Privacy Policy

Sketch Audit (“we,” “us,” “our,” or “Company”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and otherwise process personal information when you use our Shopify application (“App”), including our dashboard and related services.

Sketch Audit is operated by Maple and Sketch Inc., a federally incorporated Canadian corporation. All data is stored and processed within Canada. We do not transfer personal information outside Canada except as required by law, or as described in this Policy for AI analysis (see Section 4).

2.1 Information from Shopify OAuth

When you install Sketch Audit, Shopify provides us with:

• Shop ID (unique identifier for your store)
• Shop name and shop domain
• Admin email address (from your Shopify account)
• Timestamp of installation and authorization

We use this information to:

• Create and manage your account
• Process your subscription and billing
• Contact you for critical account issues (e.g., GDPR data deletion requests)

2.2 Alert email address(es)

When you configure Sketch Audit, you separately provide one or more email addresses where you want to receive security alerts. These can be:

• Your personal email
• A team member’s email
• A shared inbox or group email
• Any external contact of your choice

We store these email addresses only to send security alerts when malware or suspicious code is detected in your store. We do not use these addresses for:

• Marketing or promotional emails
• Customer support (we do not provide email-based support)
• Any purpose other than alert delivery

2.3 SMS alert phone number (Pro)

On the Pro plan, you may optionally provide a mobile number for SMS alerts when a theme scan finds a problem that needs attention. We verify the number with a one-time code and require express consent before sending alerts. We use the number only for those security alerts and for processing STOP/opt-out requests. SMS is not included on Basic.

2.4 Store theme and code

To perform security scans, we collect and analyze:

• Theme HTML, CSS, and JavaScript files from your store’s theme
• SHA256 hashes of theme files (fingerprints to detect changes)
• URLs and domains loaded by scripts on your storefront
• Script code snippets that appear suspicious or unusual

We do not collect:

• Screenshots or visual data
• Customer data (names, emails, payment information)
• Store inventory or product data
• Customer browsing behavior
• Form submissions or user input
• Checkout page visuals

What we do with this data:

• Compare files day-to-day to detect malicious changes
• Analyze suspicious code patterns using an AI analysis service
• Store scan results in our database for 7 days (Basic and Pro)
• Generate alerts when compromises are detected

2.5 Scan results and alerts

We store:

• Scan timestamps (when each scan ran)
• Findings (suspicious files, malicious code snippets, URLs detected)
• Analysis results (AI-generated explanations and fix guidance)
• Alert logs (which alerts were sent, when, to whom)

You can delete this data anytime by uninstalling the App or requesting data deletion (see Section 7).

2.6 Browser extension data

The Sketch Audit Chrome extension is not currently offered on Basic or Pro. We do not collect page HTML or extension tokens for live-page scans as part of the current product. If we reintroduce the extension, we will update this Policy before offering it.

2.7 Support communications

Sketch Audit does not provide email-based support. If you contact us through our website contact form or other channels:

• We store your email address and message content
• We use this to respond to your inquiry and improve our service
• We retain contact messages for up to 30 days after responding
• If there is a dispute or suspected abuse, we may retain messages longer for investigation purposes
• Otherwise, all contact messages are permanently deleted after 30 days

We recommend consulting our help documentation or dashboard resources for common questions.

Sketch Audit uses an external AI service to analyze suspicious code findings. This means your code is sent outside Canada to the United States.

4.1 What we send to the AI service

When we detect suspicious code in your store:

• Malicious code snippets (the lines we flagged as suspicious)
• Your store’s baseline code (for context/comparison)

4.2 What the AI service does

The external AI analysis service:

• Analyzes the code for malware patterns and threats
• Generates explanations of what was found and why it’s dangerous
• Suggests step-by-step fix instructions for you
• Does not store or log your code beyond the immediate analysis

4.3 Data security and location

• Processing location: United States (third-party AI service infrastructure)
• Real-time processing: code is analyzed immediately and not stored after analysis
• Data handling: the AI service’s privacy policy governs how they process this data
• Legal safeguard: we have data protection agreements with our AI analysis provider to protect your data
• Retention: your code is not retained beyond the immediate analysis request

4.4 Your consent to US data transfer

By installing Sketch Audit, you consent to:

• Sending code samples to the AI service provider (US-based)
• Processing by the AI service provider’s servers located in the United States
• Data handling under the AI service provider’s privacy policies and US laws

If you do not consent to this international data transfer, do not install Sketch Audit. There is currently no option to disable AI analysis.

4.5 For GDPR users (EU)

If you are subject to GDPR, sending data to the US involves an international data transfer. While the AI service provider implements appropriate safeguards, data transferred to the US may be subject to US government access under US law (e.g., FISA orders).

Your options:

• Accept the US data transfer risk and use Sketch Audit
• Do not install Sketch Audit if you cannot accept this risk
• Contact us at [email protected] if you have questions about the AI service provider’s data protection practices

5.1 We do not share your data

We do not sell, rent, or share your personal information with:

• Marketing agencies or advertisers
• Data brokers or third-party data companies
• Competitors or other app developers
• Social media platforms

5.2 Third parties we do work with

We use third-party services to operate Sketch Audit. We contractually require all third parties to protect your data and use it only for their stated purpose.

All third-party vendors are contractually bound to protect your data under data processing agreements.

5.3 Legal disclosure

We may disclose your information if required by law:

• Court orders or subpoenas
• Government requests (law enforcement, tax authorities)
• Preventing fraud or illegal activity
• Protecting our legal rights

We will notify you of such requests unless legally prohibited.

We implement industry-standard security measures:

• Encryption in transit: all data sent to Sketch Audit is encrypted using HTTPS (TLS 1.2+)
• Database security: encrypted database with role-based access control and authentication
• Server security: secure Linux-based infrastructure with regular security patches and monitoring
• Access controls: only authorized staff can access customer data
• No public backups: database backups are stored privately, not publicly accessible
• API keys and credentials: stored securely using environment variables, never in code
• Network security: firewalls and network isolation for infrastructure

What we do not do:

• We do not encrypt data at rest in the database (we assess that the security risk is low given that sensitive scan data is temporary)
• We do not use client-side encryption (AI analysis requires server access to code for analysis)

If you have specific security requirements or concerns, contact us at [email protected] to discuss options.

7.1 Access, correction, and deletion (GDPR & CCPA)

You have the right to:

• Access: request a copy of all personal data we hold about you
• Correct: request corrections to inaccurate data
• Delete: request deletion of your account and all associated scan data
• Portability: request your data in a portable format (JSON/CSV)

To exercise these rights, email us at [email protected]. We will respond within 30 days (or as required by law).

7.2 Opt-out of communications

You can opt out of Sketch Audit email reports (nightly scan results and weekly / monthly summaries) at any time by:

• Clicking “Unsubscribe” in a summary report email (no login required)
• Contacting us at [email protected]
• Changing notification preferences in Sketch Audit → Settings

Note: we cannot opt you out of critical security alerts (e.g., malware detected), as these are essential to protecting your store. Manual scans only email when they find an alert.

7.3 Data deletion / “right to be forgotten”

When you uninstall Sketch Audit:

• Immediately: your account is marked as inactive (soft delete)
• 7 days later: all scan results are automatically deleted
• Upon request: we can immediately delete all data, including account information, scan history, stored baseline code, and all alerts and communications

To request immediate deletion, email [email protected] with subject “Delete My Data.”

9.1 Data storage location

Most Sketch Audit data is stored in Canada:

• Account information
• Scan results and findings
• Alert history
• Baseline code snapshots

All stored in an OVH VPS datacenter (Canada).

Exception — AI analysis service processing (USA): when AI analysis of suspicious code runs, that code is temporarily sent to the AI service provider (US-based) for processing. This constitutes an international data transfer to the United States.

Data flow:

• Your code is sent to the AI analysis service (US)
• The AI service analyzes it in real-time
• Analysis results are returned to Sketch Audit (Canada)
• Results are stored in Canada
• Original code is not stored by the AI service provider after analysis

By using Sketch Audit, you consent to this data transfer. See Section 4 for full details.

9.2 GDPR compliance (EU users)

If you are in the EU, you have additional rights under GDPR:

• Right to lodge a complaint with your data protection authority
• Right to data portability (we provide export in standard formats)
• Rights to restrict processing or object where applicable under law

As stated in Section 4, there is currently no option to disable AI analysis. If you cannot accept US data transfer for AI review, do not install Sketch Audit.

For GDPR inquiries, contact [email protected] with subject “GDPR Request.”

9.3 CCPA compliance (California users)

If you are a California resident, you have rights under CCPA:

• Right to know what personal information is collected, used, shared, or sold
• Right to delete personal information collected from you
• Right to opt out of the sale or sharing of your personal information
• Right to non-discrimination for exercising your CCPA rights

Note: Sketch Audit does not sell or share personal information for monetary consideration. Your information is used only to operate the App and provide security scanning.

For CCPA requests, email [email protected] with subject “CCPA Request.”

10.1 Dashboard cookies

When you log into the Sketch Audit dashboard, we use:

• Session cookies (required for authentication; deleted when you log out)
• Preference cookies (optional; remember your dashboard theme/settings)

We do not use:

• Advertising or tracking cookies
• Third-party analytics cookies
• Cross-site tracking

10.2 Browser extension

The Sketch Audit Chrome extension is not currently offered. We do not set cookies or local browser storage for an extension as part of the current product.

This Privacy Policy covers Sketch Audit only. If you click external links (e.g., to our website, Shopify), those sites have their own privacy policies:

• Shopify
• Twilio

We are not responsible for third-party privacy practices.

Sketch Audit is not intended for children under 13. We do not knowingly collect data from children. If we learn we have collected data from a child under 13, we will delete it immediately.

We may update this Privacy Policy at any time. We will notify you of material changes by:

• Email (to your registered store email)
• In-app notification (dashboard alert)
• Posting the updated policy here

Effective date of changes: 30 days after notification (or earlier if required by law). Your continued use of Sketch Audit after the effective date constitutes acceptance of the updated policy.

For privacy questions, data requests, or concerns:

• Email: [email protected]
• Website: mapleandsketch.com

Response time: we aim to respond within 30 days. For urgent security issues, contact [email protected] and mark the subject “SECURITY”.

If you are subject to GDPR or similar regulations, we can provide a Data Processing Agreement (DPA) that governs how we handle your personal data as a processor on your behalf.

To request a DPA, email [email protected] with subject “DPA Request.”