Privacy Policy

PageGen is an AI-powered Shopify product page generator operated as an individual business. The data controller for your personal information is:

We collect the following categories of personal data:

We do not sell your data, use it for advertising, or share it with data brokers.

• To provide and operate the PageGen service (AI generation, Shopify sync, billing)
• To manage your subscription and process payments via Stripe
• To send transactional emails (sign-up confirmation, billing receipts) — no marketing without consent
• To respond to bug reports and support requests you submit
• To detect and prevent abuse, fraud, or security incidents
• To comply with legal obligations under EU law

• Contract (Art. 6(1)(b)): Processing necessary to deliver the service you signed up for.
• Legitimate interest (Art. 6(1)(f)): Security, fraud prevention, service improvement.
• Legal obligation (Art. 6(1)(c)): Keeping billing records as required by Belgian and EU tax law.
• Consent (Art. 6(1)(a)): For any optional analytics or marketing communications — you can withdraw at any time.

We use the following sub-processors. Each has its own GDPR-compliant privacy policy:

SCCs = EU Standard Contractual Clauses, ensuring GDPR-compliant transfers to non-EU countries.

• Account data: retained while your account is active, then deleted within 30 days of account deletion.
• Generated product pages: retained until you delete them or your account.
• Billing records: retained for 7 years as required by Belgian fiscal law.
• Server logs: retained for 30 days by Vercel, then automatically purged.
• Feedback submissions: retained for up to 2 years, or until resolved.

As an EU/EEA resident, you have the following rights:

• Right of access (Art. 15): Request a copy of all data we hold about you.
• Right to rectification (Art. 16): Correct inaccurate personal data.
• Right to erasure (Art. 17): Request deletion of your account and personal data.
• Right to portability (Art. 20): Receive your data in a machine-readable format.
• Right to object (Art. 21): Object to processing based on legitimate interest.
• Right to restrict processing (Art. 18): Limit how we use your data while a dispute is resolved.

To exercise any right, email creativxm@gmail.com. We will respond within 30 days. You also have the right to lodge a complaint with the Belgian Data Protection Authority (GBA / APD) at dataprotectionauthority.be.

PageGen uses only strictly necessary cookies required for authentication (Clerk session cookies) and security (CSRF tokens). We do not use tracking, advertising, or analytics cookies.

No cookie consent banner is required because we only use technically necessary cookies, which are exempt under the ePrivacy Directive.

• All data is transmitted over HTTPS/TLS.
• Database access uses Supabase Row-Level Security (RLS) and service-role keys — never exposed to browsers.
• Payment data is handled exclusively by Stripe — we never see or store card numbers.
• API keys and secrets are stored as environment variables, never in source code.

PageGen is not directed at children under 16 years of age. We do not knowingly collect personal data from children. If you believe a child has provided us with personal information, please contact us and we will delete it promptly.

We may update this policy from time to time. When we do, we will update the "Last updated" date at the top of this page. For material changes, we will notify you by email. Continued use of PageGen after changes constitutes acceptance of the updated policy.

For any privacy-related questions or to exercise your rights: