Effective Date: January 15, 2026
Our diagnostic engine inspects only publicly accessible storefront endpoints (such as public /products.json catalog feeds and public CDN product images). We do not access private customer records, payment card details, or password-protected Shopify Admin accounts.
When using our Zero-Code CSV Merger, 100% of file parsing and merging is enforced via browser Content-Security-Policy (connect-src 'none') so CSV processing runs locally on your device. Your Shopify product export CSV is never uploaded to or stored on Asaf Audit Labs servers. Static storefront pages use zero third-party web-font CDNs or tracking scripts.
Legitimate Interest (GDPR Art. 6(1)(f)): For B2B store outreach, we collect publicly published merchant contact email addresses and public catalog metadata to prepare free sample accessibility evaluations under Legitimate Interest for B2B commercial communication.
Independent Public-Metadata Demonstrations: Any sample preview pages (marked noindex, nofollow) are independent demonstrations derived exclusively from publicly accessible catalog metadata. Asaf Audit Labs is not affiliated with, sponsored by, or endorsed by any sampled merchant.
We rely on the following infrastructure subprocessors:
checkout[custom][target_domain]) for fulfillment.noindex, nofollow) sample preview pages.Generated order remediation archives and audit metadata are retained for 90 days to support customer re-downloads and technical compatibility resolution tickets, after which they are purged upon request or automated expiry.
Right to Object & Erasure: At any time, you may object to B2B outreach or request immediate deletion of any sample preview page or stored contact/audit record by replying "no" to any email or writing to support@asaflabs.com.
Service Operator & Data Controller: Asaf Audit Labs (Principal & Lead Auditor: Asaf Mizrahi, Tel Aviv, Israel — support@asaflabs.com).