Privacy Policy

Last updated: October 5, 2026

Introduction

Welcome to Vigenfy ("we," "our," or "us"). Vigenfy is operated by Mobile Cosmos, LLC, a company registered in the State of Wyoming, United States of America. Our servers are located in Germany (European Union). We are committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Shopify application.

By using Vigenfy, you agree to the collection and use of information in accordance with this policy.

Information We Collect

1. Information You Provide

Store Information:

  • Store domain (your .myshopify.com address), which identifies your account
  • The Shopify access token that lets the app act on your store (stored server-side, never shown)
  • Your app settings: plan, credit balance, watermark settings, interface language

Product Information (read from Shopify only for the products you pick for a video):

  • Product titles and descriptions
  • Product images
  • Product type and vendor (the product category is detected automatically from these)

Account Information:

  • Subscription plan details
  • Billing information (processed by Shopify)
  • Payment history and transaction records
  • Credit balance and usage history

Customization Settings:

  • Watermark settings (logo image stored in our video storage, text, colour, position, opacity)
  • Interface language
  • The settings of each video you generate and any notes you type for the AI

2. Automatically Collected Information

Usage Data:

  • Video generation requests and parameters
  • Credit usage and transaction history
  • Error logs and diagnostics
  • Sampled performance traces and masked session replays of the app's interface (Sentry, about 10 % of sessions; all text is masked)

Technical Information:

  • IP address (in our server logs and error reports)
  • Browser type and version, operating system
  • Access times and dates

We do not run analytics or advertising tracking.

Cookies and Tracking:

  • A language preference cookie (lng)
  • Shopify session tokens for authentication (no tracking cookies)

3. Data from Third Parties

Shopify:

  • Store domain and app installation status
  • Product data (titles, descriptions, images) when you select a product for a video
  • Billing status of your subscription and credit purchases (Shopify Billing API); Vigenfy never receives card details

AI Service Providers:

  • Replicate, fal.ai, Higgsfield (which one depends on the AI model you choose): Processing results, model metadata, generation timestamps
  • OpenAI: Prompt generation results, category detection data
  • Processing logs and performance metrics

How We Use Your Information

We use the collected information for the following purposes:

Service Provision

  • Generating AI-powered videos from your product images
  • Managing your account and subscription
  • Processing payments through Shopify Billing API
  • Storing and delivering generated videos
  • Providing customer support and assistance
  • Sending service-related notifications

Service Improvement

  • Tuning the prompts and model settings we use (we do not use your data to train AI models; for the AI providers see "Use of Your Content by AI Providers" below)
  • Developing new features and functionality
  • Fixing bugs and technical issues

Communication

  • In-app notifications about your videos, credits, plan and billing
  • Replies to the emails you send us
  • Important security notices

Vigenfy does not send marketing emails.

  • Complying with legal obligations and regulations
  • Protecting our rights and property
  • Preventing fraud and abuse
  • Enforcing our Terms of Service
  • Responding to legal requests
  • Maintaining legal and tax records

Data Storage and Security

Storage Locations

Our application server (Hetzner Online GmbH, Germany):

  • Location: Germany (EU) - GDPR compliant region
  • Data Stored: Store information, video metadata, transactions, notifications, user settings (self-hosted Appwrite database) and workflow execution logs (self-hosted n8n, pruned after 14 days)
  • Encryption: HTTPS between your browser and Cloudflare, which fronts our server; access to the server is limited to the operator
  • Backup: Automated daily backups with 14-day retention
  • Hosting Provider Privacy Policy: https://www.hetzner.com/legal/privacy-policy

Cloudflare R2 (Video Storage):

  • Location: Cloudflare's global network
  • Data Stored: Generated videos and thumbnails, your watermark logo, copies of the product photos framed for the video and the scenes rendered from them
  • Encryption: Server-side encryption enabled
  • Retention: Videos, thumbnails and logo until you delete them or uninstall the app, then purged within 30 days; framed product photos and rendered scenes are purged after 7 days
  • Privacy Policy: https://www.cloudflare.com/privacypolicy/

Replicate (AI Processing):

