Privacy and Cookie Policy
Effective date: September 1, 2026
This Privacy and Cookie Policy explains how Averta Ltd., doing business as Depicter (“Depicter,” “Averta,” “we,” “us,” or “our”), collects, uses, discloses, stores and protects personal information when you use:
– the Depicter website, account portal, support services and related online services;
– the Depicter WordPress plugin, its account, licensing, support and connected services; and
– the Depicter Shopify app (the “Shopify App”).
By using a Depicter service, you acknowledge that you have read this policy. Your use of our services is also subject to the applicable Terms of Service.
1. Our role
When a Shopify merchant or website owner uses Depicter to collect information from visitors, that merchant or website owner generally determines why and how the information is collected. The merchant or website owner is responsible for providing appropriate notices, obtaining consent where required and responding to its visitors or customers. Depicter processes that information to provide the service on the merchant’s or website owner’s instructions.
For Depicter account information, service security, billing, support, analytics and business administration, Depicter may process personal information for its own purposes as described in this policy.
2. Personal information we collect
Information you provide directly
We may collect information that you provide when you create an account, purchase or use a service, contact support, participate in a survey or promotion, or otherwise communicate with us. This may include:
– name, email address, account credentials and contact information;
– company, website, store or domain information;
– billing jurisdiction and limited payment-related information received from our payment provider, such as card type, last four digits, expiration information or payment status;
– support messages, feedback, survey responses and other communications;
– designs, text, links, images, videos, settings and other content you upload, create or provide through Depicter;
– marketing preferences.
Information received from third-party services
If you sign in, connect or interact with Depicter through another service, we may receive information permitted by that service and your settings, such as an account identifier, access token, profile information or information needed to operate the integration.
If you communicate with us through social media or share user-generated content with us, we may receive your account name, profile information and the content you choose to share.
Information processed in connection with the WordPress plugin
When a website owner installs or uses the Depicter WordPress plugin or a connected Depicter service, we may process:
– the website domain, Depicter account, license, subscription and plugin-version information;
– slider, popup, notification-bar, carousel, hero-section and other designs, settings and content created by the website owner;
– uploaded images, videos, fonts and other media or generated variants;
– configuration for WordPress, WooCommerce, data sources, media providers or other integrations selected by the website owner;
– technical, diagnostic, error, compatibility and support information needed to provide or troubleshoot the plugin;
– visitor or form information collected through a Depicter feature configured by the website owner.
The WordPress website owner controls its own website, hosting environment and the Depicter features it configures. The website owner is responsible for providing appropriate privacy notices and obtaining consent where required for information collected through its site.
Information received through the Shopify App
When a merchant installs or uses the Shopify App, we may receive or access:
– the Shopify store domain, App account and installation status;
– granted permissions and an offline access token used to connect the App to the merchant’s store;
– product information selected or used by the merchant in Depicter content;
– Online Store, theme and custom-data information needed to create, preview, publish or maintain storefront content;
– store-owner information such as name, email address, phone number and physical address, and blog-contributor information such as email address, IP address, browser and operating-system information, where made available by Shopify under the App’s granted permissions;
– slider, carousel and hero-section designs, text, links, settings, uploaded images and resized or generated media variants.
The Shopify App is not intended to import Shopify customer or order records through the Shopify Admin API. Information submitted directly through a storefront form is described below.
Storefront forms and lead information
When a merchant or website owner publishes a form created with Depicter, the form may collect information selected by that merchant or website owner, including:
– email address and merchant-defined form answers, which may include a name, phone number or other information;
– consent status, consent time and the wording shown when consent was requested;
– submission time, referring page, IP address, user agent and referring URL;
– campaign and advertising identifiers contained in the page URL, such as UTM parameters, gclid, fbclid or msclkidgclid, fbclid or msclkid
– spam-detection and validation information.
The merchant or website owner decides which fields to display and is responsible for ensuring that the collection and use of form information complies with applicable law.
AI prompts and generated content
If you choose to use an optional AI feature, we may process the prompt, keywords, categories, generation settings and other information you submit, together with the generated result. Do not include personal, confidential or sensitive information in a free-text AI prompt unless you have a lawful reason and appropriate authority to do so.
Information collected automatically
When you use Depicter services or visit our website, we and our service providers may automatically collect:
– IP address and approximate location;
– browser, device, operating system, language, network and unique-device information;
– pages visited, referring pages, timestamps, clicks, searches, scrolling, browsing time and interactions;
– service performance, load times, errors, authentication events, request identifiers and security information;
– campaign, attribution and advertising information.
We may combine information collected from our services with information received from partners where permitted by law.
3. Cookies and similar technologies
We and our partners use cookies and similar technologies to provide and secure our services, keep users signed in, remember preferences, understand service usage and, where permitted, measure or personalize marketing.
We use the following categories:
– Essential cookies: required for authentication, security, navigation and requested service functionality. These cookies cannot be disabled through our cookie controls where they are strictly necessary.
– Performance and analytics cookies: help us understand visits, traffic sources, errors and how users interact with our services.
– Targeting and advertising cookies: may be used by us or advertising partners to measure campaigns and show relevant advertising, where permitted and subject to your choices.
Where required by law, non-essential cookies are used only after you provide consent. You can accept, reject or adjust available categories through our cookie banner or browser settings. Blocking some cookies may affect service functionality.
4. How we use information
We use personal information to:
– create, authenticate and administer accounts;
– provide, operate, maintain and improve Depicter services;
– allow users to create, save, preview and publish designs and storefront content;
– store and deliver uploaded media and generated variants;
– collect, display, export, synchronize and delete leads on a merchant’s instructions;
– record consent and submission context;
– provide attribution, validation and spam protection;
– provide optional AI-assisted generation requested by a user;
– operate integrations expressly selected by a user or merchant;
– process purchases and manage subscriptions;
– provide support and troubleshoot errors;
– monitor performance, analyze service usage and improve search or content discovery;
– protect accounts, detect abuse and maintain service security;
– send service communications and, with consent where required, marketing communications;
– comply with law, enforce agreements and respond to valid privacy requests.
We do not sell personal information.
5. Legal bases
Where applicable law requires a legal basis, we process personal information based on one or more of the following:
– performance of a contract or steps requested before entering into a contract;
– our legitimate interests in operating, securing, supporting and improving the services, where those interests are not overridden by your rights;
– consent, including for optional marketing or non-essential cookies where required;
– compliance with legal obligations;
– protection of vital interests or establishment, exercise or defense of legal claims where applicable.
You may withdraw consent at any time, without affecting processing that occurred before withdrawal.
6. Merchant access, export and deletion
Shopify merchants can use the Depicter dashboard to view, export and delete lead submissions associated with their own account. Leads may be deleted individually or in bulk, and requests are scoped to the authenticated merchant account.
If you submitted information through a merchant’s storefront or another website using Depicter and want to access, correct or delete it, contact that merchant or website owner first. They control the form and can identify the context in which the information was collected. Depicter assists merchants with verified requests, including valid privacy requests delivered through Shopify.
7. AI-assisted features
Depicter may offer optional AI features that generate editable headings, body copy, keywords, colors or other content. The feature is initiated by the user and does not automatically publish its output.
Merchant-entered prompts and generation settings may be sent through Depicter’s server-side service to OpenAI, which currently provides the GPT-4o model used for the Shopify App’s AI feature. We do not intentionally include Shopify customer or order records or storefront lead submissions in these AI requests.
OpenAI states that information submitted through its API is not used to train or improve its models by default unless the API customer explicitly opts in. OpenAI also states that default API abuse-monitoring logs may be retained for up to 30 days unless different approved data controls apply or longer retention is legally required. For more information, see OpenAI’s business data privacy information and OpenAI API data controls.
