Last updated: 2026-08-09
The English version of this policy is the authoritative text. Translations are provided for convenience only; if they differ, the English version prevails.
VELIXO SOFTWARE DEVELOPING - FZCO ("allBuilder.ai", "we", "us") operates the allBuilder.ai platform. This policy explains what we collect, why we collect it, how long we keep it, and what rights you have over it.
| Operator | |
|---|---|
| Legal name | VELIXO SOFTWARE DEVELOPING - FZCO |
| Address | Building A1, Dubai Digital Park, Dubai Silicon Oasis, Dubai, United Arab Emirates |
| Privacy enquiries | privacy@allbuilder.ai |
| Support | support@allbuilder.ai |
We never access your customers' data.
allBuilder.ai does not request the read_customers permission, never calls Shopify's customer or order APIs, and does not store the names, addresses, email addresses, payment details, or purchase history of the people who buy from your store.
You can verify this yourself: the permissions we request when you install the app cover products, theme files, and file uploads only. We could not read your customer list even if we wanted to.
| Data | Why we need it | Legal basis |
|---|---|---|
| Your email address and a bcrypt hash of your password, or a Google or Apple account identifier if you use social sign-in | Creating your account and keeping it secure | Performance of a contract |
| Connected Shopify stores: the store domain, an encrypted offline access token, and the permissions you granted | Publishing pages and products to your store when you ask us to | Performance of a contract |
| Content you generate: product pages, theme sections, advertising copy, and AI images | Providing the service itself | Performance of a contract |
| Product URLs you import, and the publicly available product data retrieved from them | Building a page from a source product | Performance of a contract |
| Usage records: the operation performed, which AI provider handled it, token counts, and estimated cost | Enforcing plan limits and calculating billing | Performance of a contract |
| Support conversations with our in-app assistant | Answering your questions | Legitimate interest in supporting our users |
| Whether you opened a marketing email, measured with a tracking pixel | Understanding whether our emails are useful | Consent, withdrawable at any time by unsubscribing |
| Technical logs: store domain, error messages, and diagnostic context | Diagnosing failures and protecting the service against abuse | Legitimate interest in operating a reliable service |
We do not sell personal data. We do not use it for behavioural advertising or profiling.
We share data only with providers that make the service work, and only what each one needs:
| Provider | What they receive |
|---|---|
| Shopify | Your store domain, the product content you choose to publish, and your subscription status |
| OpenAI | Your prompts and the product data used to generate text and images |
| Anthropic | Your prompts and the product data used to generate theme sections |
| CJ Dropshipping | Keywords derived from a product title, when you use supplier matching |
| Apify | Search parameters used for product discovery |
| Cloudflare (Turnstile) | Bot-protection signals when you sign up or sign in |
| Brevo | Your email address, to send transactional and marketing email |
| Hetzner (European Union) | All data, as our hosting infrastructure |
| Google / Apple | Only if you choose to sign in with them |
| YouTube / Vimeo | Playback requests, only when you play an embedded course video |
We never send your password, your account credentials, or your Shopify access tokens to any AI provider.
| Category | Retention |
|---|---|
| Account and generated content | For as long as your account is active. After you delete your account, erased within 30 days |
| Store data (store record, import jobs, sessions, generated pages) | Deleted when you uninstall the app, on Shopify's app/uninstalled notification |
| The connection between your allBuilder.ai account and a Shopify store, including the encrypted access token | Deleted when Shopify sends a shop/redact request, which follows uninstallation. That request also removes that store's technical logs |
| Technical logs | 90 days, then deleted automatically |
| Billing records | As long as applicable accounting and tax law requires |
Uninstalling and redaction are two separate moments. Uninstalling removes the store's working data immediately. Shopify then sends a redaction request for the same store, and at that point we also delete the stored connection and its encrypted token.
Our operator is established in the United Arab Emirates, and several of our processors operate in the United States and elsewhere. Where personal data belonging to individuals in the European Economic Area is transferred outside the EEA, we rely on Standard Contractual Clauses and equivalent contractual safeguards with each processor.
If you are in the European Economic Area, the United Kingdom, or another jurisdiction granting equivalent rights, you may:
To exercise any of these, write to privacy@allbuilder.ai. We respond within 30 days. Withdrawing consent does not affect processing carried out before you withdrew it.
You also have the right to lodge a complaint with the data protection supervisory authority in your country.
To delete your account and everything associated with it, contact us at the address above.
Every cookie we set is strictly necessary for the service to function:
| Cookie | Purpose |
|---|---|
| ab_user_session | Keeps you signed in |
| ab_theme | Remembers whether you chose light or dark mode |
| ab_locale | Remembers your language |
| ab_connect_shopify, ab_oauth_google, ab_oauth_apple, ab_oauth_shopify | Short-lived security state during sign-in and store connection |
We set no advertising cookies and no third-party analytics cookies.
Cloudflare Turnstile sets its own cookies for bot protection. Embedded YouTube and Vimeo players may set cookies, but only if you play a video.
Email open tracking is separate from cookies and runs on consent. Our marketing emails contain a tracking pixel that tells us whether the message was opened. Unsubscribing stops it. Transactional email — password resets, billing notices — contains no tracking.
Passwords are stored as bcrypt hashes and are never recoverable in plain text. Shopify access tokens are encrypted at rest. All traffic is served over HTTPS. Access to production data is restricted to personnel who need it to operate the service.
allBuilder.ai is a business tool. It is not directed at anyone under 18, and we do not knowingly collect personal data from children. If you believe a child has provided us data, contact privacy@allbuilder.ai and we will delete it.
We will post any change on this page and update the date at the top. For changes that materially affect your rights, we will notify you by email or in the app before they take effect.