  • Location: United States
  • Data Stored: Product photos and the generated prompt text (temporary processing only)
  • Retention: Removed by Replicate shortly after the generation according to its API data policy
  • Encryption: HTTPS in transit
  • Privacy Policy: https://replicate.com/privacy

fal.ai (AI Processing):

  • Location: United States
  • Data Stored: Product photos and the generated prompt text (temporary processing only), for the AI models that run on fal.ai
  • Retention: Kept by fal.ai for a limited period according to its privacy policy
  • Encryption: HTTPS in transit
  • Privacy Policy: https://fal.ai/privacy

Higgsfield (AI Processing):

  • Location: United States
  • Data Stored: Product photos, the generated prompt text and the videos generated from them, for the AI models that run on Higgsfield
  • Retention: Generated files stay available for about 7 days according to its API documentation; Higgsfield may keep and use submitted content and outputs to improve its AI models (see "Use of Your Content by AI Providers")
  • Encryption: HTTPS in transit
  • Privacy Policy: https://higgsfield.ai/privacy-policy

Security Measures

We implement comprehensive security measures:

  • Encryption: HTTPS between browsers and Cloudflare, and between our server and every service provider
  • Authentication: Secure authentication via Shopify OAuth 2.0 and session tokens
  • Access Controls: Server and database access limited to the operator, principle of least privilege
  • Monitoring: Error tracking, sampled performance traces and masked session replays (Sentry)
  • Backups: Automated daily backups stored on the server
  • Incident Response: Breach notification procedures as required by GDPR
  • Secure Development: Dependency updates and automated tests before every release

Data Retention

  • Active Accounts: Data retained while the app is installed
  • Generated Videos: Retained until you delete them or uninstall the app, then purged from storage within 30 days
  • Transaction Records: Kept after uninstall for accounting purposes and so that your credit balance can be restored if you reinstall
  • Uninstall: Your Shopify session and access token are deleted immediately; your store, video, transaction and notification records are marked as deleted and are no longer processed; video files are purged within 30 days. If you reinstall the app, only your store record and its credit balance are restored: videos, transaction history and notifications are not. Email us if you want the records erased completely
  • Backups: Nightly backups are kept for 14 days
  • Legal Holds: Data subject to legal holds retained as required by law

Data Sharing and Disclosure

We do NOT sell, rent, or trade your personal information.

We share data only with the following parties and for legitimate purposes:

Service Providers

Hetzner Online GmbH (Hosting):

Cloudflare (Storage & CDN):

  • Purpose: Video storage, content delivery, DDoS protection
  • Location: Global with EU options
  • Data Shared: Generated videos, thumbnails, watermark logos, framed product photos and rendered scenes; all web traffic to our domains passes through Cloudflare
  • Privacy Policy: https://www.cloudflare.com/privacypolicy/

Replicate (AI Processing):

  • Purpose: AI video generation from product images, and the optional Scene and AI expand steps, in which an image model re-stages or extends your product photo
  • Location: United States
  • Data Shared: Product photos and the generated prompt text (temporary)
  • Data Processing Agreement: Replicate's data processing terms
  • Privacy Policy: https://replicate.com/privacy

fal.ai (AI Processing):

  • Purpose: AI video generation from product images, for the AI models that run on fal.ai
  • Location: United States
  • Data Shared: Product photos and the generated prompt text (temporary)
  • Data Processing Agreement: fal's Data Processing Addendum
  • Privacy Policy: https://fal.ai/privacy

Higgsfield (AI Processing):

  • Purpose: AI video generation from product images, for the AI models that run on Higgsfield
  • Location: United States
  • Data Shared: Product photos and the generated prompt text
  • Use by the provider: Higgsfield's terms allow it to use submitted content and generated outputs to develop and improve its own AI models
  • Privacy Policy: https://higgsfield.ai/privacy-policy

OpenAI (AI Services):

  • Purpose: Planning the video (writing the prompt), category detection
  • Location: United States
  • Data Shared: Product title and description, your optional notes for the video, the video settings, and the product photos you chose for that video (so that the plan fits what the photos show)
  • Data Processing Agreement: OpenAI's data processing addendum (API data is not used for training)
  • Privacy Policy: https://openai.com/privacy/

