, our legitimate interest). It contains no contact, catalog, order or customer data, cannot be turned back into your store name, and is used for nothing else. - The accounting entries of your credits (granted, bought, used and refunded, with their dates and amounts), under an internal reference that no longer leads to your store.
- The key events mentioned in section 2, with the link to your store removed.
How to have your data deleted is on our Data Deletion page.
7. Security
Data is encrypted in transit. Access tokens for Shopify and Instagram are encrypted before they are stored, our access to your store's products, inventory and orders is read-only, and messages from Shopify and Instagram are verified before they are acted on. No system is perfectly secure; if a breach affects your data we will tell you as the law requires.
8. Your rights
Depending on where you are, you may have the right to access, correct, delete or receive a copy of your data, and to object to or restrict how we use it. Write to [email protected] and we will answer within 30 days. You may also complain to your local data protection authority.
If you are a customer of a store that uses the Service, that store decides how your order information is used; contact the store, and we will help it answer you. Requests Shopify sends us on a customer's behalf are honored automatically.
9. Children
The Service is a tool for businesses. It is not directed at children, and we do not knowingly collect their information.
10. Changes to this policy
We may update this policy. When a change is material, including a new company in section 5, we will tell you in the app or by e-mail.
11. Contact
Privacy questions and requests, and anything else: [email protected].