Lab Report Privacy Policy

Last updated: October 7, 2026

This policy explains how Digital Commerce Lab ("we", "us") collects, uses and protects information when a merchant uses Lab Report AI Audit ("Lab Report", "the app"), our app for Shopify stores.

Who we are

Digital Commerce Lab
85 Reichert Crt, Milton ON L9T 8R6, Canada
Email: devteam@digitalcommercelab.co

What Lab Report does

Lab Report audits the store that installed it. It opens the store's public pages in a browser on a mobile and a desktop screen size, takes screenshots, measures things like page weight and image sizes, and uses an AI service to write a report of issues that may get in the way of buying, with suggested fixes.

Information we collect

• Store details from Shopify: your store's name, address on Shopify (myshopify domain), connected domains, currency and the details Shopify provides when the app is installed, including an access token that lets the app read your store data. We use your domains to make sure audits only visit your own store.
• Sign in details from Shopify: to let you use the app, Shopify gives it a store-level access token. The app does not store staff names or email addresses.
• Product and collection data: through the read products permission, we read product and collection titles, links, images, prices, availability and whether they are published, so we can choose which pages to audit.
• Screenshots and page data: screenshots of your public storefront pages and measurements of those pages, such as load time, scripts, image sizes and the position of page elements. Screenshots show whatever is visible to any visitor of those pages.
• Your storefront visitor password (optional): if your store has a password page and you choose to save its visitor password in the app, we store it encrypted. This is the password shoppers type on your password page, never your Shopify admin or account login, which we never ask for.
• Numbers you enter (optional): figures you choose to type in from your own analytics: sessions, sessions with cart additions, sessions that reached checkout, sessions that completed checkout, average order value, currency, and the size of change you want an A/B test to detect. We keep each set you enter with its date, so the app can compare before and after.
• Your choices in the app: for example issues you mark as fixed, intentional or not relevant, the pages you choose or add for an audit, and the results of page rechecks.
• Plan information: which plan your store is on, which we read from Shopify. Payments are handled by Shopify. We never see or store card details.
• Server logs: our hosting provider records technical logs for running and troubleshooting the app, such as your store address, audit identifiers, the store pages visited and the AI cost of each audit. Logs never contain your storefront password or our access keys, and they are kept for a limited period.
• Support messages: anything you send us when you contact support.

Lab Report does not request access to your orders or customers, and we do not intentionally collect personal information about your customers.

How audits interact with your store

• To see a real cart, the audit adds one product to a cart in its own browser session. It never starts checkout, never buys anything and never changes your store, products or theme.
• While the audit browses your store, we block analytics and advertising tracking events where possible, so our visits stay out of your analytics and ad data.
• Shopify's own analytics may still count an audit or a page recheck as visits to your store and as an add to cart, because the audit really visits your pages. Keep this in mind when reading your store's numbers for the day of an audit.

How we use information

• To run audits and page rechecks and build your report and PDF.
• To show plans and limits, and to let Shopify bill you for paid plans.
• To provide support and fix problems.
• To keep the app secure and working properly.

We do not sell your information, and we do not use it for advertising.

AI processing

Screenshots and page data from your storefront are sent to an AI service, Claude by Anthropic, which analyses them and writes the findings in your report. Your storefront visitor password and the numbers you enter are never sent to the AI service. Under Anthropic's commercial terms, Anthropic does not use this data to train its models, and keeps it only for a limited period for operating its service and for safety, as set out in its terms. Expected lift figures in reports are our own estimates, not measurements of your store.

Service providers we use

• Shopify: app installation, sign in and billing.
• Anthropic: AI analysis of screenshots and page data.
• Render: hosting of the app, its database, audit files and server logs, in the United States (Virginia).

These providers process information only to provide their services to us. Because our hosting and AI providers are based in the United States, your information is stored and processed outside Canada and may be subject to the laws of that country.

How long we keep information

• We keep your store's last 10 audits for up to 90 days, then delete them automatically, including screenshots, page data, reports, PDFs and page recheck results.
• Full page screenshots used to build a report are deleted once the report is built. We keep the marked screenshots used in the report. Screenshots taken for a page recheck are deleted as soon as the recheck finishes.
• Numbers you enter are deleted automatically after 90 days. You can also remove them in the app at any time.
• If you uninstall Lab Report, we delete right away your saved visitor password, your audits, your recheck results, your issue choices, the numbers you entered, the sign in details and the Shopify access token. Any remaining information about your store is deleted when Shopify sends us its deletion request, about 48 hours after uninstall.
• Our hosting keeps daily backups for a short period. Deleted information can remain in these backups for up to about 8 days before it is removed.

Security

The app uses encrypted connections. Your storefront visitor password is encrypted when stored, and access to app data is limited to what is needed to run and support the service.

Requests from Shopify and your customers

We respond to Shopify's privacy requests, including customer data requests, customer deletion requests and store deletion requests. Lab Report does not store personal information about your customers.

Your rights

You can ask us to access, correct or delete information we hold about your store, or ask questions about how we handle it, by emailing devteam@digitalcommercelab.co. Depending on where you are, you may have additional rights under privacy laws such as Canada's PIPEDA. You can also remove your saved password and numbers in the app at any time, or uninstall the app.

Changes to this policy

We may update this policy. We will change the date at the top when we do, and for important changes we will let merchants know in the app or by email.

Contact

Digital Commerce Lab, 85 Reichert Crt, Milton ON L9T 8R6, Canada
devteam@digitalcommercelab.co