Catalog Checkup Privacy Policy
Version 1.1 — Last updated: October 2026
This privacy policy explains how the Catalog CheckupShopify app (“Catalog Checkup”, “we”, “us”, “our”), provided by SIXFIT, collects, uses, and protects data when installed on a merchant’s store.
SIXFIT AI B.V., Schipholplein 237, 6843 BR Arnhem, The Netherlands.
This policy covers the Catalog Checkup app only. For the SIXFIT fit-recommendation app, see the SIXFIT App Privacy Policy; for the SIXFIT Analytics app, see the SIXFIT Analytics Privacy Policy; for the sixfit.ai website, see the Website Privacy Policy.
Who This Policy Is For
This policy is for Shopify merchants who install or are considering installing Catalog Checkup. It explains what data the app reads from your store, what we do with it, and how we protect it.
What the App Does
Catalog Checkup is a read-only catalog audit. It reads your product catalog and checks each product against the structured-data fields that Google Shopping and Meta use to show and rank products, then presents a score and a list of gaps to fix. It only requests the read_productspermission — it does not modify your store, and it cannot read orders, customers, or any other data.
Our Role
When you install Catalog Checkup, you are the data controller for your catalog data, and SIXFIT is the data processor— we read your product data on your behalf to produce the audit report.
Separately, because Catalog Checkup is a free tool that SIXFIT offers to introduce merchants to its services, SIXFIT is an independent controllerfor the limited business-contact information it uses to follow up with you about SIXFIT (see “Marketing and Outreach” below).
What Data We Collect
From your store’s catalog (via the Shopify API)
| Data | Why |
|---|---|
| Product and variant fields (title, description, product type, vendor/brand, price, availability, barcode/GTIN, options such as colour and size) | Checked against Google and Meta field requirements to score completeness and enrichment |
| Product metafields and taxonomy category | Detects structured data (e.g. Google Shopping metafields, category) that the channels read |
| Product status and stock (active/draft/archived, in/out of stock) | Only active products are scored; stock is noted because the channels drop out-of-stock items |
From Shopify (via OAuth)
| Data | Why |
|---|---|
| Shop domain (your .myshopify.com address) | Identifies which store the audit belongs to |
| Shopify access token (and refresh token), stored encrypted | Lets the app read your catalog to run audits; refreshed automatically and deleted on uninstall |
What we don’t collect:
- No customer or shopper personal data
- No orders, checkout, or payment data
- No storefront tracking — the app has no theme widget, pixel, or cookies on your storefront
- No data from your shoppers’ browsers
What We Store
The app stores your encrypted Shopify session and the results of each audit — your scores, per-field gap counts, per-channel eligibility counts, and product totals, keyed to your shop domain. Audit results describe your catalog in aggregate; they do not contain customer data.
How We Use This Data
- Running the audit — Reading your catalog to score it and generate your report
- Showing your report — Displaying your latest results in the app and in the report you can save or print
- Improving the tool — Using aggregated, de-identified audit statistics to improve our scoring
- Marketing and outreach — Contacting you about SIXFIT’s products and services (see below)
We do not:
- Sell your data to third parties
- Use your catalog data for advertising or ad targeting
- Modify your products or store in any way
Marketing and Outreach
Catalog Checkup is a free tool offered by SIXFIT. When you install it, we treat that as an expression of interest and may contact you about SIXFIT’s products and services, including help closing the catalog gaps the app identifies.
For this we use your store’s business-contact details (such as business name, store URL, and business email), which we may obtain from Shopify, your public storefront, or reputable business-data providers. This is business-to-business outreach directed at the store, not at individual shoppers.
You can opt out at any time by replying to any message, emailing hello@sixfit.ai, or uninstalling the app. See “Your Choices and Rights” below.
The clmbrs.com Leaderboard
clmbrs.com is a public leaderboard, run by SIXFIT, that ranks Shopify stores by how findable their products are. Your store appears there only if you opt inon the app’s report page; the default is not listed. Listed anonymously, we show your rank, score, main product category, catalog size band and country (e.g. “A clothing store, DE”). Listed by name, we also show your store name and domain.
You can change or withdraw this at any time on the report page; it takes effect within an hour. Uninstalling the app removes you from the leaderboard. We compute the score for every audited store, but only publish it with your consent.
Legal Basis for Processing
Under the GDPR (Article 6), we rely on the following legal bases:
| Purpose | Legal basis | Explanation |
|---|---|---|
| Running the audit and showing your report | Contract performance (Art. 6(1)(b)) | Necessary to provide the audit you installed the app for |
| Improving the tool (aggregated statistics) | Legitimate interest (Art. 6(1)(f)) | Our interest in improving scoring, using de-identified data |
| Business-to-business marketing and outreach | Legitimate interest (Art. 6(1)(f)) | Our interest in offering relevant services to merchants who installed a free tool; you may object at any time |
Third-Party Services
- Shopify— We read your catalog through Shopify’s APIs as part of normal app operation. Shopify’s privacy policy
- Hosting— Our servers are located in the European Union (Germany).
- Internal alerting— We send ourselves an internal notification (containing your shop domain) when the app is installed, so our team is aware of new installs.
- Business-data providers— We may use reputable providers to look up publicly available business-contact details for the outreach described above.
We do not sell personal data, and we do not share your catalog data with advertisers or other third parties.
How Long We Keep Data
| Data | Retention | Notes |
|---|---|---|
| Shopify session / access token | Until uninstall | Deleted when you uninstall the app |
| Audit results (scores, gap counts) | While installed | Erased within 48 hours of uninstall, via Shopify’s shop-redact webhook |
| Business-contact details (outreach) | Until you opt out | Removed on request or when no longer needed for outreach |
Shopify Compliance Requests
Shopify sends apps three privacy webhooks. Because Catalog Checkup does not collect customer or shopper personal data:
- Customer data request — We hold no customer data to return.
- Customer redact — We hold no customer data to delete.
- Shop redact — We delete your store’s session and audit results (Shopify sends this about 48 hours after uninstall).
Data Security
- All data is encrypted in transit (TLS/HTTPS)
- All data is encrypted at rest (encrypted database storage)
- Our servers are hosted in the European Union (Germany)
- Access to production data is restricted to authorized personnel only
- We use Shopify’s HMAC verification to validate webhook requests
International Data Transfers
Our servers are in the European Union (Germany). If your store is outside the EU, the data described here is transferred to and processed in Germany.
Your Choices and Rights
As a merchant, you can:
- Delete your data — Uninstall the app; your session and audit results are erased within 48 hours
- Opt out of outreach — Reply to any message or email us to stop marketing contact
- Access, correct, or export — Contact us to exercise your GDPR rights
- Object — Object to processing based on legitimate interest, including outreach
If California residents’ information is involved, note that under the CCPA/CPRA we do not sell personal information or share it for cross-context behavioral advertising. California consumers may exercise their rights by contacting us.
Children
Catalog Checkup is a business tool for merchants and is not directed at children. We do not knowingly collect data from children.
Changes to This Policy
If we make changes, we’ll update the date at the top. For significant changes that affect how we process data, we will make the updated policy available here.
Contact Us
If you have questions about this privacy policy or how we handle data:
SIXFIT AI B.V.
Schipholplein 237, 6843 BR Arnhem, The Netherlands
hello@sixfit.ai
For data protection inquiries, you can also contact us at dpo@sixfit.ai.
If you are in the EU and believe we have not addressed your concerns, you have the right to lodge a complaint with your local data protection authority.