This policy covers Alate for Brands, a Shopify app published by Tessellate Studio ("we", "us"), and the Alate Size Finder block it adds to a merchant's product pages. It explains what we read from a Shopify store, what we keep, what happens to a shopper's measurements, and how everything is deleted. The Alate shopping app has its own privacy policy.
SummaryWe read your catalogue from Shopify when we need it and don't keep a copy. We do keep what you type into the app (size charts, fit offerings, model sizing, fabric and settings) and your store's connection, with its access token encrypted. A shopper's measurements typed into the size finder are used once to work out a size, are not stored, and never reach your store. We hold no Shopify customer data. Uninstall, and what you entered is deleted straight away.
1. Merchants: what we collect
a) Your store's connection
When you install, Shopify gives us your shop's domain, an access token, the permissions you granted, your store's primary domain and a token for reading your public storefront. We store these with the date you installed. The Admin access token is encrypted (AES-256-GCM) before it is stored, and tokens refresh automatically when they expire.
b) What you enter
- Size charts: the name, sizes, measurements, unit, and which product, collection or shop each one applies to
- Fit offerings: the type (for example a tall range or made to measure), extra length, price difference, lead time and how to order
- Sizing for each product: model height, the size the model wears, notes, fibre content, stretch, and whether you've said you won't restock it
- Settings: the shoppers you serve, your default unit and your shop's default size chart
- Suggestions from your listing: values the app suggests from a product's own listing, such as model sizing or a size range, each with a short snippet (up to 200 characters) of the listing text that supports it, and whether you accepted or dismissed it. Nothing is applied unless you accept it
c) What we read from Shopify but do not keep
Product titles, prices, options, stock, product types, tags, descriptions and photos are read from Shopify when they're needed, for example when a shopper asks for a size, when you open your products in the app, or when you import size charts from your product descriptions. We don't keep them as a catalogue. We also read your products' category details (such as size type and fabric), only to suggest values for you to accept or dismiss, and your live theme, only to check whether the size finder block is on it.
d) Who you are
The app runs inside your Shopify admin and does not ask for your name or keep a separate account for you. If you email us, we keep that correspondence to answer you.
2. Shopify permissions and why
| Permission | Why we need it |
|---|---|
read_products | List your products in the app; import size charts from product descriptions |
read_themes | Check whether the size finder block is on your live theme |
read_metaobjects | Read the labels of your products' category details (such as size type and fabric), so the app can suggest sizing from your listing |
unauthenticated_read_product_listings, unauthenticated_read_product_tags | Read a product's public details, whether a size is available, and tags through the Storefront API when a shopper asks |
Every permission is read-only. We do not ask for orders, customers, or anything that writes to your store.
3. Shoppers: the Alate Size Finder
a) Measurements typed into the block
A shopper can type their chest, waist and hips, and their height if they want, into the block on your product page. These, with the product being viewed, are sent over HTTPS to Alate's server, used once to work out the size from your chart, and then discarded. They are not stored, not linked to the shopper, and not sent to your store. Your store receives only the resulting size and fit note, shown in the shopper's browser.
b) "Use my Alate profile"
A shopper who uses the Alate app can connect it to the block instead of typing. We create a short-lived record holding a random token, your shop, the product and the result, so their phone and the product page can connect. It expires after ten minutes. The shopper's profile itself stays in the Alate app and is handled under the Alate privacy policy.
c) Sizes past your range
When an Alate shopper falls outside your size range and taps to say they'd want a bigger or smaller size, we record the product, the direction and a scrambled per-install code (so one person counts once). No size, measurement, name, email or account is kept. These records are deleted after 90 days, and you see only counts.
d) No cookies, no customer data
The block sets no cookies and stores nothing in the shopper's browser. We hold no Shopify customer data; Shopify's customer data and customer erasure requests are answered accordingly.
4. How we use data
- To answer shoppers' size questions from your data, on your product pages and in the Alate app
- To show you your products, charts and the sizes-past-range counts
- To keep the service secure and working (error reports, see section 5)
We do not sell data, do not use it for advertising, and do not share your sizing data with other merchants.
5. Service providers
- Shopify, the platform the app runs on. Privacy Policy
- Supabase, our database, hosted in Singapore (ap-southeast-1). It holds the data described in sections 1a, 1b, 3b and 3c. Privacy Policy
- Vercel, which hosts the app and its API. Requests may be processed in the United States. Privacy Policy
- Sentry, which receives error reports from our API and from the app's pages in your Shopify admin. Shopify's session token, cookies and authorization headers are removed before they're sent. Privacy Policy
6. Retention and deletion
| Data | Kept until |
|---|---|
| Store connection, suggestions from your listing and everything you entered | You uninstall. It's deleted as soon as Shopify tells us the app was uninstalled |
| Anything left after uninstall | Erased when Shopify sends its shop erasure request, 48 hours after uninstall (skipped if you've reinstalled) |
| Size finder measurements | Not kept. Used for one answer only |
| "Use my Alate profile" hand-off | Ten minutes |
| Sizes-past-range taps | 90 days |
| Error reports | Sentry's retention for our plan |
7. Security
- All traffic uses HTTPS / TLS. Every Shopify webhook is verified by its signature.
- Admin access tokens are encrypted at rest with AES-256-GCM.
8. Your rights
Merchants and shoppers can ask for access to, correction of, or deletion of personal data we hold, and EEA/UK residents can object or withdraw consent. Email privacy@tessellate.co.in; we respond within 30 days (within 15 days for grievances under India's DPDP Act). Because size finder measurements are not stored, there is nothing of a shopper's to retrieve or delete from a size-finder answer.
Legal basis (GDPR): performing our contract with you as a merchant (sections 1 and 2); legitimate interest in answering a size question a shopper asked for (sections 3a and 3b) and in showing anonymous demand (section 3c). Cross-border transfers: data may be processed outside the EEA/UK by the providers in section 5, under their standard contractual clauses.
9. Changes to this policy
Every change is posted on this page with a new effective date. If a change materially affects how we handle your data, we'll tell installed merchants before it takes effect.
10. Contact
Publisher: Tessellate Studio (sole proprietorship, India)
Privacy and grievances: privacy@tessellate.co.in
Support: partners@tessellate.co.in