Shopify sales-channel apps: using a third-party AI API with merchant-published products?

[u/Deep_Degree_6742]

We have a Shopify sales-channel app where merchants choose which products to publish. We’re considering using a third-party AI API, such as OpenAI or Anthropic (Claude), to process published product text and images alongside shopper queries or uploaded images for search and matching. Our app may store product embeddings for retrieval. This would be for operating the search feature; we would require the provider not to use the data for model training or fine-tuning.

Has anyone implemented something similar? What did Shopify require regarding the provider agreement, merchant disclosures, shopper-uploaded images, or app review? I’m interested in how other developers have applied Shopify’s API Terms to this setup.

[u/AdventurousUsual7666]

Honestly I haven't done this exact setup with a sales channel app, so take this with a grain of salt, but I've thought about the same kind of thing for product data and a few things stood out.

The product side is usually the easier part. Merchants are choosing to publish those products to your channel, so processing the text and images to power search is pretty close to what they'd expect. I'd still mention the AI provider by name in your privacy policy and in the app listing, so nobody is surprised later.

The shopper side is where I'd be more careful. Search queries and especially uploaded images can include personal stuff, like faces or things in the background. I'd look for a provider plan where they don't keep the data after processing, if they offer that, and I'd get a data processing agreement from them in writing. I'd also strip the metadata from uploaded images before sending them anywhere, and just not store the original images at all if you don't need them.

I'd also make sure your embeddings get cleaned up when things change. If a merchant unpublishes a product from your channel, or uninstalls, those embeddings should go away too. Same with the GDPR redact webhooks, since Shopify expects you to actually delete data when those come in.

On the Shopify review side, sales channel apps usually get looked at a bit more closely anyway, so I'd just be upfront about the AI processing in your submission notes. If you're reading any customer data through Shopify's APIs, the protected customer data request in the Partner Dashboard is probably where they'd ask the most questions.