Privacy Policy

1. Scope and roles

This policy explains how MerchantDeck AI processes information when a Shopify merchant installs or uses the app, visits its public pages, or contacts support. Depending on the data and context, the operator may act as a data controller or as a processor acting on a merchant's instructions.

2. Information we process

• Store and account information, including the shop domain, Shopify identifiers, installation status, subscription entitlement, and encrypted access credentials.
• Catalog information available under the approved Shopify product scope, such as products, variants, collections, descriptions, pricing, inventory-related fields, and publication state.
• Merchant-provided goals, brand guidance, protected terms, risk preferences, audit requests, decisions, and support communications.
• Generated recommendations, quality-assurance results, workflow status, usage counters, and limited security or diagnostic logs.

The current app does not request Shopify permissions for customer or order data. Mandatory privacy webhook requests can include identifiers needed to locate and honor a valid privacy request.

3. Why we process information

We process information to:

• authenticate the store and provide the subscribed service;
• sync the approved catalog fields and run requested audits;
• generate, validate, prioritize, and display recommendations;
• operate billing, usage limits, security, support, and reliability;
• comply with Shopify requirements and applicable law.

The applicable legal bases can include performance of a contract, legitimate interests in providing and securing the service, and compliance with legal obligations. Where consent is legally required, it will be requested separately.

4. AI-assisted processing and merchant control

Selected store context and merchant instructions can be sent to Anthropic's API to generate analysis and recommendations. The public beta is read-only: recommendations do not automatically change products, themes, campaigns, or customer communications. Merchants remain responsible for reviewing and deciding whether to use any output.

5. Service providers and international transfers

We use service providers only as needed to operate MerchantDeck AI. These currently include Shopify for commerce platform services, Anthropic for AI processing, and Render for application hosting, databases, and private infrastructure. Providers can process data in other countries under their applicable terms and transfer safeguards.

• Shopify Privacy Policy
• Anthropic Privacy Policy
• Render Privacy Policy

6. Retention and deletion

We retain information for as long as needed to provide the service, maintain security and audit records, resolve disputes, and meet legal obligations. Retention depends on the record type and the merchant's installation status. Valid Shopify privacy requests are authenticated and handled through the required compliance webhooks. Shop data is deleted or anonymized after uninstall and a valid redaction request, subject to any legally required retention.

7. Security

We use measures designed to protect information, including encrypted credentials, isolated tenant access, authenticated internal requests, private orchestration services, restricted production secrets, dependency monitoring, and operational logging designed to avoid raw credentials and customer content. No security measure is completely risk-free.

8. Privacy rights

Depending on applicable law, individuals may have rights to access, correct, delete, restrict, object to, or receive a copy of personal data, and to complain to a competent data protection authority. Merchants can contact support for requests relating to their account. Customer requests submitted through a Shopify merchant are handled through Shopify's required privacy-request process.

9. Changes and contact

We may update this policy as the service or legal requirements change. The effective date above identifies the current version. Material changes will be communicated through appropriate service channels. Contact us at prjctmilly@gmail.com.