Scelto privacy policy

Last updated 29 October 2026.

Scelto is a Shopify app that gives AI shopping agents a plain version of a merchant's store and a store agent to ask, and shows the merchant which agents visit. This policy explains what the app collects on a merchant's storefront and in their Shopify admin.

What the app collects from store visitors

• With analytics consent (Shopify's cookie banner): the page address and type, the product handle, a random visitor id kept in the browser's local storage, and browser signals used to tell automated browsers from people (for example whether the browser reports automation, its time zone, graphics renderer name, language count and screen flags). The user agent is classified and then discarded. The referring site's name (not its full address) and the utm_source tag are checked against a list of AI assistants (ChatGPT, Perplexity, Gemini...): only a match is kept, as the assistant's name; anything else is discarded at once.
• Funnel events from Shopify's web pixel, after consent: product viewed, added to cart, checkout started and completed, with the product handle. No order contents, prices paid or customer details are stored.
• Without consent, only if the merchant turns on the bot check: the page address, page type and product handle. The app looks at the request itself and keeps it only when it is clearly automated (a declared bot, automation, a cloud network or a verified agent signature); everything else is discarded at once. Nothing is read from or stored in the visitor's browser.
• Agent hand-off, only if the merchant turns it on: when the app recognises an AI agent, the visitor's browser tab remembers that choice in session storage, and a short-lived signed token links the visit to the agent view.
• Agent view and store agent: requests to these are logged with the page or skill used. The message text sent to the store agent is not stored.

The app uses IP addresses only in memory, to look up the network and country (with the free DB-IP Lite database) and to group one automated visitor's requests for a day as a keyed hash. IP addresses, cookies, names, email addresses, phone numbers, addresses and payment details are never stored.

What the app collects from merchants

The Shopify session the app needs to work (shop domain, access token, the staff member's name and email as Shopify provides them), the merchant's settings and plan. Product and policy data is read from Shopify and kept in the app's database to answer agents; it is deleted when the merchant uninstalls the app.

To show the merchant which orders came from AI, the app reads recent orders' totals, the app or sales channel that created them, and the referring site and utm_source of the visits Shopify attributes to them. No customer details, addresses or order contents are read, and nothing from orders is stored: the totals are computed when the merchant opens the dashboard and kept in memory for a few minutes.

The free store check

Anyone can check a store's public pages at /check. The check reads a handful of the store's public pages, identifying itself as SceltoCheck and following the store's robots.txt, and saves the report (the store's address and what was found on its public pages) so it can be shared by link. Nothing about the person who runs a check is stored: their IP address is used in memory only, to limit how many checks one person can run.

How long data is kept

Visit events are deleted after 90 days. When a merchant uninstalls the app, Shopify asks the app to delete the store's data 48 hours later; the app then deletes its events, settings and sessions.

Who processes the data

The app runs on Fly.io and stores data in a Supabase Postgres database. Data is not sold or shared for advertising.

Visitors' rights

The app stores no data that identifies a store visitor. Visitors with questions should contact the store they visited; merchants can contact us at the address in the app's Shopify App Store listing.