What SearchReady does
SearchReady reads the product text and product fields already in your store and turns them into filterable attributes (material, room, whether a product can go outside, and so on). Those attributes power storefront search and the collection pages SearchReady can generate from them. It shows you, in the app, how much of each attribute it read and where every value came from.
What SearchReady reads and writes
The app asks for four Admin API permissions: read and write your products — we read the catalogue to build filters, and write back only the filter values you approve — read your shop’s languages, create the web pixel that measures whether search helped, and read the customer events that pixel produces. We do not ask for access to orders, customers, or payments.
What SearchReady stores
When a shopper searches, we store what they typed, what came back, and a session identifier we generate ourselves. In our own database we store a hash of the IP address, never the address itself. Our hosting provider’s request log is separate and does record IP addresses (see “Our hosting provider’s logs” below). We never ask Shopify for a shopper’s name, email, or address. Shopify does send us a customer’s contact details when that customer asks the shop for their data or asks to be erased: its notice identifies the customer and can include their email address and phone number. We do not keep the email address or phone number. For a data request we keep the customer’s Shopify ID with our answer, as described under “When a customer asks for their data”; for an erasure request we use the ID to delete that customer’s records and keep nothing.
What we remove before storing it
The text of a search is free text, and shoppers sometimes type personal details into it. Before a search record is written, we scan the text we are about to store and replace anything shaped like an email address, a phone number, a street address or postcode, an IBAN, or a long number with a label such as [EMAIL] or [PHONE]. The label stays in the record instead of the detail, so you can still see that something was taken out. This covers the search text, its normalised form, the alternative spellings we matched, the words we could not match, the steps we took to widen the search, and the search text on the storefront events our pixel sends us. The search itself runs on the original text, so this does not change what a shopper sees.
What that is not
It is pattern matching, and we do not tell you that a search record holds no personal data. It is deliberately tuned to leave product codes alone — barcodes and SKUs are not personal data, and a rule aggressive enough to catch every card number would have replaced hundreds of real barcodes in the catalogue we measured it against. Some shorter formats, including some older payment card numbers, are not caught. We do not look for names at all.
Where data is processed
In our own database, hosted for us by Railway in their US West region (California). Railway’s data processing terms state that their primary processing operations take place in the United States, and that customer data is backed up daily “across multiple sites and regions” — so we cannot tell you that your data sits in one region only. If you are in the EEA or the UK, that transfer is covered by Railway’s Data Privacy Framework certification or by the EU Standard Contractual Clauses.
Our hosting provider’s logs
Railway, which hosts SearchReady, also keeps logs for us, including a log of what the app does and a log of the requests that reach it. The request log records, among other things, the IP address each request came from. These logs are separate from our database: they are not cleared when a search record expires, when a customer asks to be erased, or when you uninstall. Railway sets how long the request log is kept.
How SearchReady builds filters, and what that sends
To turn your product text into filters, SearchReady sends each product’s title and description to OpenAI’s API (the gpt-5.6 model) so it can propose filter values; you approve or reject those values before anything is written back to your store. We send product catalogue text only — never a shopper’s search, and never a name, email, or address. OpenAI processes this text for us as a sub-processor, and under OpenAI’s API terms this data is not used to train OpenAI’s models.
Subprocessors
SearchReady uses two sub-processors: Railway, which hosts the app, the database and the logs described above, and OpenAI, which proposes filter values from your product text as described above. Beyond these two, no other company receives your catalogue or your shoppers’ searches.
Retention and deletion
Search records carry a deletion date, 90 days by default. Deletion is triggered by activity reaching the app rather than by a timer, and it runs at most once every 24 hours. If nothing reaches the app at all, a record can pass its deletion date before the next sweep removes it. Your dashboard shows when the sweep last ran, and says so if it has stopped. A customer data request file, described below, is a copy made when the request arrives and is kept for 30 days, so a search linked to that customer can stay in the file for up to 30 days after the search record itself has been deleted.
When a customer asks for their data
When you request a customer’s data in Shopify, for example because the customer asked you for it, Shopify passes the request to SearchReady. We collect the search records and storefront events we hold that are linked to that customer’s Shopify ID, with every field we store for them, into a file you can download from the SearchReady dashboard. The file also holds the customer’s Shopify ID and, where Shopify provides one, its reference for the request. SearchReady does not record which customer made a search or triggered a storefront event, so today the file normally lists no records. You can download the file for 30 days after the request arrives; after that it is no longer available, and the next deletion sweep removes it. If the customer asks to be erased, or your shop’s data is deleted, the file is deleted too.
When you uninstall
Your shop’s data is deleted from our database, including any customer data request files. Our hosting provider’s logs are not part of that deletion.
Billing
SearchReady’s paid plans include a 14-day free trial and are billed through Shopify every 30 days. SearchReady does not use credits: the evaluation credits and monthly credits described in the Terms of Service do not apply to SearchReady.