Data Deletion Instructions

Last updated: April 19, 2026

This page explains how to request deletion of data collected by PopSmart Studio when you connect third-party accounts such as Instagram, Facebook, or Pinterest for use with the Publisher feature. PopSmart Studio is operated by PopSmart ("we", "us", or "our"). If you are a Shopify merchant, your general data rights are also described in our Privacy Policy.

1. Automatic Deletion on App Uninstall

The simplest way to remove all data associated with your store is to uninstall PopSmart Studio from your Shopify admin. When you uninstall the app:

  • Immediately — all connected Meta (Instagram, Facebook) and Pinterest OAuth access tokens stored in our database are marked as revoked, and no further posting can occur on your behalf. In-flight scheduled publishing jobs are cancelled.
  • Within 48 hours — Shopify sends us a mandatory shop/redact webhook. At that point we permanently delete your merchant record, Shopify session data, support tickets, AI-generated images, publishing history (including captions, SEO metadata, and alt text), fitting analytics, and the encrypted OAuth tokens themselves. Customer photos submitted through the virtual try-on widget are already deleted within 24 hours of upload and are not retained beyond that window.

No further action on your part is required for this automatic deletion.

2. Manual Deletion Request

If you are unable to uninstall the app (for example, because your Shopify store has already been closed, or because you want data erased before the 48-hour Shopify grace period), you may request manual deletion by email.

2.1 How to Submit a Request

Send an email to team@popsmart.ai with the subject line "Data Deletion Request" and include the following information:

  • The email address you used to register with Shopify or PopSmart
  • Your Shopify store domain (for example, your-shop.myshopify.com)
  • Optional: the Meta / Pinterest account name or handle that you connected to Publisher, so we can confirm we have removed the correct integration

We will acknowledge your request within 3 business days and will not request any additional personal information beyond what is necessary to verify that you are authorised to make the request.

2.2 What We Delete

A confirmed manual deletion request removes the following data associated with your account:

  • Meta (Instagram, Facebook) and Pinterest OAuth access tokens and refresh tokens
  • Social account metadata: connected account or page identifiers, board identifiers, display names, and profile images cached for the Publisher UI
  • Publishing history: scheduled, queued, published, and failed publishJob records, including AI-generated captions, SEO descriptions, and alt text attached to those jobs
  • Publisher-related assets stored in our Cloudflare R2 object storage, including source product images, rendered carousel outputs, and watermarked share-intent images
  • AI-generated images stored in your Studio library (both pinned and unpinned items)
  • Customer photos and Body Profile data associated with your store (these are also subject to separate 24-hour and Customer-Account-driven deletion mechanisms)
  • Support ticket history and attachments, audit logs, webhook logs, and billing event records (except where retention is required by applicable tax or accounting law, in which case the records are de-identified)

2.3 Timeline

We will complete deletion and send you a confirmation email within 30 days of verifying your request, in line with GDPR Article 17 and comparable data protection laws. Where a Shopify shop/redact webhook is available for your store, we rely on it to perform the deletion; otherwise, we run the same deletion procedure manually against our database and object storage.

3. Disconnecting an Individual Integration

If you want to revoke access for a specific social platform without uninstalling PopSmart Studio, you can do so at any time:

  • From Studio — open the Publisher settings in your Studio dashboard and click "Disconnect" on the Instagram, Facebook, or Pinterest card. Tokens are purged from our database at the moment you confirm the disconnection.
  • From Meta — visit Facebook Business Integrations and remove "PopSmart Studio". Meta will revoke the token on their side; our database row will be marked revoked on the next attempt to use it (or earlier if you also submit a manual deletion request).
  • From Pinterest — visit your Pinterest account settings → "Apps" and remove "PopSmart Studio".

4. Data Already Deleted Automatically

Some categories of data are deleted on a short, automatic schedule regardless of any request:

  • Customer photos uploaded for virtual try-on — deleted within 24 hours of upload.
  • Temporary GDPR export files — accessible only via a 48-hour signed URL; the underlying object is deleted on Shopify shop/redact.
  • Failed AI generation intermediates — purged by nightly cleanup jobs.

5. Questions and Appeals

If you believe a deletion was not carried out correctly, or if you wish to appeal a decision about your data, contact us at team@popsmart.ai and reference the original deletion request. You also have the right to lodge a complaint with your local data protection authority.

6. Contact

PopSmart
Email: team@popsmart.ai