MCPify

Data processing agreement

Last updated 2026-10-26

This data processing agreement ("DPA") under Art. 28 GDPR is part of the terms of service between the merchant who installs the MCPify app ("controller") and MCPify, [LEGAL_ADDRESS not set] ("processor", "we"). It applies as soon as the merchant uses MCPify with personal data from their store.

1. Subject, duration and purpose

We process personal data on the controller's behalf to provide MCPify: passing data between the controller's Shopify store and the AI clients the controller connects, enforcing the controller's connection rules and keeping the audit log. Processing lasts as long as the app is installed, followed by the deletion described in section 9.

2. Type of data and data subjects

  • Customers of the controller's store: customer IDs and, only if the controller switches customer data on for a connection, names, email addresses, phone numbers, addresses and order details, passed through to the AI client.
  • Staff members of the controller who use the app or connect an AI client: name, email address, Shopify user ID.

Customer names, email addresses, phone numbers and addresses are not stored: they are removed before request arguments are written to the audit log. Responses kept for safe retries are deleted after 24 hours.

3. Instructions

We process personal data only on the controller's documented instructions. The connection settings in MCPify (permissions, limits, customer data switch, API operations) and the requests of the AI clients the controller connects are such instructions. We inform the controller if we believe an instruction violates data protection law.

4. Confidentiality

Everyone we authorise to process the data is bound to confidentiality.

5. Security

We take the technical and organisational measures described on our security page, which forms part of this DPA. We may adapt them to the state of the art as long as the level of protection does not decrease.

6. Sub-processors

The controller approves the following sub-processors:

  • Render Services, Inc. (region Frankfurt, EU): hosting of the app and its database, region Frankfurt (EU).

We inform the controller of intended changes by email or in the app at least 30 days in advance; the controller may object for important data protection reasons. Shopify and the AI client providers the controller chooses are not our sub-processors: the controller has its own agreements with them.

7. Support for the controller

We help the controller answer requests from data subjects and meet its obligations under Art. 32–36 GDPR, as far as our part of the processing allows. Shopify's customer data requests and redaction requests are handled automatically.

8. Personal data breaches

We notify the controller without undue delay, and at the latest within 48 hours after becoming aware of a breach affecting its data, with the information available at that time, so that the controller can meet its own 72-hour deadline. The procedure is described on the security page.

9. Deletion

Audit log entries are deleted after 7 days (Free), 30 days (Starter) or 365 days (Pro and Agency). When the app is uninstalled, AI client access ends immediately, and all data of the store is deleted when Shopify sends the shop redaction request, 48 hours after uninstalling. Database backups are overwritten within 3 days.

10. Audits

We provide the information needed to demonstrate compliance with Art. 28 GDPR on request and allow audits by the controller or an auditor it appoints, with reasonable notice, during business hours and without disclosing other customers' data.

11. Final provisions

Liability follows the terms of service. If this DPA conflicts with the terms of service, this DPA prevails for the processing of personal data. Questions: legal@getmcpify.app.