Privacy Policy

Last updated: September 9, 2026 · Controller: Softonomika Limited (Amasty), Nicosia, Cyprus · Applies to the AutoPost Shopify application and this website.

1. Who collects and process your personal data

1. This privacy policy and data protection rules provide the clients installing AutoPost by Amasty [hereinafter referred to as “App”] at Shopify Store [hereinafter referred to as “Store”], customers (including potential customers) of the clients (that is – the users of the online stores) and other subjects with information on which personal data we collect and how we process such personal data [hereinafter referred to as the “Rules”].
2. Your personal data hereunder are collected and processed by Softonomika Limited, a company established and existing under the law of Cyprus, with its registered office at: Afroditis, 25, Office 208, 1060, Nicosia, Cyprus Clarion Business Centre, Company Identification Number: HE 427722, support@amasty.com [hereinafter referred to as the “AMASTY”].
3. AMASTY is a member of group of companies operating under the trademark Amasty®. Members of this group of companies are also Amasty Development Limited [Malta], AmDev LLC [Belarus] and Design Enterprise Limited [United Kingdom] [hereinafter referred to as the “AMASTY Group”].
4. In order to provide for an effective protection of your personal data, these Rules may be subject to future changes and amendments. You will always find the updated version of these Rules on Store. Your continued use of AutoPost by Amasty after the effective date of the updated Rules will be subject to the new Rules.
5. Generally, AMASTY has the position of a controller of the personal data under the Regulation [EU] 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC [General Data Protection Regulation] [hereinafter referred to as the “GDPR”], but in some case may be a processor (for example, in relation to users of the online stores).

2. Which personal data do we collect and process

1. We respect your privacy and aim to limit the personal data that we collect from you to the amount which is strictly necessary to fulfill the purposes of processing. Categories of personal data that we process are specified below.
2. For the avoidance of ambiguity, Amasty collects certain personal data in addition to personal data collected by the Store. The Store may amend its own privacy policy ( https://www.shopify.com/legal/privacy) at its own discretion and Amasty shall not be liable for any terms, conditions and contracts, including but not limited to privacy policy, regulating the clients’ relationship with the Store.
3. For the avoidance of doubt, the present Privacy Policy regulates your relationship established with Amasty at Store only.
4. Your personal data is collected and used by Amasty as follows:

5. We do not use automated decision-making and profiling.

3. Term of personal data processing and place of storage

1. We process your personal data for a definite period of time.
2. Your personal data collected and processed by us in connection with your use (purchase and/or installation) of the App and/or your support inquiries is processed during the period which is needed for proper fulfillment of our contractual duties and obligations towards you and for a period not exceeding ten (10) years afterwards.
3. Other personal data for the remaining purposes is retained by us for no longer than it is necessary to fulfill the purposes specified in the section “Which personal data do we collect and process” or for a longer period to comply with our legal obligations, resolve disputes, establish and defend legal claims. We regularly (at least once a year) review and de-identify unnecessary data to store it for statistical purposes only.
4. Once the term of personal data processing lapses, we delete your personal data from our database and stop processing them.
5. We store and process your personal data either within the European Union member states or within other countries as described below. The storage and processing of your personal data within other countries meets the strict conditions of personal data transfer from the member states of the European Union to other countries under the Standard Contractual Clauses adopted by the European Commission.

4. Third parties and your personal data

1. Third parties may have access to your personal data collected and processed by us.
2. Your personal data may be made available to following companies which are members of the AMASTY Group (such access is needed in order to provide you with our services and / or our products properly and duly):

Amasty Development Limited, with its registered office at: 12, Zachary Street, Valletta, VLT 1133, Malta, Company Identification (registration) Number: C 83668,

Design Enterprise Limited, with its registered office at: Suite 100, The Studio, St Nicholas Close, Elstree Borehamwood, Hertfordshire WD6 3EW, United Kingdom, Company Identification (registration) Number: 4481350,

AmDev LLC [Belarus], with its registered office at: pr. Dzerzhinskogo 104A-1904, 220 116 Minsk, Belarus, Company Identification (registration) Number: 192814386.

All companies which are members of AMASTY Group meet the strict rules of data protection under the GDPR.

3. We also engage third-party cookies providers:

Helpdesk System(s);

5. Your rights under the GDPR

1. You have following rights under the GDPR:

The right of access to your personal data meaning that you can receive a copy of the personal data that we hold about you, as well as other supplementary information.

The right to rectification of your personal data which is incomplete or inaccurate.

The right to erasure of your personal data meaning that you can ask us to delete or remove your personal data in certain circumstances.

The right to restrict processing of your personal data if (a) the accuracy of the personal data is contested by you, (b) the processing is unlawful and you oppose the erasure of the personal data, (c) we no longer need the personal data for the purposes of the processing, but they are required by you for the establishment, exercise or defense of legal claims, and (d) you have objected to processing pending the verification whether the legitimate grounds override this.

The right to data portability. Please note that this right only applies to information that we processed based on your consent or contract.

The right to object to the processing of your personal data where we are relying on a legitimate interest and there is something about your particular situation that makes you want to object to the processing on this ground. We will no longer process the personal data unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defense of legal claims.

If your explicit consent serves the basis for personal data processing, you have the right to recall your consent to process your personal data at any time. If we have no other grounds for processing your personal data, after you send us a request to withdraw consent, we will stop processing your personal data that we were processing under your consent.

Right to lodge a complaint with a supervisory authority if you consider that our processing of your personal data infringes the relevant legislation.

2. You may exercise these rights by means of an email sent to our email address or written notice sent to the address of our registered office. We will address your request as early as possible and no longer that within one month. Please note that this period may be extended by two further months where necessary, taking into account the complexity and number of the requests. In this case, we will inform you of the extension within one month of receipt of your request and will explain to you the reasons for the delay.

