Trust and security

What I read, where it lives, for how long.

I need your images to find evidence. Nothing more. Here is exactly what happens.

I read
Image files of your products, collections, blogs, and theme sectionsInside them: C2PA manifests, IPTC DigitalSourceType, and XMPWhere an image is usedThe languages of your store
I do not read
Customer dataOrders and paymentsAddresses and analytics: I have no permission for them
I do not change
Image files and alt textsProductsTheme code

Data at a glance

I run on Cloudflare. The database (Workers KV) stores data in data centers in the EU and the US and briefly holds copies at Cloudflare locations worldwide. Cloudflare does not offer a restriction to EU locations for Workers KV (accessed 14 September 2026), so I do not claim one. Transfers to the US are based on the EU-US Data Privacy Framework and EU Standard Contractual Clauses.

Image metadata Finding evidence and showing it to you: provenance data found per image
Where
Cloudflare Workers KV, EU and USA
How long
until deletion after uninstall
Findings per image Results summary, proposals, automation: file name, URL, dimensions, location
Where
Cloudflare Workers KV, EU and USA
How long
until deletion after uninstall
Your decisions Which images carry a label
Where
Cloudflare Workers KV, EU and USA; confirmed images also in an app metafield in your store
How long
until deletion after uninstall; the metafield disappears with the app
Settings Corner, size, page types, language
Where
Cloudflare Workers KV, EU and USA
How long
until deletion after uninstall
Image files Only for reading during the scan, the first 512 kilobytes per file
Where
in memory only, never stored
How long
discarded immediately
Access token So that I may read on your behalf, AES-GCM encrypted
Where
Cloudflare Workers KV, EU and USA
How long
until uninstall, then deleted immediately
Log Event, store, truncated IP address, timestamp
Where
at Cloudflare
How long
90 days
Support conversations Only if you use the chat in the app
Where
at Cloudflare; sent to Anthropic (USA) for the reply without your name, store domain or e-mail; on handover to the support team in Slack (USA)
How long
90 days after the last message

Permissions in Shopify

During installation, Shopify shows you every permission before you agree. I request four read-only permissions and no write access; I write only two app-owned metafields, the on/off switch and the list of images you have confirmed.

read_products
Product titles and which image belongs to which product
read_files
File inventory and originals, the first 512 kilobytes per file for C2PA, IPTC, and XMP
read_themes
whether the label is active and which images sit in theme sections
read_locales
the languages of your store, for the label in your customer’s language

After uninstall

The label disappears from your store immediately, and I delete the access token at the same moment. I delete stored findings as soon as Shopify sends the deletion request shop/redact 48 hours after uninstall, no later than after 30 days; a daily cleanup job checks this. Log entries expire after 90 days.

Found a security vulnerability?

Write to support@easyaiactlabels.com, also machine-readable at /.well-known/security.txt. I confirm receipt within 48 hours with a first assessment. Everything legal is in the privacy policy.

AI labelling on this website

The texts on this website are created with AI. The label Created with AI at the top says so in guides, index editions, the FAQ and reference pages; every page also carries a note in the footer. Is a label missing somewhere, or is it wrong? Write to support@easyaiactlabels.com. I review every report within 5 working days and correct what is missing.