Waslio: Competitor Prices — Privacy Policy
Last updated: 2026-09-26
Waslio: Competitor Prices ("Waslio", "the app") is a competitive-intelligence app for Shopify merchants, published by Waslio Connect. It mirrors the merchant's own catalog, reads publicly available competitor storefronts, and turns the differences into alerts and price suggestions.
This policy describes what the software actually does. Where a control is manual, or a capability exists in the codebase but is not switched on, it says so instead of implying otherwise. An engineering record of the same processing, with references to the code, is kept alongside the source and is available on request.
Contact: founder@waslio.com — for privacy questions, deletion requests and crawler opt-outs alike. Publisher: Waslio Connect.
1. Who we are
Waslio Connect ("we") is the data controller for merchant account data and for the operational records the app creates. Where a merchant uses Waslio to process data relating to their own business, we act as their processor for that data under the Shopify App Store's Data Protection Addendum.
2. What we collect from a merchant's store
Granted Shopify scopes: read_products, write_products, read_inventory. write_products is used for one thing only: applying a price change the merchant has approved.
We store:
| Data | Why |
|---|---|
| Shop domain, currency, primary market | Identify the store and price in the right currency |
| Shopify access token (valid for one hour) and the refresh token that renews it, encrypted with AES-256-GCM | Read the catalog, apply approved price changes |
| Products and variants: title, vendor, product type, SKU, barcode, options, image URL, price | Match against competitor products and compare prices |
| Cost per item per variant, when the store records it | Enforce the merchant's cost-markup floor on suggested prices |
| Settings: alert rules, channels, quiet hours, pricing rules and guardrails | Run the product |
| Team records: email address, name, interface locale | Account administration and saved preferences |
| API keys (stored only as a SHA-256 hash) and outbound webhook endpoints with their signing secrets | The public API |
| Applied and reverted price changes | Audit trail |
| Google Merchant Center OAuth credentials, encrypted with AES-256-GCM, if the merchant connects one | Market benchmark |
3. What we do not collect
We store no customer personal data. Waslio never requests customer scopes, never reads orders or customer records, and holds no customer names, addresses, emails, payment details or order history. The database schema has no customer, order or payment table.
The mandatory Shopify compliance webhooks are answered accordingly:
customers/data_request— authenticated, acknowledged and logged. There is nothing to hand over, because no customer data is stored.customers/redact— authenticated, acknowledged and logged. There is nothing to redact.shop/redact(sent 48 hours after uninstall) — authenticated, and it deletes the store's data automatically (see section 5). If the delivery fails, the webhook reports an error so Shopify retries it.app/uninstalled— the app deletes its OAuth session rows for the shop immediately and tells the Waslio backend the store is gone. The backend records the uninstall and mutes every competitor for that account, which removes their scheduled crawl, promotion, stack, ads and newsletter jobs on the next scheduler sync. Collection stops; stored data is not deleted by this step.
4. Competitor data
Waslio reads publicly accessible pages of competitor storefronts: catalog feeds and structured product data, product, collection and home pages, and publicly published advertising records.
How we crawl:
- Identified. Every request is made with the user agent
WaslioRadarBot/1.0 (+https://benchmark-prices-app.onrender.com/bot). We do not disguise the crawler as a browser. - robots.txt is fetched and honoured for that user agent, per origin, before any page is fetched by the crawler. A robots.txt that is unreachable or returns an error is treated as expressing no opinion, and the page is fetched.
- Rate limited to one request per second per host by default, with backoff that respects
Retry-After. - Public only. We do not create accounts, do not log in, do not bypass paywalls or access controls, and do not attempt to reach anything a robots.txt disallows.
- No purchases. Nothing in the service completes a purchase, and no payment instrument of ours or the merchant's is ever used against a competitor's store. The codebase contains a cart-inspection routine that is restricted, in code, to three cart endpoints (
/cart/add.js,/cart.js,/cart) and throws before any other path is requested; no scheduled job runs it, so the running service does not add items to competitor carts at all. If that changes, this policy will be updated before it is switched on.
We retain extracted text, page HTML and, where a browser renderer is configured, a screenshot to investigate alerts. In-app alerts show an explanation and link to the public source page; the saved snapshot body is not currently displayed in the app.
