Tradecraft Privacy Policy
Effective date: October 9, 2026
Summary
Cabra Development Inc. runs Tradecraft. This policy tells you what personal information Tradecraft collects, why, and what rights you have. Tradecraft imports your store's catalog and photos, analyzes the photos with AI from Google, and helps you use them in your store. It also signs in the Tradecraft command-line tool and delivers releases. We collect only what we need to run these features and keep them secure. We do not collect your store's customer data. We do not sell or share personal information for advertising. We store data in the United States. When Shopify asks us to delete a store's data after an uninstall, we delete it within 30 days. You can ask us to see, correct, export, or delete your information.
1. Who we are
1.1. Cabra Development Inc. ("we," "us," or "our") is a British Columbia corporation. It also trades as Groupthought.
1.2. Our two roles.
- We are responsible for your account information, CLI sign-in data, license records, support messages, and technical data. For this information, we are the "controller" under EU and UK law.
- A store's content can also hold personal information. This includes photos, catalog data, brand material, the people who appear in photos, and photo metadata. For this information, we act as the Merchant's service provider, or "processor." We process it only on the Merchant's instructions, to provide the Service. The Merchant is responsible for having the rights to it and for giving any notices that the law requires. A business that needs a data processing agreement can ask us at help@groupthought.com.
1.3. This policy covers Tradecraft: the Tradecraft Shopify app and web application (the App), now served at https://assembly.groupthought.com; the Tradecraft command-line tool (the CLI), published on npm as tradecraft-cli; the delivery of packages, themes, and agent skills from our private GitHub release repository; and our support. Together, these are the Service. Our Terms of Service, at https://assembly.groupthought.com/terms, use the same terms.
1.4. Shopify, Dropbox, Google Drive, and GitHub also process your information under their own privacy policies when you use their services.
2. The information we collect
Account information. Accounts are by invitation. We keep your name, your email address, a one-way hash of your password (never the password itself), and the stores you are a member of and your role in each. If you link your Shopify account, we also keep your Shopify user ID. When you invite a person, we keep their email address and who sent the invitation.
Store information. When you install the App on a store, we keep the store's domain, name, website address, the access and refresh tokens that Shopify gives the App, and the state of the store's import. The App has these Shopify permissions: read and write products, files, and themes, and read metaobjects. Through them, we keep a copy of the store's products, collections, files, metaobjects, and themes.
No customer data. The App has no Shopify permission for customers or orders. We do not collect the personal information of your store's customers.
Photos and photo metadata. We store the photos that you import from Shopify, upload, or pick from Dropbox or Google Drive, and the resized copies that we make. We read the metadata in each photo, such as the date, the camera, and the GPS location if the photo has one. We turn a location into a place name, as section 6 describes. Photos can show people, such as models, and the location can show where a person was.
Analysis. We send photos and product data to Google to analyze them with AI. From the results, we keep tags, descriptions, groups, matches between photos and products, and numeric summaries of photos (embeddings) that let us find similar photos. We do not use face recognition, and we do not try to identify the people in photos.
Your website. To learn about your brand, the App opens your store's public website in an automated browser and reads its pages.
Connected accounts. If you connect Dropbox or Google Drive, we keep the access and refresh tokens, encrypted, and the name of the connected account. We read only the files that you pick.
Activity log. We record who made each change in the App, and when. When AI makes a change, we record it under an AI identity, not under a person's name.
CLI sign-in and release access. When you run tradecraft login, we issue a signed account token and a refresh token. The CLI keeps them on your computer, in ~/.config/tradecraft/session.json, with permissions that only your user can read. When the CLI asks for releases, we issue a GitHub token that can read only the release repository and that expires after 1 hour. We record which tokens we issued, to whom, and when.
License records. To decide whether a store holds a theme license, we use our records of Shopify Theme Store sales by store domain, and the records of copyright cases that we handle, such as DMCA notices. These records can include a store domain, the theme, the purchase date, the case details, and the names and contact details of the people in a case.
Technical data. Our servers record your IP address, user agent, the time of each request, and the request path. Error reports and performance data can include the same request data and your user ID.
Cookies. The App sets only cookies that are strictly necessary for it to work:
| Cookie | Purpose | How long |
|---|---|---|
| Session cookie | Keeps you signed in, and holds the state of a sign-in or of a Dropbox or Google Drive connection | Until you sign out or close the browser |
The App has no analytics or advertising cookies and no analytics scripts.
