Privacy Policy — Store2Content AI

Last updated: 8 October 2026

Service provider and data controller: Store2Content AI is provided by Liekrafit (ليكرافيت للملابس الرياضية), Mokattam, Cairo, Egypt. Liekrafit is the legal service provider and the data controller for the personal data described in this policy. Business contact: support@liekrafit.com.

Purpose and data we process

Store2Content AI ("we", "us") uses store and account data to prepare, schedule and publish organic product feed posts to your connected Facebook Page and Instagram professional account, manage access and usage, provide support, and protect the service. We do not sell personal data or use it for paid advertising.

• Shopify: shop domain and identifier, time zone, installation and session information; products, descriptions, images, variants, collections, inventory availability and product links. Our catalog scopes are read_products and read_inventory. We do not request access to Shopify customer or order data or maintain customer or order records. Shopify session information may include the installing admin's identity and contact details.
• Merchant settings: brand and audience preferences, language, publishing time zone, automation choices, content plans, captions and schedules.
• Meta: your Facebook app-scoped user ID, the selected Page's ID and name, the linked Instagram professional account's ID, username and name, granted permissions, access tokens and token expiry; post content, publishing attempts, post identifiers and receipts. Permissions we request: public_profile (granted with Facebook Login; used only to identify the connecting Facebook user by their app-scoped user ID for the connection), pages_show_list (list Pages you manage so you can choose one), pages_read_engagement (required by Meta for Page publishing), pages_manage_posts (publish posts to your selected Page), instagram_basic (read your linked Instagram professional account ID and username), instagram_content_publish (publish feed posts to that account).
• Billing and operations: subscription status and billing-cycle dates obtained through Shopify, image/content usage and cost records, support requests and diagnostic summaries, webhook receipts and technical logs. We do not collect payment card details.
• AI content: product images and generation instructions sent to FAL when image generation is enabled; generated images and their source lineage. Caption generation and image checks may use the providers listed below when configured and enabled.

Data we receive from Meta (Platform Data) is used only to connect your accounts and publish the posts you approve or schedule. We do not sell it, use it for advertising, or share it with AI providers (FAL, OpenAI, AWS). Only our hosting and storage providers (Railway, Cloudflare R2) process it for us.

In the default Approval First mode and in Manual mode, a post is published only after you approve it or choose to publish it; if you select Full Autopilot and give explicit consent, scheduled posts are published automatically to your selected Page and Instagram account without per-post approval, and you can pause or switch modes at any time in Settings.

Service providers and subprocessors

• Shopify: installation, catalog access and subscription billing.
• Meta: Facebook and Instagram authorization and publishing.
• FAL (fal.ai): AI image generation and product-image editing from product images and instructions.
• Railway: application hosting and PostgreSQL database.
• Cloudflare R2: S3-compatible storage for generated and publishing media.
• Resend: private operational and support-ticket notification emails. In-app support notifications contain a ticket reference and fixed text, not the merchant's message or diagnostic contents.
• OpenAI: AI caption generation from product and brand context when enabled.
• Amazon Web Services (Rekognition): image safety checks when enabled. A configured image-embedding service may also compare source and generated images for product fidelity; its operator depends on configuration.

These services may process information outside your country. Their own policies govern data they hold independently, including published posts and provider-side retention.

Storage, security and retention

Operational records are stored in PostgreSQL and media in object storage. Shopify access and refresh tokens and Meta access tokens are encrypted before database storage using AES-256-GCM. Images intended for publishing can be served through public media links; disconnect or uninstall revokes applicable links and removes stored Meta credentials.

Store settings, catalog projections, content and operational records remain until applicable deletion processing. Minimal pseudonymized webhook receipts and shop-deletion audit records remain for replay protection and reconciliation. Meta deletion preserves unrelated Shopify, subscription and internal usage/accounting records. Database backups are kept up to 30 days; hosting/application logs up to 30 days. Eligible billing, usage, audit and support-message history is subject to a daily purge after 2 years. Protected records remain while needed for active billing, reconciliation, replay protection or dependent data. Shop trial, content-usage and quota accounting records have no age-based purge and are deleted when eligible shop data is redacted; uninstall alone does not delete them. Global daily cost-budget totals contain no shop identifiers and are retained without an automatic deletion period. Deletion from the active database does not immediately erase backups or logs.

During verified uninstall webhook processing, Shopify sessions are deleted, applicable media links are revoked and stored Meta tokens are shredded. Eligible shop data is deleted within 30 days of Shopify's shop/redact request (Shopify's mandatory privacy webhook): processing starts after the request is recorded, with retry sweeps every 5 minutes. Stored objects are deleted after database erasure, with failed deletions retried. Meta deletion requests are processed by a worker sweep on startup and every minute.

Shopify mandatory privacy webhooks

We authenticate Shopify's mandatory privacy webhooks. customers/data_request and customers/redact are honoured. Store2Content AI stores no customer personal data. Our Shopify scopes are read_products and read_inventory only; we do not request customer or order access. These webhooks are acknowledged with a receipt and an operational event containing shop/topic/webhook identifiers; customer payloads are not retained and there are no customer records to return or erase.

shop/redact records a durable request. Eligible shop data is deleted within 30 days of Shopify's shop/redact request, followed by stored-media deletion with retries. Active or newer installations are protected against an older request. Failed object deletion remains pending; objects belonging to a reinstalled shop may be retained rather than falsely reported deleted. A pseudonymized audit record is retained. Uninstall alone is not immediate full shop erasure.

Meta data deletion

Meta can submit an authenticated signed request to /social/meta/delete. We record the request durably and return a private confirmation code and status link. Processing removes credentials and associated Meta identity, destination and publishing identifiers from the active database where authorization can be reliably attributed. Ambiguous historical records or newer connections require review; pending or review statuses do not confirm deletion.

We complete Meta data deletion requests within 30 days of receiving them, including requests that need review.

Use the request-specific link returned by Meta to check progress. Our Meta data-deletion status page explains how to find that link. Deletion does not remove posts already held by Facebook or Instagram; remove those through Meta's tools. It does not erase unrelated Shopify or billing data or immediately remove backups and hosting logs.

Meta-specific retention: access tokens are deleted on disconnect, uninstall or a deletion request. Meta identifiers and post IDs are removed on a deletion request or shop redaction. Backups are kept up to 30 days.

How to delete your Facebook/Instagram data

1. In the app: Settings → Connected social accounts → Disconnect Facebook & Instagram (shown as Remove Facebook & Instagram connection if setup was not finished). This immediately deletes stored access tokens and the selected Page and Instagram account details.
2. On Facebook: Settings & privacy → Settings → Business integrations (or Apps and websites) → Store2Content AI → Remove, then request deletion. Meta notifies us and you get a confirmation code and status link.
3. Email support@liekrafit.com. We delete your Facebook/Instagram data within 30 days.

Your rights and requests

Where applicable, including under the GDPR, you may request access, correction, deletion, restriction, portability or object to processing of your personal data, and withdraw consent where processing relies on it. You may complain to the relevant data protection authority. See the European Commission's information on individual rights.

Send privacy questions or deletion requests to support@liekrafit.com, identifying your shop and the data concerned. We may need to verify your authority before acting. Do not send passwords or access tokens. We will explain any records that must remain or need further review.

Report a security vulnerability

Email support@liekrafit.com with the subject "Security".