Competitor marketing email. If email monitoring is enabled, Waslio generates a tracking address on our own inbox domain, unique to that merchant-and-competitor pair, and submits that address to a newsletter form discovered on the competitor's public storefront. Submission is attempted at most three times, a week apart, and stops permanently after one success. The only value ever entered into a competitor's form is our own tracking address; no personal data of any individual is submitted. Mail received at these addresses is marketing mail the competitor sent to that address. This pillar is only active when an inbox is configured for the deployment; with no inbox configured, no address is generated and no form is submitted.
Advertising data comes from the platforms' own public archives — the Meta Ad Library, and the TikTok Creative Center where it is available and enabled. Shopping-result sampling goes through a search-results provider (SerpApi); we do not scrape Google directly.
Site-owner opt-out
If you operate a storefront and do not want Waslio to read it:
- Disallow the crawler in robots.txt. We honour it, per origin, for our user agent:
User-agent: WaslioRadarBot Disallow: / - Or write to founder@waslio.com from an address at the domain, or with any reasonable proof of control. We will stop crawling the domain, stop any tracking-address subscription, and delete the stored pages and price history for it. Tell us in the message if you want the deletion confirmed in writing.
Requests under (2) are carried out by hand against the database and stored page evidence — there is no self-service blocklist yet. We aim to stop crawling within one business day and to complete deletion within five business days.
5. How long we keep data
| Data | Retention |
|---|---|
| Competitor price history | The window the merchant's plan provides: 30 days (Preview), 90 (Monitor / legacy Starter), 365 (Optimize / legacy Growth), 730 (legacy Scale and Agency) |
| Events and alerts | The same plan window as price history |
| Captured competitor emails, and ads that have stopped running | The same plan window |
| Page, email and ad snapshots | The plan window, capped at 90 days whatever the plan |
| Ads still running | Kept while they run, whatever their age; pruned once they stop and pass the plan window |
| The price-change audit log | For the life of the account, then deleted with it |
| Merchant catalog mirror, matches, settings, team records | For the life of the account |
| Shopify and Google tokens | Until the account's data is deleted. There is no self-service "disconnect Google" control yet; ask us and we will remove the stored credential |
A daily job enforces these windows automatically. It deletes price history, events, captured emails and finished ad records older than the plan window, together with the stored copies of the pages they cite. One exception is deliberate: a competitor variant's most recent price point is never deleted by age, because price points are written only when something changed, so the oldest surviving row may be the competitor's current price.
Deletion after uninstall is automatic. Uninstalling stops collection immediately and pauses every competitor on the account. Shopify sends the shop/redact request 48 hours later, and on receiving it we delete the store and its catalog mirror, matches, price-change log and stored Shopify token. When no other installed store shares the account, we delete the whole account with it: competitors and their price history, events, alerts, rules, settings, team records, API keys, webhook endpoints and Google credentials, and the stored page, email and ad copies on the worker's persistent disk. A store that was reinstalled within those 48 hours is not deleted. To have your data deleted sooner, or to have the deletion confirmed in writing, write to founder@waslio.com.
6. Subprocessors
| Subprocessor | Purpose | What is sent |
|---|---|---|
| Anthropic, if the language-model fallback is configured | Reading product data from storefronts that publish none, classifying an ambiguous storefront copy change, adjudicating an ambiguous product match, re-deriving a broken extractor, writing the digest narrative | The specific page text, product pair or digest skeleton being processed, for one merchant at a time. Never another merchant's data, never customer data |
| Voyage AI, if embeddings are configured | Text and image embeddings for the product-matching cascade | Product titles and image URLs being compared |
| Render cloud hosting, managed PostgreSQL, Redis and persistent disk | Running the service and storing the data described above | All data in this policy, at rest in our infrastructure |
| Crisp | In-app support chat in the Shopify admin | The Crisp widget and its session cookies load only after a merchant selects “Chat with support.” Crisp may receive browser/device and chat-session metadata; if a merchant starts a conversation, it also processes the message and any contact details they choose to provide. Waslio does not send Shopify customer data, catalog contents, or access tokens to Crisp. |
| Resend, or an SMTP provider, if external email delivery is enabled in a future release | Sending alert and digest email | Recipient address and the alert or digest content |
| Meta (Ad Library API) | Reading a competitor's public ad archive | The competitor's page or domain being looked up |
| TikTok (Creative Center), where available and enabled | The same, for TikTok | The competitor's advertiser identifier |
| Google (Merchant Center Content API) | The market price benchmark, only if the merchant connects an account | The merchant's own product identifiers |
| SerpApi | Sampling shopping results for competitor discovery | Product titles and keywords being searched |
| UPCitemdb | Barcode reverse lookup during competitor discovery, when configured | The barcode being looked up |
| Sentry, when error reporting is enabled for the deployment | Diagnosing failures | Error messages and stack traces, with the queue name, job id and competitor id attached |
The current alert-rule interface creates immediate in-app alerts. External alert delivery and deferred digests are unavailable until destinations and delivery are configured per merchant. Outbound API webhooks to an endpoint chosen by the merchant are a separate integration and are signed so the recipient can verify them.
