Privacy Policy

Effective Date: November 12, 2026

1. Data We Process & Client-Side Merge Guarantee

Our diagnostic engine inspects only publicly accessible storefront endpoints (such as public /products.json catalog feeds and public CDN product images). We do not access private customer records, payment card details, or password-protected Shopify Admin accounts.

When using our Zero-Code CSV Merger, 100% of file parsing and merging is enforced via browser Content-Security-Policy (connect-src 'none') so CSV processing runs locally on your device. Your Shopify product export CSV is never uploaded to or stored on Asaf Audit Labs servers. Static storefront pages use zero third-party web-font CDNs or tracking scripts.

2. B2B Prospect Processing & Sample Demonstration Pages (GDPR Art. 14)

Legitimate Interest & Categories / Source of B2B Data (GDPR Art. 6(1)(f) & Art. 14): For B2B store outreach, we collect publicly published business contact email addresses and public /products.json catalog metadata from merchant storefronts to prepare free sample accessibility evaluations under Legitimate Interest for B2B commercial communication.

Independent Public-Metadata Demonstrations: Any sample preview pages (marked noindex, nofollow) are independent demonstrations derived exclusively from publicly accessible catalog metadata. Asaf Audit Labs is not affiliated with, sponsored by, or endorsed by any sampled merchant.

3. Subprocessors, CDN Hosts & Order Information

We rely on the following infrastructure subprocessors and public media hosts:

Cloudflare, Inc.: DNS, CDN routing, and DDoS/TLS edge security.
Lemon Squeezy (Merchant of Record): processes card and PayPal payments, sales tax/VAT, and transmits your order identifier, email address, and bound target domain (checkout[custom][target_domain]) for fulfillment. Approved 7-day net B2B invoice orders are billed directly by Asaf Audit Labs.
GitHub (GitHub Pages): hosts static storefront pages, the client-side CSV merger, and unindexed (noindex, nofollow) sample preview pages.
Google (Gemini Vision API — paid commercial API tier): evaluates product images in our hybrid pipeline by pairing structured catalog metadata and filename parsing with computer-vision inspection on public product image URLs whenever filenames or metadata do not clearly describe the visual angle, detail, or embedded text. Customer inputs and product images are processed under the paid commercial API tier, where they are not used to train Google models.
Public Image CDNs: Public preview pages load static product thumbnails directly from the merchant's own Shopify CDN (cdn.shopify.com), and the homepage preview uses royalty-free Unsplash (images.unsplash.com) demo photography.

4. Data Retention, International Transfers & Data Subject Rights

Retention of Order, Prospect & Suppression Data: Generated order remediation archives and audit metadata are retained for 90 days to support customer re-downloads and technical compatibility resolution tickets, after which they are automatically deleted. Unindexed sample preview pages and B2B prospect contact records are retained for up to 30 days if no order is placed, or erased immediately upon a "no" reply or written deletion request to support@asaflabs.com—retaining only a minimal email suppression entry so opted-out addresses are never contacted again.

International Transfers & Data Subject Rights (GDPR Art. 14 / Art. 21): Data is processed in Israel (recognized under an EU adequacy decision) and via US cloud subprocessors under Standard Contractual Clauses (SCCs). Data subjects have the right of access, rectification, erasure, restriction of processing, objection (Art. 21, including instant opt-out by replying "no" to any outreach email), and the right to lodge a complaint with a competent supervisory authority.

5. Service Operator & Data Controller

Service Operator & Data Controller: Asaf Audit Labs (AsafLabs), operated by Asaf Mizrahi (Sole Proprietor / Commercial Software Studio, Tel Aviv, Israel — support@asaflabs.com).