Privacy

ColdSilver operates Moonlight. We use account and Shopify data to research products and run the features you choose.

Updated 14 October 2026.

Your account and sign-in

We store your email address, display name, password hash, account permissions, research preferences and activity history. Passwords are hashed before storage. Sign-in attempt records help protect accounts against misuse.

Moonlight uses an essential sign-in cookie that expires after seven days. Signing out removes that cookie. Your connected Shopify credentials are encrypted before storage and used to access the permissions you granted.

Your Shopify store

We read your shop name, domain, currency and country, together with product titles, descriptions, images, prices, variants and inventory. Research preferences and catalogue information help Moonlight find relevant products and prepare listings for your shop.

With order access, we read order identifiers, numbers, dates, totals, refunds and product quantities. Our order query does not request buyer names, email addresses, phone numbers or delivery addresses, and we do not request the Shopify customer-list permission. Order data is used only within your own account, for your sales reporting and to tailor Moonlight’s suggestions to your shop. It is never shared with other merchants and is kept for up to 13 months.

Shopify privacy-request notifications can nevertheless contain customer identifiers and contact details. We verify and process those notifications without saving their raw contents or copying their customer contact fields into the activity log. We use the named order identifiers to find or delete the relevant order records. We retain the request reference and the order identifiers needed to prepare your response. Store owners can download matching records in Settings → Customer data requests. For erased orders, we retain only the store and order references needed to prevent the next sync from importing them again. These references are removed when the shop or account is deleted.

Changes to your products

Imports create and publish products. Market Polish, Image Polish and Revert can change existing listings or their images when you run them. Disconnecting Moonlight or deleting your account does not undo changes already made in Shopify.

Payment

Moonlight is a paid subscription. Payments are processed by Stripe and sold through Link, Stripe’s merchant-of-record service, which also handles tax and sends receipts. Stripe collects your card and billing address; we never see your full card number. We store the Stripe customer and subscription references, the subscription status and its dates, and the email address and shop you started the trial with, to give your account its access.

Services that process data

• Vercel hosts the application.
• Fly.io runs background workers.
• Supabase provides the database.
• OpenAI generates text and images from relevant product text, images, research context and your instructions. OpenAI may retain API inputs and outputs for up to 30 days for abuse monitoring. Do not put customer contact details or other unnecessary personal information in your product instructions.
• Google provides Gemini image generation, and Google Ads Keyword Planner and Google Trends for search demand.
• Serper provides web search results.
• Store Leads provides a store directory and traffic estimates.
• Meta Ad Library provides public ad data.
• Shopify processes connected-store operations.
• Stripe (with Link as seller of record) processes payments and subscriptions.
• Have I Been Pwned checks new passwords against known breaches. It receives only the first five characters of a password hash, never your password, full hash or email address. Existing-password sign-in does not use this service.

Google Ads, Google Trends, Serper, Store Leads and the Meta Ad Library receive search terms, keywords or store addresses, not your sign-in details or your customers’ information. Providers may process data outside the Netherlands. Their applicable service and data-processing terms govern that processing. Contact us for information about the safeguards applicable to your account.

Moonlight does not sell your account data or share it with advertisers. Merchants share research drawn from public product listings and market signals; another merchant does not receive access to your private Shopify account, orders or connected catalogue.

Keeping and deleting data

Account, catalogue, preference and activity records support your use of Moonlight while your account is open. Settings → Delete your account deletes your account, your stores and their data from Moonlight immediately. The shared public research catalogue is retained.

When you uninstall the Shopify app that connects Moonlight, Shopify notifies us. The shop’s access token is revoked immediately and queued scans and imports for that shop are cancelled. The shop’s data in Moonlight (catalogue copy, imports, orders, activity and settings) is deleted when you delete your account in Settings, when Shopify sends a shop-redaction notice for it, or within 30 days of a request to info@coldsilver.nl.

Provider backups and infrastructure logs are not erased immediately; they expire on the provider’s schedule. Contact us to request access or deletion beyond the records described above.

Your choices and rights

We process account and shop information to provide the service you request, and sign-in information to protect the service against misuse.

You can ask to access, correct, receive a copy of or delete your personal data, and to restrict or object to processing where applicable. We may need to verify your identity before acting. You can also complain to the Dutch Data Protection Authority or your local data protection authority.

For privacy questions or requests, contact ColdSilver at info@coldsilver.nl.