We do not sell data, and we do not use one merchant's data to serve another. Prompts sent to the language model are built only from the requesting merchant's own data.
7. Security
- Third-party tokens (Shopify access tokens, Google OAuth credentials) are encrypted at rest with AES-256-GCM, with a 32-byte key supplied through the environment and never stored in the database. The API refuses to start without a real key.
- API keys are stored only as SHA-256 hashes, shown once at creation, verified in constant time, and revocable.
- Outbound webhooks are signed with HMAC so recipients can verify them; inbound Shopify webhooks are verified with timing-safe HMAC comparison before any processing.
- Internal callers (the embedded app, the engine) must present a shared secret as well as the account identifier; an account identifier on its own is not accepted as authentication.
- Crawl targets, redirect hops and merchant-supplied webhook URLs are checked against a guard that refuses loopback, private, link-local and cloud-metadata addresses.
- Every tenant-scoped table carries a tenant id, and API requests are served through a tenant-scoped database client that refuses an unscoped query. Cross-tenant isolation is covered by automated tests.
- Access to production data is limited to staff who need it, over authenticated connections.
8. Legal bases and international transfers (GDPR / UK GDPR)
- Merchant account and catalog data: processed to perform the contract with the merchant (Art. 6(1)(b)).
- Publicly available competitor storefront data: processed under legitimate interests (Art. 6(1)(f)) — providing merchants with competitive price and assortment information. This data concerns businesses and their public offers, not individuals; where a competitor's public page incidentally contains a person's name, we hold it only as part of that page's stored evidence and will remove it on request.
- Marketing email received at tracking addresses: legitimate interests (Art. 6(1)(f)), limited to commercial mail the sender chose to send to an address subscribed for this purpose.
Merchant users may request access, correction, deletion, restriction, objection and portability at founder@waslio.com. We respond within 30 days. There is no self-service export endpoint today: a portability request is served by the CSV exports available in the app plus a database extract we prepare by hand.
Production hosting is in the United States. Optional providers may process data in other regions according to their own data-processing terms. Contact founder@waslio.com for details about the providers and transfer safeguards that apply to your account.
9. Saudi Arabia (PDPL) and the Gulf
Waslio is used by merchants in Saudi Arabia and the wider GCC. For them:
- The categories above are the complete set of personal data processed; none of it is sensitive personal data under the PDPL, and no customer data is involved.
- Personal data is limited to the merchant's own team members — business contact details used to operate the service, retained for the life of the account.
- Merchant users hold the PDPL rights to be informed, to access, to request correction and to request destruction; the same address, founder@waslio.com, serves those requests.
- Cross-border transfer of that data to our hosting and subprocessor regions is necessary to provide the service the merchant has subscribed to; a record of processing and of transfer safeguards is available to merchants on request.
- We do not use merchant data for marketing purposes and do not disclose it to third parties beyond the subprocessors listed in section 6.
10. Children
Waslio is a business tool and is not directed at children. We do not knowingly collect data from anyone under 18.
11. Changes
Material changes are announced in-app and by email to account owners at least 14 days before they take effect. The date at the top of this document always reflects the current version.
Monitoring purchase records
We store Shopify one-time purchase identifiers, pack type, price, credit quantity, purchase date and your remaining prepaid balance to fulfil purchases and prevent duplicate credits. We do not receive payment-card details. These records and unused credits are removed with account data when Shopify requests erasure following uninstall.