What we collect
FilterIQ uses Shopify catalogue data for search and filtering. Read the Privacy Policy and DPA for the data categories, purposes and permissions that apply.
Security and trust
A clear starting point for your review.
Review our integration approach and the policies that govern data handling. Private-preview access does not imply certification or public App Store approval.
Privacy Policy
Data categories, purposes, retention and request channels.
Read the policyData Processing Agreement
Processing commitments and the subprocessor schedule.
Read the agreementSecurity questions
Contact the team about your assessment and the evidence you need.
Email securityData Handling
How we use it
Product data supports search indexes and filter configuration. Analytics availability depends on event collection and privacy choices. The Privacy Policy and DPA define data-handling commitments.
Where it's stored
When you uninstall the app, your search index and associated data are deleted, typically within 48 hours of Shopify delivering the required shop/redact privacy webhook. Shopify-side delivery retries can extend that timeline. See the Privacy Policy for canonical retention details.
Infrastructure
Supabase (PostgreSQL)
Supabase provides application persistence. Consult the DPA for processor details and contact the team for evidence relevant to your security review.
Meilisearch
Meilisearch provides product search indexing. Hosting and security arrangements are covered by the processor information in the DPA; this page makes no certification claim.
Redis
Redis supports caching and request-control functions. Refer to the DPA and Privacy Policy for processor and retention commitments.
Security review evidence
Contact the team to discuss your transport, storage and access-control requirements. Confirm deployment-specific evidence before relying on a cryptographic or availability guarantee.
Policies and access
GDPR
Read the Privacy Policy and DPA for data processing, privacy requests and the responsibilities of each party.
CCPA
The Privacy Policy explains privacy rights and request channels. Consult its current terms for the handling that applies to your store.
Shopify App Store
FilterIQ is in private preview. Access onboarding does not establish that a public App Store listing or a third-party security certification is available.
Shopify Integration Security
OAuth 2.0
Shopify app installation and session authentication are separate integration flows. Review requested permissions during installation and use the documented access path.
HMAC validation
Every webhook from Shopify is verified using HMAC-SHA256 signatures before processing. Requests that fail validation are rejected immediately.
Session tokens
In-app authentication uses Shopify's session token mechanism with JWT verification. Shop identity is always extracted from verified tokens — never from client-provided parameters.