Privacy policy for Celeris for Flow
Effective date: 2026-10-28
Marqo Inc, operating as Celeris, operates Celeris for Flow. Contact support@celeris.ai with privacy questions or requests.
What the app reads
The app requests no access scopes. It reads what the merchant puts in the action fields; Shopify Flow renders that text before sending it to the app. From the Admin API it reads only the shop's ID and whether the shop is a development store, and it sends the shop ID to Shopify's Partner API to check the shop's Celeris for Flow plan.
What the app stores
The app does not store the question, text, images, or reason in its database or logs. The run record holds only answer fields and expires after 48 hours. There is no prompt logging or input-recording debug mode.
Logs hold metadata only: shop, action_run_id, handle, status, latency, Celeris input tokens, and image count.
Per shop, the app stores the Shopify session, monthly answer counts and limit, plan cache, installation state, and usage outbox for billing events. Monthly counts and the limit remain across uninstall and reinstall until shop/redact.
Processing and hosting
The app sends the question, text, and images to the Celeris API, which Marqo Inc also operates, to compute the answer. Celeris runs its own models on AWS and Nebius and does not send the content to other model providers. Celeris does not write request content to its logs.
Content from this app is excluded from Celeris's model-improvement capture. Celeris does not keep the question, text, images, or reason after answering, and does not use them to train or improve models. Celeris keeps usage records including token counts, outcome, model, and region for 90 days. See Celeris security and data handling.
The app is hosted on Cloudflare Workers, with per-shop storage in Cloudflare Durable Objects.
Uninstall and deletion
On app/uninstalled, the app deletes the Shopify session and stops answering. It retains the usage outbox for 24 hours after uninstall to send remaining billing events. Run records still expire after 48 hours.
The app handles Shopify's GDPR/CCPA compliance webhooks: customers/data_request, customers/redact, and shop/redact. It stores nothing keyed by customer, so the customer webhooks acknowledge the request. A current shop/redact deletes all of the shop's stored data, including sessions, run records, monthly counts and limit, plan cache, installation state, usage outbox, schema metadata, and the alarm. Older webhooks from a prior installation are ignored when newer installation proof exists.