Legal & Privacy

Privacy Policy

Savage SI (trysavage.si) · Effective October 21, 2026

1. Data we collect & least-privilege scopes

Savage Cart and the Savage SI Suite process merchant catalog metadata, anonymous cart session attribution tokens (_savage_session), and, when Savage Rewards is enabled, customer order points balances. OAuth tokens are encrypted at rest with AES-256-GCM.

2. Search-by-photo privacy

Shopper images submitted to Savage Search are processed in memory to compute a query and are never stored on disk or in object storage.

3. Mandatory GDPR & privacy webhooks

We honor all Shopify mandatory compliance webhooks (customers/data_request, customers/redact, and shop/redact) by permanently deleting associated records in our database and recording the deletion in our immutable audit log.

4. Contact

For privacy inquiries or data requests, contact support@trysavage.si.