Privacy Policy
Last updated: 27 July 2026
Sichta checks whether a Shopify store's data can be read by AI shopping agents. It reads product and shop configuration data to run those checks — it never asks for, receives, or stores a shopper's personal data. This page describes exactly what happens to the data we do touch, in plain terms, matching what the software actually does.
Sichta is operated as a sole trader by:
Via Vergiò 27
6932 Lugano
Switzerland
Privacy contact: hello@gigliotti.software
We have not appointed a Data Protection Officer. Our processing does not meet the Art. 37 GDPR criteria that would require one; if that changes, this page changes with it.
Which laws apply
Sichta is operated from Switzerland and serves merchants in the EU, so two laws apply at once: the GDPR and the Swiss Federal Act on Data Protection (FADP). We comply with both, and where they differ we apply whichever is stricter. This page is written to the GDPR because that is the higher standard on most points. Our own supervisory authority is the Federal Data Protection and Information Commissioner (FDPIC).
What we process, and our role
Our role depends on whose data it is. There are two kinds, and — importantly — neither includes your customers.
a) Store catalog and configuration data — we are the processor
To run a readiness scan we read, through Shopify's APIs, your products (titles, descriptions, prices, images, alt text, metafields, identifiers), your shop configuration (policies, locales, currency, domain), and your storefront's public files (llms.txt, robots.txt, sitemap, structured data). This is business data about your catalogue, not personal data about a person. We process it only to compute your score, generate llms.txt / agents.md, and — when you ask — apply a fix. You are the controller; we act on your instruction under the Data Processing Agreement.
b) Your merchant account — we are the controller
For your own account we hold the shop domain, the contact email you give us for alerts, your plan, your saved settings, and the scan history for your shop. We decide the purposes here, so we are the controller for this narrow set.
read_products, write_products, read_content and write_online_store_navigation. It does not request access to orders, customers, or any shopper personal data — and cannot read them.What we never collect
We never ask for or receive customer or order data, payment details, government ID numbers, or any special-category data under Art. 9 GDPR. This site and the app run no analytics, advertising, or tracking pixels, and set no tracking cookies. Session cookies exist only to keep you signed in to the embedded app.
Server logs for this website
Our content delivery network (Amazon CloudFront) keeps ordinary server logs of requests to this site: IP address, date and time, the page requested, HTTP status, referring page, and user agent. The legal basis is Art. 6(1)(f) GDPR — our legitimate interest in running the site securely and knowing which pages get read. These logs are deleted automatically after 30 days, are not combined with any other source, and are not used to recognise individuals: our reporting counts pages, referrers and crawlers, never IP addresses. This is server-side logging, not analytics or tracking — no script runs in your browser.
Legal basis and purposes
For your merchant account the basis is the performance of our contract with you (providing the app) and our legitimate interest in operating and securing it. The purposes are strictly: running scans, storing your results and settings, sending the alerts you enable, and billing through Shopify. We do not profile, we do not sell data, and we do not use your data to train machine-learning models.
AI snapshots — off unless you turn them on
The optional AI snapshots feature asks external AI models what they say about your store. It runs only after you give explicit in-app consent, and never before. When it runs, we send the model your public store name, domain, and a generic shopping question (for example, "where can I buy running shoes?"). We do not send customer data, order data, or account credentials.
Snapshot inference uses OpenAI (api.openai.com) and, on paid plans, Google's Gemini API (generativelanguage.googleapis.com) and Anthropic (Claude, with web search) — all of which process in the United States. Only your public store name, domain and a generic shopping question are sent — never customer data. These US transfers rely on Standard Contractual Clauses, and because no personal data is included, the transfer risk is minimal. All three providers process API inputs under terms that prohibit training on your data, and all are listed on our Subprocessors page. You can withdraw consent at any time in the app; snapshots then stop. Note that your app data itself — scans, settings, snapshot results — remains hosted in the EU (see below); only this opt-in inference call leaves it.
Where data is hosted
All app data is hosted in the European Union, in AWS's eu-central-1 region (Frankfurt). Alert and change emails are sent with Amazon SES in that same region.
Sichta is operated from Switzerland, so administering the service means the data is available to us there. Under the GDPR that counts as a transfer to a third country, whatever region the servers are in — we would rather say so plainly than claim a Frankfurt address settles the question. Switzerland holds a European Commission adequacy decision, which is the transfer's legal basis, so no Standard Contractual Clauses are needed.
Retention and deletion
We keep your scan history and settings for as long as the app is installed, so you can see change over time. When you uninstall the app, we delete your shop's data — scans, generated files, settings, and snapshots — in response to Shopify's shop/redact request, which arrives within 48 hours of uninstall. You can also email us to have it deleted sooner.
Your rights
Under the GDPR you may request access, rectification, erasure, restriction, portability, and object to processing. For the store catalog data we process on your instruction, you are the controller — you already hold it in Shopify, and you trigger its deletion by uninstalling. For your merchant account data, contact us at hello@gigliotti.software and we will act. The FADP grants equivalent rights, so the same requests reach us whichever law covers you.
You also have the right to complain to a supervisory authority: in the EU, one in your country of residence, place of work, or where you believe an infringement occurred; in Switzerland, the FDPIC.
Security
Data is encrypted in transit (TLS) and at rest. Access to production is restricted to the operator, over audited sessions, with no public administrative interface. We do not log the contents of your catalogue or webhook payloads.
Changes
When this policy changes materially we update the date above and, for changes that affect you, note it in the app. Continued use after a change means you accept the updated policy.
Contact
Questions about this policy or your data: hello@gigliotti.software.