Support messages. If you contact us, we keep your message and our reply.
What the CLI does not send. The CLI sends no usage analytics or telemetry. It calls only the Service and GitHub. When the CLI reads or writes your store's theme files, it uses the Shopify CLI. Those files go between your computer and Shopify, not to us.
3. How we use your information
We use your information to:
- create and run your account, invite your team, and sign you in on the web and in the CLI;
- import your catalog and photos, analyze them, and write the changes that you ask for back to your store;
- check that your stores hold a theme license, and give or remove release access;
- show your team who changed what;
- keep the Service secure and working, find and fix errors, and prevent abuse;
- handle copyright cases and enforce our Terms and the Tradecraft License;
- answer your support requests, and send invitations and messages about the Service, such as security notices and changes to our terms; and
- obey the law.
We do not use your information for advertising. We do not use your photos or store data to train AI models, and our AI provider does not either (section 6).
4. Automated decisions
A computer program decides whether your account gets release access. It uses the license records in section 2. If the program refuses access and you think it is wrong, contact us. A person will review the decision. The AI analysis of photos makes suggestions. It does not make decisions about people.
5. Legal bases and consent
5.1. Canada. We collect, use, and disclose your personal information with your consent, for the purposes in this policy, or as the law permits or requires. You give consent when you accept an invitation, install the App, or use the Service. You can withdraw consent, but then we cannot give you the Service.
5.2. EU and UK. For the information we control (section 1.2), we rely on these legal bases under the GDPR and the UK GDPR. For store content, we follow the Merchant's instructions.
- Contract: to run your account, import and analyze your catalog and photos, check licenses, and give release access.
- Legitimate interests: to read your public website, keep the activity log, keep logs and error reports, prevent abuse, and protect our copyright, including in DMCA cases. We balance these interests against your rights.
- Legal obligation: to keep records that the law requires and to answer lawful requests.
6. Who we share information with
We do not sell personal information. We share it only with the service providers below, who process it for us under contract, and with the others listed after them.
| Provider | What it does | Where |
|---|---|---|
| Heroku (Salesforce) | Hosts the App and its database | United States |
| Amazon Web Services | Stores photos and the resized copies that we make | United States (us-east-1) |
| Google Cloud (Vertex AI, Gemini, Cloud Vision, Cloud Storage) | Analyzes photos and product data with AI, and stores files for batch analysis | United States |
| GitHub (Microsoft) | Delivers releases | United States |
| Mailgun | Sends invitations and account email | United States |
| Honeybadger | Error reports | United States |
| AppSignal | Performance and error monitoring | United States |
Google processes photos and product data as our service provider under Google Cloud's terms. Under those terms, Google does not use this data to train its models.
We also share information with:
- OpenStreetMap Foundation, through its Nominatim service in the United Kingdom. We send it only the GPS coordinates of a photo, to get a place name. We send no name, email address, or photo.
- Shopify, which runs the app platform and receives the changes that you ask the App to write to your store.
- Dropbox and Google Drive, only to read the files that you pick.
- Authorities and others when the law requires it, or to protect our rights, such as in a copyright case.
- A buyer or successor, if we merge, sell assets, or reorganize. This policy will continue to protect your information.
7. Where we store your information
7.1. We are in Canada. Our providers store and process your information in the United States. Shopify can process information in Canada and in other countries. The OpenStreetMap Foundation receives photo coordinates in the United Kingdom.
7.2. Notice for Canada. Your personal information is stored outside Canada, in the United States. It is subject to the laws of the United States, and its courts, law enforcement, and national security authorities can get access to it.
7.3. EU and UK transfers. The European Commission has found that Canada gives an adequate level of protection for commercial data. The United Kingdom has a similar rule. For transfers to the United States, we rely on the EU-US Data Privacy Framework and its UK extension when our provider is certified, or on standard contractual clauses or the UK addendum.
