Effective date: 19 September 2026
1. Who operates ScenePact
ScenePact is operated by Nadim Najjar, an individual, at 3257 Al Hawm, king Fahd District, 12274 Riyadh, KSA ("ScenePact," "we," "us," or "our"). Privacy and data-rights requests can be sent to privacy@scenepact.com. General merchant support is available at support@scenepact.com.
2. Scope and information we process
ScenePact is an embedded Shopify app that creates product media with generated backgrounds. It requests only the Shopify write_products scope needed to read eligible product media and publish approved media as a new product image. We do not request customer or order data scopes, collect information directly from a merchant's customers, or use storefront cookies or pixels to track them.
- Shopify merchant and staff account information received during installation and authentication, including shop domain, Shopify user identifier, first and last name, email address, locale, account-owner or collaborator status, granted scopes, session dates, and OAuth access or refresh credentials. We use this information to authenticate authorized users, maintain sessions, and secure the service.
- Product identifiers and the product media a merchant selects from Shopify for eligibility checks, compositing, review, download, or publishing.
- Text background prompts, job and attempt state, safety and fidelity results, usage records, and security or operational audit events.
- Shopify subscription identifiers and billing status used to determine entitlement. Shopify handles charge approval and collection; ScenePact does not collect payment-card details.
- Contact details and other information a person voluntarily includes in a support or privacy request.
3. Why we process information
We process this information to authenticate shops, provide and secure ScenePact, check media eligibility and output fidelity, composite and deliver approved media, publish media at a merchant's direction, administer usage and subscription access, prevent abuse, diagnose failures, comply with Shopify and legal obligations, and answer support or privacy requests. Depending on the context and applicable law, processing is necessary to perform our agreement, comply with legal obligations, or pursue legitimate service-security and operational interests; we rely on consent where applicable law requires it. ScenePact does not use submitted product media or prompts to train its own machine-learning models.
4. Providers, disclosures, and international processing
ScenePact's background generation is separated from product-media processing. Product media is not sent to the generation provider; it remains within ScenePact's processing boundary and private EU object storage.
ScenePact currently uses services offered under the following provider brands. These brand names do not identify the specific contracting entities, and roles, locations, and terms depend on the applicable service arrangement.
- Shopify provides app installation, authentication, product-media APIs, and billing and may process information under its own privacy terms.
- Hetzner provides hosting for the application, worker, and PostgreSQL database; the current deployment is in HEL1, Finland.
- Cloudflare R2 provides private object storage for media in the current bucket configured for EU jurisdiction; browser access uses short-lived signed links.
- Replicate provides AI generation and receives only text background prompts, never product media. It returns a generated background for ScenePact to composite within ScenePact's processing boundary.
Because ScenePact is operated from Saudi Arabia and uses services abroad, information may be processed outside the country where it was supplied. The current application and database deployment is in Finland; Shopify and Replicate may process information in other locations under their service arrangements. Cross-border processing is handled subject to applicable legal requirements. This policy makes no claim about particular contractual safeguards unless they have been verified for the applicable service arrangement. We may also disclose information when required by law or necessary to establish, exercise, or defend legal claims. We do not sell merchant or customer personal data.
5. Retention and deletion
Product-media assets use a 30-day default retention period. A merchant may change the setting to 7, 30, or 90 days for assets stored after the change. The selected period is attached to each newly stored asset. The retention worker deletes expired private objects and their asset metadata. Publishing does not replace or delete the original Shopify product image.
Records that are not product-media assets are kept only for as long as reasonably necessary for the purposes described in this policy. The period varies with the record type, the active service relationship, service security and integrity, billing and accounting needs, dispute resolution, Shopify requirements, and applicable law. This policy does not promise a fixed deletion period or unimplemented automated deletion for those records.
After uninstall or a verified deletion request, ScenePact may retain limited Founding Plan reservation and enrollment records, and records needed for billing, security, compliance, fraud prevention, dispute resolution, or legal obligations, only where necessary and lawfully permitted. Those records are restricted to those purposes and are deleted or anonymized when no longer required. Legal holds are one example of a lawful retention reason, not the only possible exception. OAuth credentials, sessions, and other applicable app data are handled through uninstall and Shopify privacy-webhook workflows, subject to identity verification and the necessary, lawfully permitted retention described here.
6. Shopify privacy webhooks
ScenePact receives Shopify's mandatory privacy webhooks for customer data requests, customer redaction, and shop redaction. Because ScenePact does not request customer or order data scopes and is not designed to store customer or order records, customer requests and redactions ordinarily produce a tenant-scoped zero-data audit. Shop redaction invokes the deletion handling described above.
7. Your choices and rights
Merchants can choose the media-retention setting, avoid including optional information in support messages, and uninstall the app. Depending on applicable law, a person may have rights to be informed and to request access, correction, deletion, restriction, objection, or a copy of personal data, and may complain to a competent authority. To make a request, email the privacy contact with “Privacy request” in the subject. We may verify the requester and Shopify shop before acting. Some rights are subject to lawful exceptions.
8. Security and changes
ScenePact uses tenant-scoped access controls, private media storage, and short-lived signed links, but no system can guarantee absolute security. Do not submit passwords, access tokens, payment-card details, customer data, or media you are not authorized to process. Material changes to this policy will be shown by an updated effective date and, where appropriate, an in-app or other notice.