Privacy policy.

last updated: august 2026

Who we are

OTO ADA is an accessibility monitoring and remediation app for Shopify storefronts, built by Allure Commerce. For the app, we act as a data processor on behalf of the merchant, who remains the controller of their store's data. For this website, we are the controller.

Privacy contact: privacy@otoada.ai.

What the app never accesses

Start here, because it rules out most of what merchants worry about. OTO ADA does not request, receive, or store:

• Customer records — no names, emails, addresses, or phone numbers of your shoppers.
• Orders, carts, or checkout data.
• Payment or card details. Billing runs through Shopify; we never see a payment instrument.
• Shopify admin credentials. Access is granted by you through Shopify's OAuth screen and is revocable from your admin at any time.

These are not policy promises we could quietly break — the app does not request the Shopify permissions that would make them possible. You can confirm this on the install screen before you approve anything.

What the app does access, and why

OTO ADA requests only the permissions its job requires:

Scanning reads the public pages of your storefront — the same pages any visitor or search engine can already load.

What we store

• Store identifiers — your myshopify domain, primary domain, Shopify store ID, plan, and install date.
• An access token issued by Shopify when you approve the install, used to call the Shopify API on your behalf.
• Scan results — the URLs scanned, the accessibility issues found, and the page markup fragments that evidence each issue.
• Remediation records — proposed changes, the exact diffs, who approved them, when they were published, and the verification result.
• Settings and audit history — your configured approval rules, and a log of actions taken in the app.
• Dashboard sessions for staff who sign in.
• Optional integration credentials — if you connect GitHub or Jira, those tokens are stored encrypted.

Incidental personal data. Because we read theme and content markup, a scan may capture personal information that appears in your published storefront — a blog post author's name, a staff email in a page footer, contact details in your theme. We don't seek this out, isolate it, or use it for anything; it is retained only as part of the evidence for a finding, and it is deleted when the store's data is deleted.

What we do with it

We process store data only to provide the service: to scan your storefront, identify accessibility issues, prepare and verify fixes you approve, and maintain the record of what was done. We also use aggregate, non-identifying operational data to monitor and improve the product.

We do not sell, rent, or trade merchant data. We do not use it to build advertising profiles. We do not use your store's content to train third-party AI models.

Where data is stored

Application data is stored in the United States. Data is transmitted over TLS. Where transfers from the UK or EEA require it, we rely on Standard Contractual Clauses or an equivalent lawful mechanism.

Subprocessors

We'll update this list before adding a subprocessor that handles merchant data.

How long we keep it

• While the app is installed — scan history, remediation records, and audit history are retained so the record stays continuous, which is the point of the product.
• After you uninstall — we delete your store's data within 30 days of receiving Shopify's shop redaction request, or of a direct request from you.
• Website enquiries — up to 24 months from your last contact, then deleted.
• Server logs — a short operational period, then rotated.

Deletion and data requests

OTO ADA supports Shopify's mandatory data-privacy requests. When Shopify sends a customer data request, customer redaction request, or shop redaction request, we act on it within 30 days.

Because the app holds no customer records, a customer data or redaction request will typically return or affect nothing — there is no shopper data for us to return or erase. Shop redaction removes your store's scan history, remediation records, settings, and access token.

You can also ask us directly at privacy@otoada.ai at any time, whether or not you've uninstalled.

Security

• Data is transmitted over TLS.
• Access to the app is scoped per store; a merchant's session can reach only that merchant's data.
• Optional integration credentials (GitHub, Jira) are encrypted at rest.
• Actions taken in the app are recorded in an audit log.
• Staff access to production data is limited to those who need it for support and operations.

No system is perfectly secure. If a breach affects your data, we'll notify you and the relevant authorities as required by law.

This website

Separately from the app, this marketing site collects very little:

• Google Analytics 4. We use Google Analytics on this marketing site to understand aggregate traffic (pages viewed, referrers, and similar usage). Google may set first-party cookies such as _ga and send usage data to Google under their terms. We do not use Google Analytics for advertising personalization on this site. See Google's Privacy Policy and Google Analytics opt-out.
• Advertising measurement. We use the OpenAI Ads Measurement Pixel and Meta Pixel to measure page views, successful contact requests, confirmed demo bookings, and the start of Shopify installation from this site, and to attribute those actions to advertising. We do not include your name, email, phone number, or message in our tracking event payloads. These providers receive browser and page information through their scripts. See OpenAI’s Privacy Policy and Meta’s Privacy Policy.
• Other third-party scripts. We use Cloudflare Turnstile on the demo-booking form. Site JavaScript and fonts are otherwise served from this domain.
• Campaign attribution is held in your browser's sessionStorage (not a cookie): first-party, never sent to another site except as part of a form you submit, and discarded when you close the tab. UTM parameters may also be recorded by Google Analytics when present in the URL.
• Server logs record standard request information — IP, timestamp, page, user agent — to serve pages and defend against abuse.

Three website flows collect information: Start a trial (your myshopify domain and work email), Talk to a specialist (storefront URL, work email, role, and your message), and Book a demo (your name, business email, optional phone number, selected meeting time, and campaign attribution). We use booking details to create and manage the requested Google Calendar event, provide a Google Meet link, send the invitation and confirmation, and notify our team. We won't add you to a sequence you didn't ask for.

We never ask for your Shopify admin credentials on this website. No page here will request a password, an API key, or payment details. Treat any message claiming to be us and doing so as fraudulent.

Your rights

Depending on where you live, you may have the right to access, correct, delete, or export the information we hold about you, to object to or restrict how we use it, and to complain to your data protection authority.

If you're a merchant, you may also have obligations to your own customers as the controller of your store's data; we'll support you in meeting them.

Ask and we'll act. We won't make you justify wanting your own data back, we won't charge you, and we won't treat you differently for asking. Email privacy@otoada.ai and we'll respond within 30 days.

Children

This is a business product. It isn't directed at children, and we don't knowingly collect information from anyone under 16.

Changes

If we change how we handle your information, we'll update this page and move the date at the top. Material changes will be called out rather than quietly folded in, and we'll notify merchants of changes that affect the app.

Contact

Privacy questions and data requests: privacy@otoada.ai. Anything else: book a demo or email support@otoada.ai.