8. How long we keep information
We keep information only as long as we need it:
| Information | How long |
|---|---|
| Account information | While your account is open, and 90 days after you close it |
| Invitations not accepted | 90 days |
| Store data: catalog copy, photos, resized copies, metadata, analysis, embeddings, website pages, activity log | Until Shopify's deletion request after an uninstall, or until you ask us to delete it, plus up to 30 days |
| Files staged at Google for batch analysis | Until the batch ends, and at most 30 days |
| Shopify tokens for a store | Until you uninstall the App |
| Dropbox and Google Drive tokens | Until you disconnect the account or close your account |
| CLI account and refresh tokens | Until they expire, are used, or are revoked |
| Release token records | 12 months |
| Theme Store sales records | 7 years after the sale |
| Copyright case records | 7 years after the case ends |
| Server logs | 30 days |
| Error reports (Honeybadger) | 90 days |
| Performance data (AppSignal) | 30 days |
| Email logs (Mailgun) | 30 days |
| Database backups | 30 days |
| Support messages | 2 years after the conversation ends |
We can keep information longer if the law requires it or if we need it for a legal claim.
9. When you uninstall the App
When you remove the App from a store, the App stops reading from and writing to that store, and we delete the store's Shopify tokens at once. We keep the store's library for 48 hours, so that you can reinstall without loss. Shopify then sends us a shop deletion request (shop/redact). Within 30 days after that request, we delete the store's catalog copy, photos, resized copies, metadata, analysis, and activity log. This includes the stored photo files and the files staged at Google, as well as the database records. Copies in database backups expire within 30 days.
We keep our Theme Store sales records and copyright case records for the store, because they show the store's license. Your account stays open until you ask us to close it.
Shopify can also send customer data requests (customers/data_request and customers/redact). We hold no customer data, so we have nothing to give or delete.
10. Security
We protect your information with measures that suit its sensitivity. These include encryption in transit, password hashing, encryption of Dropbox and Google Drive tokens, short-lived release tokens that can read only one repository, and admin access for named staff only. The database and stored photos are encrypted at rest. No system is completely secure. If a breach creates a real risk of significant harm to you, we tell you and the regulators as the law requires.
You protect your password and the tokens on your own computer. If you think that someone has them, change your password, run tradecraft login again, and tell us.
11. Your rights
11.1. You can ask us to:
- give you access to your personal information and tell you how we use it;
- correct information that is wrong;
- delete your information;
- give you a copy of your information, including your photos and analysis, in a portable format; and
- stop or limit some uses, or withdraw your consent.
11.2. Send your request to our privacy officer (section 14). We may need to confirm your identity. We answer within 30 days, or sooner if your local law requires. Some laws let us keep some information, for example license records that we need for a legal claim. We do not charge a fee for a reasonable request.
11.3. If you are a person in a photo, or your information is otherwise in a store's content, the Merchant controls that information. Contact the Merchant. If you contact us, we pass your request to the Merchant and help it answer.
12. Region details
British Columbia and the rest of Canada. BC's Personal Information Protection Act applies to us. The federal Personal Information Protection and Electronic Documents Act applies to transfers across a border and to activity outside BC. If you are not satisfied with our answer, you can complain to the Office of the Information and Privacy Commissioner for British Columbia, or to the Office of the Privacy Commissioner of Canada.
Quebec. Our privacy officer (section 14) is responsible for personal information. Section 4 describes our only automated decision. We assess the risks before we transfer personal information outside Quebec. You can complain to the Commission d'accès à l'information du Québec.
EU and UK. You have the rights in section 11. You can also object to processing that relies on our legitimate interests. You can complain to your local data protection authority, or in the UK to the Information Commissioner's Office.
United States, including California. We do not sell or share personal information, as California law defines those words. We do not use it for targeted advertising or profiling. You have the right to know, access, correct, and delete your information. We will not treat you differently because you use these rights. An authorized agent can make a request for you, with proof of your permission. If we refuse your request, you can appeal by replying to our answer. We use the location in photo metadata only to label where a photo was taken.
Australia. We handle your information under the Australian Privacy Principles. When we disclose information to providers outside Australia, as section 6 describes, we take reasonable steps to make sure that they protect it. You can complain to us first, and then to the Office of the Australian Information Commissioner.
13. Children
The Service is for business use. It is not for people under 18. We do not knowingly collect information about children.
14. Contact and privacy officer
Contact our Privacy Officer about this policy or your information:
Email: help@groupthought.com Mail: Privacy Officer, Cabra Development Inc., 204 - 1055 Millar Creek Road, Whistler, BC V8E 0K7, Canada
15. Changes to this policy
We can change this policy. If a change is material, we tell you by email or in the App before it applies. The effective date at the top shows the current version.