Privacy policy

Last updated October 21, 2026. What Dopbot collects, why, who else handles it, and what you can ask us to do.

1. Who is responsible

the independent operator of Dopbot (the operator's full legal name and mailing address are available on request at hello@dopbot.com) is responsible for the personal information described here. We handle it under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA). Contact: hello@dopbot.com.

2. What we collect

When you request a free snapshot

Your email address, brand name, store domain, and the optional category you type.
Whether you ticked the box to receive marketing email. It is unticked by default.
A one-way hash of your IP address, which we use to limit abuse. We do not store your IP address in our database.

When you subscribe to the tracker

Your email address, plan, brand names, store domains, and the competitors and prompts you enter.
Stripe customer and subscription identifiers. Your card details go to Stripe and never reach us.
A cookie named dopbot_pending, set when you start checkout, so we can match your payment to your account. It is strictly functional and lasts 7 days.

When you connect a Shopify store

Your store's myshopify.com address, the access tokens Shopify issues to our app (stored encrypted, never shown or logged), the scopes you granted, and the email address of the store owner that Shopify provides.
The text and attributes of the products we prepare suggestions for, the suggestions themselves and the original product text, so any change can be rolled back. To draft suggestions we send an AI model (OpenAI) only each product's title, brand, product type, options and description; never prices, SKUs, inventory or customer data. Nothing is changed in your store until you approve it.
If you install from the Shopify App Store: your Shopify subscription identifier, your store's Shopify ID, and when we last checked your plan with Shopify. Shopify bills you; we never see your payment details.
A cookie named dopbot_shopify_bind, set for 30 minutes when you open a tracker's Shopify page, so only your browser can connect a store to your tracker. We keep only a one-way hash of it.
We do not read or store your customers, orders or payments.
When you uninstall the app, we delete the store's tokens. Shopify's data deletion requests are honoured as Shopify requires.

Fix outcomes

When you mark a suggested fix as done, or apply one through the Shopify app, we measure your score two and four weeks later. We combine these outcomes across brands into anonymous statistics per type of fix (for example, the median change in score) and show them only once at least 5 different brands contribute. No brand, store or person is identifiable in these statistics.

When you only read the site

We do not use advertising cookies or third-party analytics. Our hosting provider processes standard request data, such as IP address and browser type, to deliver and protect the site.

3. Why we use it

To run your snapshot or tracker and show you the results.
To bill you, answer your messages and keep the service secure.
To send marketing email, only if you ticked the box. We follow Canada's anti-spam law (CASL). You can withdraw consent at any time by emailing hello@dopbot.com, and we will stop.

We do not sell personal information.

4. Who else handles it

We use these service providers (processors) and give each only what it needs:

Cloudflare hosts the site, runs our database and queue, and provides the Turnstile check on the snapshot form. Cloudflare privacy policy.
Stripe processes subscription payments. Stripe privacy policy.
Shopify runs the stores you connect and, for App Store installs, the billing. Shopify privacy policy.
OpenAI and Perplexity answer the shopper questions we send them and help us read the answers. They receive prompts and answers. For snapshots and trackers, the prompts can include your brand name, product categories and competitor names. We do not send them your email address. Each handles that data under its own terms: OpenAI, Perplexity.

These providers may process data in countries other than Canada, including the United States, where local laws apply.

5. How long we keep it

Snapshots: the results and the email address attached to them are kept until you ask us to delete them. We may clear snapshots older than 12 months.
Paid accounts: for as long as your subscription is active, and afterwards for as long as the law requires us to keep financial records.
The Index: it contains no personal information and is kept indefinitely.

6. Your choices and rights

Under PIPEDA you can ask us to show you the personal information we hold about you, correct it, or delete it, and you can withdraw consent to marketing. Email hello@dopbot.com and we will respond within 30 days. If you are not satisfied, you can complain to the Office of the Privacy Commissioner of Canada.

7. Security

Private pages use long random addresses and are marked so that search engines do not index them. Data is held with the providers above, which use encryption in transit. No system is perfectly secure; if a breach puts you at real risk, we will tell you.

8. Children

The service is for businesses. It is not directed at children, and we do not knowingly collect their information.

9. Changes

If we change this policy in a way that matters, we will update the date above and, for changes to how we use your information, tell you by email or on the site.