Privacy Policy

CrossCheck is a product-catalog auditing tool. It requests the following Shopify access scopes: read_products, write_products, and read_locales. In practice, this means we access:

• Product catalog data: titles, descriptions, variants, options, metafields, and product images.
• Store-level information needed to operate the App: your shop domain, the OAuth access token issued to us by Shopify, your store’s configured locales, and your active subscription plan status (via Shopify Managed Pricing).

CrossCheck never requests or accesses customer data, order data, or checkout information. We have no scopes that would permit this, and no code path in the App reads or writes anything outside your product catalog and the store/billing information described above.

For this data, you (the merchant) remain the data controller, and Tuneka acts only as a service provider / data processor, handling store data solely to provide the App’s functionality and on your instructions (initiating a scan, applying a fix, etc.). You are responsible for your own compliance obligations toward your customers and staff; this Policy covers only Tuneka’s handling of the store data described above.

We use product catalog data solely to analyze your listings for internal factual contradictions (for example, a description that conflicts with a metafield, variant, or product image) and to generate proposed fixes that you may choose to apply. We use store-level information to authenticate requests, enforce your plan’s monthly scan quota, and maintain your scan history and findings dashboard within the App.

To detect contradictions, CrossCheck sends the relevant product catalog content (titles, descriptions, variants, metafields, and images being analyzed) to a third-party AI provider for automated analysis. This is the only third party that receives your product data, and it receives only product catalog content — never customer, order, or checkout data. We do not sell your data to this provider or anyone else, in any circumstance.

Data sent to our AI provider is subject to that provider’s own API data usage policies. As of this policy’s effective date, our provider does not use data submitted through its API to train its models. Because that provider controls its own processing directly and its terms may change independently of this policy, contact us using the details in Section 10 if you would like more detail about the current provider and its data usage terms.

CrossCheck’s own application infrastructure is hosted in the United States. Because our AI provider may also process data on servers located outside your own country (including in the United States), both of these mean that if you are located outside the United States, using CrossCheck involves an international transfer of your store data to the United States. Where required, this transfer relies on the safeguards our AI provider itself offers under its API terms (such as Standard Contractual Clauses). Merchants who require a signed Data Processing Addendum covering these transfers may request one by contacting us at the address in Section 10.

Tuneka does not sell, rent, or trade store or product data to any third party for monetary or other valuable consideration, and we do not share it for cross-context behavioral advertising. Data is shared only with the AI provider described in Section 3, and only for the analysis purpose described there.

We retain scan history and findings data for as long as the App remains installed on your store, so your dashboard, scan history, and Catalog Coverage score remain available to you.

When you uninstall CrossCheck, all data we have stored for your store is permanently deleted. This is handled automatically by our shop-data-deletion process. Shopify sends us confirmation of an uninstall in two steps: first an immediate uninstall notice, then a separate mandatory “shop redact” confirmation typically about 48 hours later. We delete your store’s data upon receiving that second, shop-redact confirmation, and run a backstop check within 30 days of the uninstall in case that confirmation is delayed, so your data is never retained indefinitely.

CrossCheck also honors Shopify’s mandatory GDPR webhooks. Our handling of the customer-related webhooks (customers/data_request and customers/redact) is intentionally a no-op: because we never collect or store any customer personal data in the first place, there is nothing to return or redact when one of these requests is received. The shop-level webhook (shop/redact) triggers the permanent deletion described above.

This website sets no advertising or analytics cookies. The CrossCheck app itself, when embedded in the Shopify admin, uses only the session cookies required for Shopify OAuth and App Bridge to function — no third-party tracking or advertising cookies are set by the App.

Data in transit between your store, our servers, and our AI provider is encrypted (HTTPS/TLS), and access to stored data is limited to what is necessary to operate the App. However, no method of electronic transmission or storage is completely secure, and we cannot guarantee the absolute security of any data. You provide data to the App at your own risk.

CrossCheck’s findings and proposed fixes are generated by an automated process and are provided for your convenience only. They may occasionally be inaccurate or incomplete. Tuneka makes no warranty that any finding or fix is correct, and you are solely responsible for reviewing any proposed fix before applying it and for the consequences of applying it to your store. To the maximum extent permitted by law, Tuneka disclaims liability for losses arising from reliance on CrossCheck’s automated output.

Depending on your jurisdiction (including under the GDPR and CCPA), you may have the right to request access to, correction of, or deletion of data we hold about your store. Because CrossCheck only ever stores product catalog and store-level operational data — never customer personal data — the simplest way to exercise a deletion right is to uninstall the App, which triggers the permanent deletion described in Section 5. For any other request, contact us using the details in Section 10.

If you have questions about this Privacy Policy, want to request a Data Processing Addendum, or want to exercise a data right, contact us at tunekalabs@gmail.com.

CrossCheck is a business tool intended for use by Shopify merchants and is not directed at children. We do not knowingly collect information from children.

We may update this Privacy Policy from time to time to reflect changes in the App’s functionality or applicable law. We will update the effective date above when we do. Continued use of CrossCheck after a change constitutes acceptance of the updated policy.