Sentry (Error Tracking & Monitoring):

  • Purpose: Error monitoring, performance tracking, diagnostics
  • Location: United States
  • Data Shared: Error logs and stack traces, sampled performance traces, masked session replays and your store domain (no cookies are set)
  • Data Processing Agreement: Sentry's data processing addendum
  • Privacy Policy: https://sentry.io/privacy/

Shopify (Platform Provider):

Use of Your Content by AI Providers

We do not use your product photos, prompts or videos to train AI models.

To create a scene or a video we send the product photos you chose for it and the generated prompt to the provider of the AI model you choose (Replicate, fal.ai or Higgsfield). These providers process that content under their own terms and privacy policies, and some of them may use the content they receive and the output they generate to develop and improve their own AI models and services. Where a provider's terms say so today, it is noted in the list above (currently Higgsfield). Content that a provider has already used in this way cannot be withdrawn from its models afterwards.

To plan the video, the same photos are also shown to OpenAI together with the product title and description. OpenAI does not use data sent through its API to train its models.

Only use photos you are comfortable sharing in this way. If a photo shows a person, make sure you have that person's permission.

We may disclose your information if required by law:

  • Law enforcement requests with valid legal basis
  • Court orders and subpoenas
  • Compliance with legal obligations
  • Protection of our rights and property
  • Investigation of fraud or security issues
  • Protection of safety of users or public

We will notify you of legal requests unless prohibited by law.

Business Transfers

In the event of a merger, acquisition, reorganization, or sale of assets:

  • Your information may be transferred to the acquiring entity
  • You will be notified in the app at least 30 days in advance
  • You will have the option to delete your account before transfer
  • The acquiring entity must honor this Privacy Policy

Your Rights

GDPR Rights (EU Users)

Under the General Data Protection Regulation (GDPR), you have the following rights:

Right of Access (Art. 15)

  • Request a copy of all personal data we hold about you
  • Receive information about how we process your data
  • Format: JSON or PDF, delivered within 30 days

Right to Rectification (Art. 16)

  • Correct inaccurate or incomplete personal data
  • Update your information through app settings
  • Request manual corrections via email

Right to Erasure / "Right to be Forgotten" (Art. 17)

  • Request deletion of your personal data
  • Exceptions: Legal obligations, legitimate interests
  • Deletion is carried out within 30 days of a verified request

Right to Restriction of Processing (Art. 18)

  • Limit how we process your data
  • Data stored but not actively processed
  • Available during dispute resolution

Right to Data Portability (Art. 20)

  • Receive your data in machine-readable format (JSON)
  • Transfer data to another service provider
  • Includes: Videos, settings, transaction history

Right to Object (Art. 21)

  • Object to processing based on legitimate interests
  • Object to marketing communications
  • We stop the processing unless we have compelling legitimate grounds to continue

Right to Withdraw Consent

  • Withdraw consent at any time for consent-based processing
  • Does not affect lawfulness of previous processing
  • May impact service availability

Right to Lodge a Complaint

  • File complaints with supervisory authority
  • Contact information provided in "Supervisory Authority" section

KVKK Rights (Turkish Users)

Under the Turkish Personal Data Protection Law (KVKK), you have the right to:

  • Learn whether your personal data is being processed
  • Request information if your data is being processed
  • Learn the purpose of data processing and whether it's used appropriately
  • Know third parties to whom data is transferred domestically or abroad
  • Request correction of incomplete or inaccurate data
  • Request deletion or destruction under conditions specified in KVKK
  • Request notification to third parties of correction, deletion, or destruction
  • Object to negative consequences from automated data analysis
  • Claim compensation for damages arising from unlawful processing

United States Privacy Rights (CCPA/CPRA and other state laws)

This section applies to residents of California and of other US states with comprehensive privacy laws (including Colorado, Connecticut, Virginia, Utah, Texas and Oregon). It supplements the rest of this policy.

