Last updated 30 October 2026
Herolight is a Shopify app made by Entafix, Cumhuriyet Mahallesi Aşık Veysel Caddesi, 34290 Küçükçekmece, İstanbul, Türkiye. It makes product photographs, short product videos and ads from the photographs a merchant already has, for the merchant to review and apply. This page says what the app reads, what it keeps, who it shares it with, and how it is deleted.
When you install Herolight you grant it access to your products (read and write). It reads product titles, descriptions, types, vendors, categories, variants' SKUs and barcodes, their options (such as colour names and swatches), the collections a product belongs to and its page address, and product media, and it writes only what you approve: new photographs and videos, each with a short image description, and — unless you choose otherwise in Settings — a new photograph as the picture of the product variant whose photograph it was made from. It also reads your store's account e-mail address. It has permission to change your store's files, which it uses only to take off a product a photograph or video it added there, when you undo it, or the photograph a white background replaced, which stays in your store's Files. It asks for no other permission.
Herolight does not request access to customers or orders. It never reads, stores or processes any information about your customers.
For each store that installs it, Herolight keeps:
• your store's myshopify.com address and the access token Shopify issues to the app;
• your plan, credit balance and a record of what credits were spent on;
• your settings (app language, file format, where added photographs go, the house looks you keep, the model you choose as your brand model, and the logo and colour you set for your ads and the box in unboxing videos);
• the jobs you run: which products, which photographs, the generated photographs, videos and ads, and whether you applied them, so you can review, download or undo them;
• what our image-reading step noted about your product photographs (for example the product type or whether a logo is visible), so the same photograph is not read and charged twice;
• what the Your products page notes about your products, such as how many photographs each has;
• photographs you upload yourself, including reference photographs of models you choose to use;
• the reason and note you give when you report a bad photograph;
• the scenes you write or have written for you, and the favourites you mark;
• your store's account e-mail address and name as Shopify gives them, to answer a scene you ask us to make and to know who writes in the help chat, and for the only e-mails the app sends you: a welcome once when you install, and a note when your credits run low and when they run out (you can turn those two off in Settings). We never send marketing e-mail.
Herolight does not store the names or email addresses of your staff. Generated photographs are stored at web addresses that are not listed or indexed anywhere, so that they can be shown in the app and copied onto your products.
To make a photograph, a video or an ad, the app sends the product photograph and the product's own text to AI models run by fal.ai (United States), which hosts the image and video models Herolight uses, together with whatever you chose for that job: a model's or a place's reference photograph you uploaded, the product's other photographs, your logo and the words you wrote. The questions that read a photograph (what the product is, whether it carries writing, whether a result kept it) and the writing of an ad's words go through fal.ai to Google's Gemini model by way of OpenRouter (both United States). Only what that one job needs is sent, and no customer data exists to send.
Herolight does not use your store's data, photographs or results to train AI models, and does not ask anyone to. fal.ai processes what it receives only to provide the service and treats it as confidential; its terms allow it to use anonymised, aggregated usage data derived from requests to improve its services. OpenRouter states that it does not store prompts or responses unless an account opts in, and Google's terms for paid use of Gemini state that it does not use prompts, images or responses to improve its products.
The app, its database and the files it keeps (generated photographs, videos and your uploads) live on one virtual server at a hosting provider. Traffic to the app reaches that server through Cloudflare's network. Payments are handled entirely by Shopify through its billing system; Herolight never sees card details.
When you report a photograph, or when you ask us to make a scene for you and the help chat cannot load, a short message with your store address, your words, a link to the photograph or any picture you add, and your store's account e-mail address is e-mailed to our own team so a person can look at it and answer you.
These messages, and the e-mails the app sends you, are sent through Brevo (France), which receives the message and the addresses in it to send it.
The help chat in the app is run by Crisp (France). It loads from Crisp when you open the app, and the app tells it your store's myshopify.com address, its account e-mail address, your plan and your credit balance, so we know who is writing without asking. What you write there and any picture you send, a scene you ask us to make included, is kept by Crisp so that we can answer you, and Crisp keeps a small identifier in your browser to hold the conversation. If we answer while the app is closed, Crisp may send the answer to that e-mail address.
We do not sell data, and we do not use it for advertising.
Everything above is kept while the app is installed, with one exception: a job none of whose photographs, videos or ads went onto a product is deleted, with its files, 90 days after it was last changed. When you uninstall, the access token is deleted at once. Shopify then sends a deletion request 48 hours later, and unless the app has been installed again by then, Herolight deletes every record and every stored file that belongs to your store: jobs, generated photographs and videos, uploads, readings, the product notes, settings and the credit record. Photographs and videos that you already applied to your products stay in your store, because they are yours. One thing is kept: a one-way fingerprint (a SHA-256 hash) of your store's address, which cannot be turned back into the address. It only records that your store has already received the free signup credits, so that reinstalling does not grant them again.
Because no customer information is held, a customer data request or a customer deletion request forwarded by Shopify has nothing to return or erase.
If you join the waiting list on herolight.app, we keep the e-mail address you give, when you gave it and whether you came from the site or a link, so that we can write to you once, the day Herolight opens. It is stored with Cloudflare, which runs the site, and our team is told of the new address by an e-mail sent through Brevo. It is not used for anything else and is deleted when you ask, by writing to [email protected].
You can ask what we hold about your store, ask for a copy, or ask for it to be deleted before you uninstall, by writing to [email protected]. If you are in the European Economic Area or the United Kingdom you also have the right to complain to your data protection authority.
The terms of using the app are at app.herolight.app/terms. If this policy changes, the date at the top changes with it.