Privacy for Seller Listing Doctor

Seller Listing Doctor is a Shopify app. A seller connects their Google account and sees why Google rejected their products or limited their account, what Google says to change, and a link to each product in Shopify. It is run by Gomorra Labs LLC.

This page covers Seller Listing Doctor only, and the Privacy link at the foot of every screen in the app leads here. Our Privacy policy covers this website, and Privacy for our Shopify app covers our other app, Seller Profit Doctor. More about this app is on its own page.

The app asks Google for one permission over the store’s data, https://www.googleapis.com/auth/content. Google’s consent screen words it as “Manage your product listings and accounts for Google Shopping”, and Google offers no read-only alternative.

The app uses that permission read-only. It never creates, edits or deletes anything at Google. A test in the app’s code checks that it only makes the documented read calls.

The app also asks for openid, so it can tell one Google login from another. It never asks for your email address, name or profile.

Read live, for this store’s Merchant Center account only:

• The Merchant Center accounts this Google login can open, with their names and numbers, so you can choose one, confirm the login you connected, and see by name which account is being read. Read each time the main screen opens, and never stored.
• Products: each one’s title, image and offer ID, and its approval status and issues in each country.
• Account issues: the problems Google reports on the account as a whole.
• Google’s fix text for an issue (Google’s explanation of what to change), read only while you are on the page and open that problem.
• Google’s subject for the login, from the openid sign-in. It is used to make the hash described in section 5, and isn’t kept.

• Products (read_products), to link each problem to a product in Shopify.
• The shop’s name.
• The store owner’s email address (Shop.email), only when an email is about to go out, and when someone sends “Message us”. It is never kept.
• Whether the store has the plan, from Shopify’s Admin and Partner APIs.
• No customers and no orders.

Everything here belongs to one store and is kept for that store only.

• The store’s Shopify domain, and when it installed and last uninstalled the app.
• Shopify’s offline access and refresh tokens, encrypted with AES-256-GCM, so the app can read the store.
• The plan: the plan last read from Shopify, when it was read, when Shopify last confirmed it, and when Shopify first said there was no plan.
• The Google refresh token, encrypted with AES-256-GCM under its own key, and usable only for its own store. It is what lets the app read Google again without asking you to sign in each time, and what the daily check in section 7 uses.
• The chosen Merchant Center account number, and the permission Google granted.
• A keyed hash of Google’s subject for the login (an HMAC, under its own key), never the subject itself and never an email address. It is how the app knows whether another store uses the same login before ending its access at Google.
• The connection’s dates: when it was made, when a Reconnect became needed, and whether you were told.
• A sign-in in progress: a hash of its one-time value (a nonce) and its encrypted PKCE verifier, which keep the sign-in safe.
• A grant waiting for you to confirm it: a one-time code’s hash, the encrypted token, the permission granted and the login’s hash.
• The daily check’s memory: the issue codes and how many products each touches, the unit it counted in, how many listings it read, which account they came from, and when it ran. Codes only, never Google’s words. It is how the check knows what is new.
• How many times in a row the daily check has failed, so you can be told when it keeps failing.
• Which problems have been emailed, by code, and when, so the same problem isn’t emailed again too soon.
• Whether alert emails are on or off, and the date of the last one.
• Your “I’ve made this change” marks: the issue’s code or a hash of it, our group for it, and the dates, so a problem shows as waiting for Google.
• Shopify’s webhook delivery IDs, so a repeated delivery isn’t handled twice.
• Counts only: the reads of Google in the current few minutes, and the “Message us” sends today, to keep within limits.

• No products, titles, images or offer IDs, and no product's status.
• No Merchant Center account names.
• No customer data of any kind.
• No text Google wrote: an issue Google gave without a code is kept only as a hash, and a cleared problem's name is made from its code.
• No email address: the store owner's address is read from Shopify when an email is about to go, and never kept.
• No Google access tokens: each is made for a single request and never kept.
• No “Message us” message once it has been emailed to us.

Google data is used only to show you your own store’s problems and to tell you when something changes. What you see (products, statuses, account problems and Google’s words) is read when you open the app and exists only in that one response.

For paying stores, a scheduled job uses the stored Google token while you are away, about once a day, to read that store’s products and account issues and compare them with its last reading. The scheduled job never reads Google’s fix text. Stores without a plan aren’t read in the background.

Google’s fix text is requested only while you are on the page and open a problem’s details. It is never cached or stored, keeps Google’s order, and is cut down to an allowlist of safe formatting before it reaches the page. It never goes into an email.

Seller Listing Doctor’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Google user data isn’t sold, isn’t used for advertising, isn’t used to train any AI model, and isn’t read by a person unless you ask us to or the law requires it.

• Vercel hosts the app. Neon hosts the database.
• Resend sends the emails. For alerts it receives the store owner’s email address, the store’s domain, the plain words made from issue codes, and the counts. For “Message us” it receives your message, the owner’s address and the store’s domain. Google’s titles and fix text don’t go to Resend, and nor does anything about a product.
• Google and Shopify receive only what the app must ask them for.

Nothing is sold or shared for anyone else’s purposes.

An email goes when a problem is new, comes back or spreads, when a connection needs Reconnect, or when the daily check keeps failing. At most one a day, and any one problem at most once in 7 days. The switch is in the app, and every email has a one-click stop link.

Tokens are encrypted at rest with their own keys and are usable only for their own store. Access is scoped to each store by Shopify’s signed session. Traffic is HTTPS.

• A sign-in in progress, and a grant waiting to be confirmed: used once. Usable for 10 minutes, then removed by the next sweep, so about 40 minutes at most. An expired grant is revoked at Google if its login isn’t in use elsewhere; if Google can’t confirm that, the sweep tries up to 5 times, about 2.5 hours more, before our copy goes.
• Counts of reads of Google: after a day.
• “Message us” counts: after a couple of days.
• Webhook delivery IDs: once older than 7 days, as the store’s next webhook arrives.
• Which problems were emailed: 90 days.
• Marks on a problem Google has cleared: 30 days.
• The Google connection and all Google data: when you Disconnect, when you uninstall the app, or after 30 days without a plan, even if the app stays installed.
• The daily check’s memory, the marks and the alert history: also the moment Google refuses the token. Only a flag saying Reconnect is needed stays, until you reconnect or one of the events above. Connecting a different Merchant Center account clears those of the old one.
• Shopify tokens and the plan’s state: when you uninstall the app.
• The alert on or off setting, and when the last email went: when you uninstall the app. Disconnect leaves it, so a stop stays a stop.
• The store’s domain and its dates: when Shopify asks us to erase the store’s data, which it does 48 hours after the app is uninstalled, retrying for about 4 hours if we can’t answer. If the app has been installed again since, and Shopify still accepts that install’s token, the new install’s record stays. If that request never reaches us, a sweep deletes the record 7 days after the recorded uninstall.

• Disconnect in the app deletes the connection and its data, and asks Google to end the access, unless another store is using the same Google login, in which case the app says so and leaves that login’s access in place.
• You can also remove the app under Third-party apps and services in your Google account.
• Uninstalling the app removes everything above, on the schedule in section 13.
• Turn off email alerts in the app, or use the stop link in any email.

Questions about this page or the app: email support@sellerprofitdoctor.com. Gomorra Labs LLC runs Seller Listing Doctor.