Categories of personal information we collected in the last 12 months:

Category Examples Source Purpose
Identifiers Store name and .myshopify.com domain, IP address You, Shopify Providing the Service, support, billing
Commercial information Subscription plan, credit purchases, transaction history You, Shopify Billing Billing, records
Internet or network activity Video generation requests, error logs, sampled masked session replays Automatically collected Operating and improving the Service, security
Content you provide Product titles, descriptions and photos, watermark text and logo, custom prompts You, Shopify Generating videos

We do not collect sensitive personal information as defined by the CPRA, and we do not knowingly collect personal information of consumers under 18.

Sale and sharing: We do not sell personal information and we do not share it for cross-context behavioral advertising, and have not done so in the preceding 12 months. We therefore do not offer a "Do Not Sell or Share My Personal Information" link. We do not use or disclose sensitive personal information for purposes that require a right to limit.

Disclosures for a business purpose: The categories above are disclosed to the service providers listed under "Service Providers" (hosting, AI processing, storage, error tracking, Shopify), each under its terms of service or a data processing agreement that limits its use of the data to providing its service, except that AI providers may use submitted content to improve their models as described under "Use of Your Content by AI Providers".

Retention: See "Data Retention" above; we keep each category no longer than necessary for the purpose it was collected for and for legal record-keeping.

Your rights:

  • Right to know / access the categories and specific pieces of personal information we hold about you, the sources, purposes and recipients.
  • Right to delete your personal information, subject to legal exceptions (e.g. transaction records we must keep).
  • Right to correct inaccurate personal information.
  • Right to data portability in a readily usable format.
  • Right to opt out of sale, sharing and targeted advertising (not applicable, since we do none of these).
  • Right to non-discrimination: we will not deny the Service, charge different prices or provide a different level of service because you exercised your rights.

How to exercise these rights: email info@vigenfy.com with the subject "US Privacy Request" and your store domain, or use "How to Exercise Your Rights" below. We verify requests through your Shopify store (for example by asking you to write from the contact email of the store in Shopify, or from inside the app). You may designate an authorized agent to make a request on your behalf; we will ask the agent for written permission and may still verify your identity directly. We respond within 45 days (extendable once by a further 45 days with notice). You may appeal a decision by replying to our response; if you are not satisfied you may contact your state Attorney General.

Shine the Light (California Civil Code § 1798.83): we do not disclose personal information to third parties for their direct marketing purposes.

How to Exercise Your Rights

Email: info@vigenfy.com

Subject Line: "Data Rights Request – access / deletion / correction / portability"

Required Information:

  • Your Shopify store URL or email address
  • Type of request (access, deletion, correction, etc.)
  • Verification information for security purposes
  • Preferred format for data delivery (if applicable)

Response Time:

  • Initial acknowledgment: Within 3 business days
  • Complete response: Within 30 days
  • Extension notification: If additional time is needed (up to 3 months in total, as permitted by GDPR Art. 12(3))

Verification Process: We verify your identity by:

  • Confirming that the request comes from the contact email of the store in Shopify
  • Verifying Shopify store ownership
  • Additional verification for sensitive requests

No Fee: Exercising your rights is free of charge for reasonable requests.

Cookies and Tracking Technologies

Types of Cookies We Use

Vigenfy sets a single first-party cookie:

Cookie Name Purpose Duration
lng Remembers the interface language you chose in Settings 1 year

Authentication inside the Shopify admin uses Shopify session tokens carried in request headers, not cookies. We do not use analytics or advertising cookies. Your other settings (watermark, plan, credits) are stored in our database, not in cookies.

Managing Cookies

Browser Settings:

  • Chrome: Settings → Privacy and security → Cookies and other site data
  • Firefox: Settings → Privacy & Security → Cookies and Site Data
  • Safari: Settings → Privacy → Manage Website Data
  • Edge: Settings → Cookies and site permissions

Effect of Disabling Cookies:

  • Without the lng cookie the interface falls back to the language saved in your Vigenfy settings, or to English; nothing else is affected.

