Legal
Privacy
Last updated 8 September 2026. This is a product page, not legal advice.
Who we are
Buyable runs a mystery shopper against a store. If checkout fails for an agent, we host a thin handshake the merchant allowlists. The merchant stays merchant of record. We do not list shops in ChatGPT or Google.
What we store
- Shop domain and public test-buy reports
- Handshake catalog, ship-to countries, qty, returns copy
- Shopify OAuth access token with read_products only, server-side
- Sandbox order ids we print as proof (not live charges)
What we do not store
- Customer names, emails, addresses, or payment instruments
- Card numbers. We do not take cards yet
- Customer funds. Shoppers pay you, not us
Shopify
Install is OAuth. Scope is read products. Uninstall deletes the shop token. GDPR topics customers/data_request, customers/redact, and shop/redact return 200 because we hold no customer records to redact.