8. How we disclose information
We disclose information only as needed to operate our services, follow user instructions, protect rights and security, or comply with law. Recipients may include:
– Shopify: Shopify App installation, authentication, App operation and publishing to a merchant’s store;
– Hetzner: hosting and infrastructure used for App services and application data;
– Cloudflare: network security, TLS termination, traffic delivery, content delivery and R2 object storage;
– OpenAI: optional AI generation requested by a user;
– Google Analytics: website and service analytics;
– Mailchimp: Depicter marketing emails and, when a merchant enables the supported integration, synchronization of selected lead information;
– Typeform: surveys that a user chooses to complete;
– Paddle: checkout, payment and subscription processing;
– WordPress hosting and connected services: information may also be processed in a website owner’s own hosting environment or by integrations and media/data providers that the website owner chooses to enable;
– connected services and media providers: when a user chooses to connect, embed or use that service;
– professional advisers, authorities and transaction participants: when reasonably necessary to comply with law, protect rights or security, investigate misuse or complete a business transaction subject to appropriate safeguards.
We require service providers to process information only for the services they provide to us and subject to applicable contractual and legal obligations.
9. Retention
We retain information only for as long as reasonably necessary to provide the services, fulfill the purposes described in this policy, comply with legal obligations, resolve disputes and protect the services.
– Shopify storefront form submissions are retained for up to 120 days unless the merchant deletes them sooner or a valid privacy request or shop-deletion event requires earlier deletion.
– Records of successfully handled Shopify webhooks are retained for up to 60 days.
– Records of failed Shopify webhooks may be retained for up to 180 days to investigate and resolve delivery or processing failures.
– Account, configuration, content, media, authentication, billing, security and support information is retained while needed to provide and protect the services and for a limited period afterward where required for security, dispute resolution, backup or legal purposes.
– Information processed through the WordPress plugin is retained according to the applicable Depicter service, the website owner’s configuration and instructions, and the storage or retention controls available in the website owner’s WordPress environment.
– AI-provider retention is described in Section 7.
– Marketing information is retained until consent is withdrawn, the user unsubscribes or the information is no longer needed, subject to limited suppression records used to honor opt-out requests.
Deletion from active systems may not immediately remove limited copies from security logs or backups. Such copies are isolated from ordinary use and expire under applicable security and backup schedules, unless longer retention is legally required.
10. Shopify uninstall and privacy requests
When Shopify delivers a valid customers/data_request, customers/redact or shop/redactcustomers/data_request, customers/redact or shop/redact request, we use the identifiers provided by Shopify to locate information associated with the relevant store or person and assist the merchant with access or deletion as applicable.
Following uninstall and receipt of Shopify’s shop-deletion request, we disable the App account and permanently delete the store’s form submissions. Other information is deleted, anonymized or retained only for the limited operational, security, backup or legal purposes described in this policy.
11. International processing
Depicter and its service providers may process information in the European Economic Area, the United States and other countries where they or their infrastructure operate. These locations may have data-protection laws different from those in your country. Where required, we use appropriate contractual or other legal safeguards for international transfers.
12. Security
We use administrative, technical and organizational safeguards designed to protect information. These include encrypted network transport, access controls, account-scoped application queries, private infrastructure components and encryption of authentication tokens. No system is completely secure, and we cannot guarantee absolute security.
13. Your privacy rights
Depending on where you live, you may have rights to:
– request access to or a copy of personal information;
– request correction or deletion;
– request restriction of processing;
– object to certain processing;
– receive information in a portable format;
– withdraw consent;
– opt out of marketing communications;
– complain to a data-protection authority.
For information submitted through a merchant’s storefront or another website using Depicter, contact the merchant or website owner first. For information controlled by Depicter, contact us using the details below. We may need to verify identity and authority before acting on a request.
14. Children's information
Our services are intended for website owners, businesses and merchants and are not directed to children. Users must not use Depicter forms to knowingly collect children’s personal information unless permitted by applicable law and supported by appropriate notice and consent.
15. Third-party websites and services
Depicter content may link to or embed third-party websites, media or services. Their privacy practices are governed by their own policies. We encourage users and visitors to review those policies before providing information or enabling an integration.
16. Changes to this policy
We may update this policy to reflect changes to our services, practices or applicable law. We will update the effective date when changes are made. If a change materially affects how we process personal information, we will provide notice where required.
17. Contact us
For privacy questions or requests, contact:
Averta Ltd. / Depicter
Email: [email protected]
Website: https://depicter.com/
When contacting us about information submitted through a Shopify store or another website, please identify the relevant merchant, store or domain and provide only the information needed for us to route the request.