3. Note that if you ask us to delete your personal data, we may retain your personal data as necessary to comply with our legal obligations or resolve disputes.

6. Cookies

1. Cookies are text files placed on your computer’s browser to collect standard internet log information and visitor behavior information. We may create and implement our cookies or cookies from third-party providers (for more information please refer to section “Third persons and your personal data”).
2. Some of our cookies are necessary for certain uses of the Web-site. The Web-site cannot function properly without these cookies. We also use cookies for analytical and marketing purposes. This information is used to track visitor use of the website and to compile statistical reports on website activity and the effectiveness of our third-party advertising. Analytical cookies with a 30 days expiration period are also used within our affiliate program to track purchases made with the affiliate link. Other cookies allow you to navigate the Web-site and take full advantage of its capabilities like handling the same visitor session while you browse between pages of the website. For further information visit https://www.aboutcookies.org.
3. You can set your browser not to accept cookies and the above website tells you how to remove cookies from your browser. You can also contact us with the request to disable particular categories of cookies.

7. Age limits

1. We do not knowingly collect or solicit personal data about or direct or target personalized advertisements to anyone under the age of 16, or knowingly allow such persons to use the App. If you are under the age of 16, please do not send any personal data to us. If we learn that we have collected personal data about a child under age 16, we will delete that personal data as quickly as possible. If you believe that we might have any personal data from or about a child under the age of 16, please contact us.

8. Contact us

1. Would you have any questions regarding the processing of your personal data by us, do not hesitate to contact us under the email address: help-center@amasty.com or by means of a written notice sent to the address of our registered office: Afroditis, 25, Office 208, 1060, Nicosia, Cyprus Clarion Business Centre.
2. Be also informed, that since AMASTY is registered under the Cyprus law, the personal data authority overseeing AMASTY regarding the personal data processing is Cyprus Office of The Personal Data Commissioner. In case you have any doubts how we process your personal data, you may contact the Cyprus personal data authority anytime.

A.1 Data the app processes

Store and account data

• Your Shopify store domain, store name, plan, primary locale and currency, and the Shopify access token issued to the app on install
• The email address associated with your store or with a support request
• Your app settings: connected networks, templates, automations, schedules and preferences

Catalog and publishing data

• Product data needed to build a post: title, description, price, compare-at price, status, product type, collections, sales channel publication and the product URL
• Product media (images and video) or references to it, used as post media and, where required, processed and temporarily hosted so a platform can fetch it
• Discount and promotion data when a discount-aware template is used
• The posts themselves: rendered captions, selected media, target networks, scheduled times, publish status and the response returned by the platform
• Aggregated order and sales figures used for in-app statistics; we do not use them for anything else

Technical and usage data

• Server and API logs, including timestamps, request outcomes and error details, kept to diagnose failures
• Product analytics events about how the app's screens are used (for example which page was opened), used to improve the app
• Support correspondence you send us

The app does not collect your customers' personal data for its own purposes. If customer-related information appears in aggregated statistics, it is processed only to render those figures inside your admin.

A.2 Social platform data and permissions

When you connect a social account, the platform issues the app an authorisation credential. For each connected network we store:

• Access and refresh tokens, encrypted at rest, used solely to publish the content you configured and to keep the connection alive
• Account identifiers (for example the TikTok open ID, a Facebook Page ID or a Pinterest account ID)
• Public profile details shown in the app: display name, username and avatar
• Platform responses to publishing requests, including publish identifiers and failure reasons

The permissions requested per network are listed below. In every case they cover identifying the connected account and publishing the content you configured — nothing more. AutoPost does not read your followers, direct messages, private analytics or advertising data, does not access other users' accounts, and does not publish, follow, like or comment outside the automations and posts you set up.

Each integration page explains why every scope is needed. Revoking access on the platform, or disconnecting the account inside AutoPost, deletes the stored tokens for that account and stops all publishing to it.

A.3 Purposes and legal bases

We do not sell personal data, do not rent it, and do not share it for cross-context behavioural advertising.

A.4 AI processing

When a template contains an AI block, the app sends the relevant product attributes and your prompt to a third-party AI provider (currently OpenAI) to generate caption text, and stores the result as part of the post. Only the data needed for that generation is sent — no social tokens, no customer records. We do not use your catalog, captions or generated text to train models, and we ask the same of our provider under its business terms. AI output is a draft: you decide which templates run and can edit any queued post before it is published.

A.5 Service providers

We use a small number of sub-processors, each bound by contract and used only for the purpose listed:

A.6 Retention

• Social tokens — deleted when you disconnect the account, revoke access on the platform, or uninstall the app
• Store configuration, templates, automations and post history — retained while the app is installed, and for a limited period after uninstall so that a reinstall does not lose your setup; deleted after that period or earlier on request
• Technical logs — kept for a short diagnostic window and then rotated out
• Billing records — kept as long as accounting law requires
• Support correspondence — kept while it may still be relevant to your case history

Shopify's mandatory customers/data_request, customers/redact and shop/redact webhooks are implemented, so requests coming through Shopify are actioned automatically.

A.7 Security

• All traffic to the app and this website is served over HTTPS
• Social platform tokens are encrypted at rest with application-managed keys
• Access to production systems is limited to staff who need it, and is authenticated and logged
• The app requests the narrowest Shopify scopes it can operate with: read access to products, files, orders and publications, plus write access to files
• Platform webhooks are signature-verified before being accepted

No system is perfect. If you believe you have found a vulnerability, please write to help-center@amasty.com and give us a reasonable window to fix it before disclosing it publicly.