starship / search / also-bought-1

Audit report

Also Bought Cross Sell

Broad accessReach : broadSensitive Access

by Arctic Grey, Ltd. · Sales and conversion optimization · Shopify App Store

Sales and conversion optimization

Risk level

Broad access

Executive summary

Also Bought just like you see on Amazon.

Key insights

◆Publisher Arctic Grey Ltd is a NYC-based Shopify agency; arcticgrey.com is itself a Shopify-hosted storefront with HSTS, X-Frame-Options DENY, and a basic CSP, reasonable hygiene.
◆App self-describes as LLM + collaborative filtering, but the privacy policy is the agency's generic merchant policy with zero AI/LLM disclosure, a notable gap.
◆Scopes requested span customer PII, store content (write), and order history, moderate sensitivity, no high-risk write_orders/write_customers/write_payment_terms surfaced.
◆No public CVEs, breaches, or incidents found for Arctic Grey or the Also Bought app.

Top findings

No critical or high findings detected.

Synthesis

Analysis summary

Also Bought just like you see on Amazon.

Key insights

◆Publisher Arctic Grey Ltd is a NYC-based Shopify agency; arcticgrey.com is itself a Shopify-hosted storefront with HSTS, X-Frame-Options DENY, and a basic CSP, reasonable hygiene.
◆App self-describes as LLM + collaborative filtering, but the privacy policy is the agency's generic merchant policy with zero AI/LLM disclosure, a notable gap.
◆Scopes requested span customer PII, store content (write), and order history, moderate sensitivity, no high-risk write_orders/write_customers/write_payment_terms surfaced.
◆No public CVEs, breaches, or incidents found for Arctic Grey or the Also Bought app.
◆Single 5-star review since 2018 indicates very low install base; reputational signal is weak in both directions.

Detections

Findings (6)

Risks detected through static, network, and policy analysis.

Write access to online store content

Medium

App requests permission to edit online store content (theme/storefront) to embed cross-sell widgets across product, cart, checkout, and thank-you pages. Write scope on the storefront expands blast radius if the app's infrastructure is compromised.

Evidence

https://apps.shopify.com/also-bought-1

Customer PII collected (name, email, IP, geolocation) shared with LLM provider not disclosed

Medium

App description explicitly states it uses LLM-based recommendations and collects customer names, emails, IP addresses and geolocation. The Arctic Grey privacy policy does NOT mention any AI/LLM processing, providers (OpenAI/Anthropic/etc.), data sharing scope, or LLM-specific retention. This is a transparency gap given the AI claim.

Evidence

https://arcticgrey.com/policies/privacy-policy

No compliance certifications disclosed

Low

Privacy policy references GDPR/CCPA frameworks but does not claim SOC2, ISO 27001, PCI-DSS, or HIPAA. Acceptable for a small-scope app but worth noting for merchants in regulated verticals.

Evidence

https://arcticgrey.com/policies/privacy-policy

Indefinite data retention policy

Low

Privacy policy states personal information is retained 'for our records unless and until you ask us to erase this information' with no specified maximum retention window, which is in tension with GDPR data minimization principles.

Evidence

https://arcticgrey.com/policies/privacy-policy

Cross-border data transfer (EU to US/Canada)

Low

Personal data is processed in Ireland then transferred to the US and Canada for storage. Policy does not explicitly cite SCCs or an adequacy mechanism for EU-US/Canada transfers.

Evidence

https://arcticgrey.com/policies/privacy-policy

Very low review count limits social signal

Info

Listed since Feb 2018 with only 1 review (5.0 stars). Long-tenured listing with low adoption suggests limited real-world security scrutiny by merchants.

Evidence

https://apps.shopify.com/also-bought-1

This section is available to signed-in users

Get started

Permissions

OAuth scopes requested

These are the access permissions this app asks for during install. The sensitivity column reflects PII exposure and merchant impact.

Scope	Sensitivity	Why we flag it
`read_customers`	High	Customer names and emails enable behavior-based recommendations but are PII subject to GDPR/CCPA.
`read_orders`	High	Order history feeds the collaborative filtering model; exposes purchase patterns and order values.
`read_products`	Low	Product catalog data is largely public; required for recommendation surfaces.
`write_themes / write_online_store_content`	High	Storefront write access required to inject widgets across PDP/cart/checkout/thank-you, high blast radius if compromised.
`read_analytics / read_visitor_data`	Medium	IP address and geolocation collection for behavioral signals, PII under GDPR.

read_customers

High

Customer names and emails enable behavior-based recommendations but are PII subject to GDPR/CCPA.

read_orders

High

Order history feeds the collaborative filtering model; exposes purchase patterns and order values.

read_products

Low

Product catalog data is largely public; required for recommendation surfaces.

write_themes / write_online_store_content

High

Storefront write access required to inject widgets across PDP/cart/checkout/thank-you, high blast radius if compromised.

read_analytics / read_visitor_data

Medium

IP address and geolocation collection for behavioral signals, PII under GDPR.

Where data goes

Data flow

Destinations and sub-processors detected from network analysis and policy review.

arcticgrey.com / app backend

US · Recommendation engine backend (LLM + collaborative filtering)

Declared

shopify.com

US/EU · Source merchant + order data

Declared

google-analytics.com

US · Publisher-site analytics (disclosed in privacy policy)

Declared

facebook.com / google ads / bing

US · Advertising pixels on publisher site (not necessarily in-app)

Declared

Sub-processors

ShopifyGoogle AnalyticsGoogle AdsFacebook AdsBing AdsShopify Audiences

Data residency: US

This section is available to signed-in users

Get started

This section is available to signed-in users

Get started

Attack surface

Network surface

Primary domain: arcticgrey.com
TLS grade: A
HSTS: Enabled
CSP: Enabled

Publisher site is Shopify-hosted with HSTS (max-age ~7.9M), X-Frame-Options: DENY, X-Content-Type-Options: nosniff, X-XSS-Protection, and a minimal CSP (block-all-mixed-content; frame-ancestors 'none'; upgrade-insecure-requests). App backend was not separately measured.

Posture

Compliance & certifications

GDPR webhooks Fail

SOC 2 Type II Fail

ISO 27001 Fail

PCI DSS Fail

Policy references GDPR/CCPA rights but no audited certifications are claimed. Retention is open-ended.

Track record

Publisher reputation

Publisher: Arctic Grey, Ltd.
Verified Shopify Partner: No
Years active: 8
Other apps: 0

Past incidents

No past incidents on record.

LLM exposure

AI / LLM usage

LLM providers

Data shared with providers

Customer signals (orders, products viewed, basic identifiers) fed into LLM-augmented collaborative filtering for recommendations; specific LLM provider and data-sharing terms not disclosed.

Retention policy

Not specified for AI/LLM pipeline; general policy retains data indefinitely until user erasure request.