Privacy Policy

Tilty is a product intelligence platform operated by Brandshine Solutions, a business registered in India (“we”, “us”, “our”). This policy covers our website at tilty.ai, the Tilty web application and the Tilty app for Shopify (together, the “Services”).

You can reach us about anything in this policy at admin@tilty.ai.

For information about people who visit our website, request access or hold a Tilty account, we decide how that information is used (we are the data fiduciary or controller).

For data we receive from a store or channel that a merchant connects to Tilty, the merchant decides what is shared and why, and we process it on the merchant's behalf to provide the Services (we act as a data processor). Merchants are responsible for having the right to share that data with us.

Account information. When you sign in with Google we receive your name, email address and profile picture. We also keep your workspace memberships, roles and any invitations you send (the invitee's email address).

Access requests. If you request access we collect your name, company email, company website and, if you provide it, your store link.

Store data. When you connect a store (currently Shopify) we read, with the permissions you approve: products, variants, images, collections, metafields and category information; store details such as name, domains, currency, markets and languages; store policies; and theme files, only to check whether the Tilty storefront block is switched on. When you publish, we write product content back to your store.

Order data. To show traffic and revenue from AI assistants and search, we read orders and storefront sessions and keep only aggregated figures, such as counts, revenue and traffic source per product and day. We do not store your customers' names, email addresses, postal addresses, phone numbers or payment details.

Search data. If you connect Google Search Console, we read search queries, impressions and clicks for your product pages (read-only access).

Content you create. Prompts, field edits, generated product content, approvals and a history of changes made through Tilty.

Credentials. Access tokens for the stores and Google accounts you connect. These are encrypted before they are stored.

Technical information. Our hosting provider records standard server logs (such as IP address, browser type, the page requested and the time) to run and secure the Services. We do not use advertising or analytics trackers on our website.

• To provide the Services: importing your catalogue, analysing it, generating product content, publishing changes you approve, and reporting on performance.
• To sign you in, keep your account secure and manage workspaces and permissions.
• To review access requests and contact you about them.
• To support you, answer questions and send important notices about the Services.
• To maintain, secure and improve the Services, and to meet legal obligations.

We do not sell personal data, we do not use it for advertising, and we do not use your store data to train AI models.

Where the law requires a legal basis, we rely on performance of our contract with you, our legitimate interests in running and securing the Services, your consent (for example when you request access or connect Google Search Console), and compliance with legal obligations. Where we rely on consent you can withdraw it at any time.

To generate product content we send product information from your catalogue (not your customers' personal data) to our AI provider, Anthropic, through its commercial API. Anthropic processes it to return results to us and, under its commercial terms, does not use it to train its models. Generated content is shown to you for review, and nothing is published to your store without your approval.

We share information only with the providers below, as needed to run the Services, and under agreements that protect it:

We may also disclose information if required by law or to protect our rights, users or the public, and to a successor if our business is reorganised or sold, in which case this policy will continue to apply.

Our servers are in the United States, so information is transferred to and processed there. Where data protection laws require it, we rely on appropriate safeguards for these transfers, such as contractual commitments from our providers.

• Account information: while your account is active, and deleted on request.
• Sign-in sessions: expire after 30 days.
• Store data: while the store is connected. When you uninstall the Tilty app, its access tokens are deleted immediately, and the store's data is deleted when Shopify sends its data-removal request (normally 48 hours after uninstalling).
• Access requests: up to 24 months, unless you ask us to delete them sooner.
• Server logs: kept by our hosting provider for a limited period under its own retention settings.

Depending on where you live, including under India's Digital Personal Data Protection Act, 2023, the GDPR and UK GDPR, and US state privacy laws, you may have the right to:

• access the personal data we hold about you and receive a copy;
• correct or complete it;
• have it deleted;
• withdraw consent, or object to or restrict certain processing;
• nominate another person to exercise your rights if you are unable to; and
• raise a grievance with us and, if you are not satisfied, with your data protection authority.

To exercise any of these rights, email admin@tilty.ai. We will respond within 30 days. If your data reached us through a merchant's store, we may refer your request to that merchant and help them respond.

Tilty does not store personal data about the customers of the stores that use it. When Shopify sends us a customer data request or a request to delete customer data, we handle it as required; because we hold no customer personal data, there is normally nothing to return or delete.

We protect information with encryption in transit (HTTPS) and encryption at rest for store and Google access tokens (AES-256-GCM), limited permissions requested from connected platforms, access controls by workspace and role, and session tokens that are stored only in hashed form. No system is completely secure, but we work to protect your information and will notify you and the relevant authorities of a personal data breach where the law requires it.

We use only essential cookies, to keep you signed in and to secure sign-in and app installation. See our Cookie Policy for details.

The Services are intended for businesses and are not directed to anyone under 18. We do not knowingly collect personal data from children.

We may update this policy as the Services change. We will post the new version here with a new date, and tell account holders about significant changes by email or in the app.

Questions, requests and grievances about your personal data can be sent to our Grievance Officer at Brandshine Solutions: admin@tilty.ai.