Privacy Policy

TaxonomyForge — product taxonomy & attribute enrichment for Shopify.

_Last updated: July 1, 2026_

Who we are

TaxonomyForge is operated by CGN Media Group LLC. Questions: chad.g.norris@gmail.com · 5036 3rd Ave S, St Petersburg FL 33707.

What data we access

TaxonomyForge requests only the read_products and write_products Shopify scopes.

• Products (read) — title, description, product type, vendor, tags, options, current taxonomy category, image alt text, and existing taxonomyforge.* metafields — used to detect catalog-quality issues and propose categories and attributes.
• Products (write) — after your explicit approval of each proposal, we set the product's standard taxonomy category, normalize its productType, and write attribute metafields under the taxonomyforge namespace. Nothing else is ever modified.

We do not read orders or customer data of any kind — no names, emails, phone numbers, addresses, payment details, or customer identifiers. Because TaxonomyForge never touches Protected Customer Data, it is out of scope for Shopify's Protected Customer Data review.

What we store

• Shop settings — your enrichment configuration (confidence threshold, write toggles, demo-mode flag).
• Enrichment proposals — the pending/applied category and attribute proposals for your products.
• Audit log — a before/after record of every scan, approval, and skip, so changes are traceable and reversible.
• Shopify session — the offline access token Shopify issues so the app can call the Admin API on your behalf.

How we use AI

Category matching, issue flagging, and attribute extraction run in a deterministic, on-server pipeline against a bundled subset of the Shopify Standard Product Taxonomy. We send only product copy (title, description, type, tags, options, image alt text) plus the pipeline's category candidates to Anthropic's Claude API, which picks the best candidate and refines the attributes. Its output is validated against the candidates before you ever see it, and nothing is written to your store without your approval. No customer data is sent to any third party. When no API key is configured, a deterministic local matcher is used and nothing leaves your server.

Data retention & deletion

When you uninstall the app (or Shopify sends a shop/redact request), we delete all data we hold for your shop: sessions, shop settings, enrichment proposals, and audit logs. We respond to the mandatory customers/data_request and customers/redact webhooks with an attestation that no customer data is held.

Contact

chad.g.norris@gmail.com