Our Service may contain links to third-party websites and services:

  • We are not responsible for their privacy practices
  • We recommend reviewing their privacy policies before providing data
  • Links do not imply endorsement

Third-party services we integrate with:

  • Shopify App Store
  • Shopify Admin
  • Third-party AI models (via Replicate, fal.ai and Higgsfield)

Children's Privacy

  • Vigenfy is a business tool and is not intended for anyone under 18 years of age
  • We do not knowingly collect data from children
  • If we learn we have collected data from a child, we will delete it immediately
  • Parents/guardians can contact us at info@vigenfy.com to request deletion

International Data Transfers

Your data may be transferred to and processed in countries outside your residence. Our company is established in the United States, our application servers and database are in Germany (EU), and some processors are in the United States and Canada.

Users in the United States: your data is stored on our servers in Germany and processed by the service providers listed above. Because we control those servers, US law enforcement requests are handled by us in accordance with US law and this policy.

Safeguards for International Transfers

European Union to United States:

  • Standard Contractual Clauses (SCCs) or EU-US Data Privacy Framework certification, as offered in each provider's data processing terms
  • Data Processing Agreements with all US-based processors
  • Supplementary measures (encryption in transit, access controls)

Adequate Countries:

  • Transfers to countries with adequacy decisions (e.g., Canada, Japan)
  • No additional safeguards required

Your Rights:

  • Request information about safeguards for your data
  • Object to transfers that don't meet requirements
  • Contact: info@vigenfy.com

Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect:

  • Changes in our practices
  • Legal or regulatory requirements
  • New features or services
  • Feedback from users

Notification of Changes

Minor Changes:

  • Updated "Last Updated" date at top of policy

Material Changes:

  • In-app notification banner
  • 30 days' notice before changes take effect
  • Option to review and accept, or uninstall the app

Your Options

  • Accept: Continue using the Service
  • Reject: Uninstall the app and request data deletion

Continued use after notification period constitutes acceptance of updated policy.

Privacy Contact

We are not required to appoint a Data Protection Officer. Privacy matters are handled by the operator of the Service:

Email: info@vigenfy.com Response Time: Within 3 business days

Contact for:

  • Data protection questions
  • Rights requests
  • Privacy concerns
  • Data breach reports
  • Compliance inquiries

Supervisory Authority

You have the right to lodge a complaint with a supervisory authority:

European Union / EEA

If you are in the EU or EEA, you may lodge a complaint with the data protection authority of the country where you live or work. The list of authorities is published by the European Data Protection Board: https://www.edpb.europa.eu/about-edpb/about-edpb/members_en

Türkiye

Kişisel Verileri Koruma Kurumu (KVKK):

United States

Contact Us

One mailbox handles every privacy, rights, security and support matter:

Postal Address:

Mobile Cosmos, LLC
30 N Gould St, Ste R
Sheridan, WY 82801
United States of America

Appendix A: Data Processing Summary

Categories of Personal Data

  1. Identity Data (store name and domain)
  2. Contact Data (only what you send us by email)
  3. Technical Data (IP address, browser, operating system)
  4. Usage Data (videos generated, credits consumed)
  5. Transaction Data (plan and credit purchase history; payments are handled by Shopify)
  6. Content Data (product photos, watermark logo, generated videos)

Processing Purposes

  1. Contract Performance (service delivery, billing through Shopify)
  2. Legal Obligation (accounting records)
  3. Legitimate Interests (security, error tracking, abuse prevention)

Recipients of Data

  1. Internal: the operator of the Service
  2. External: Service providers listed in this policy
  3. Legal: Authorities with valid legal requests

Retention Periods

  • Account records: while the app is installed; marked deleted on uninstall (see Data Retention)
  • Video files: until deleted or uninstalled, then purged within 30 days; framed product photos 7 days
  • Backups: 14 days
  • Logs: workflow logs 14 days; server logs rotated by size; error reports per Sentry's retention

Effective Date: October 5, 2026

Version: 2.2.1

This Privacy Policy is effective as of the date listed above and applies to all users of Vigenfy.

By using Vigenfy, you acknowledge that you have read, understood, and agree to this Privacy Policy.