Privacy policy
Last updated 2026-10-26
1. Who is responsible
MCPify
[LEGAL_ADDRESS not set]
Email: support@getmcpify.app
This policy explains how MCPify ("we") processes personal data when merchants install and use the MCPify Shopify app and when anyone visits this website.
2. Our role
For data about the merchant's account (store, staff members using the app, billing status) we are the controller. For data from the merchant's store that passes through MCPify on the merchant's instruction, such as product, order or customer data, the merchant is the controller and we process it on their behalf as a processor (Art. 28 GDPR). A data processing agreement is available on request.
3. What we process and why
| Data | Purpose | Legal basis |
|---|---|---|
| Store domain, Shopify access tokens (offline token of the app; for staff sign-ins the staff member's online token, encrypted) | Provide the app and call the Shopify API on the merchant's behalf | Contract (Art. 6(1)(b) GDPR) |
| Staff member's Shopify user ID, name, email and permission scopes when they use the app or approve an AI client | Roles (owner, staff, team), showing who approved which AI client, enforcing their Shopify permissions | Contract; legitimate interest in secure access control (Art. 6(1)(f)) |
| Connection settings, hashed API keys, OAuth client registrations, consent records and token hashes | Authenticate AI clients and enforce the merchant's rules | Contract |
| Audit log: time, connection, AI client name, staff member, requested operation, result, reason and a shortened copy of the request arguments (which can contain IDs or search terms) | Let the merchant see and verify every AI request; security and abuse prevention | Contract; legitimate interest in security |
| Monthly request counters and plan status | Plan limits and billing through Shopify | Contract |
| Copies of theme files before an AI client changes or deletes them | Let the merchant restore earlier versions | Contract |
| Issue reports an AI client sends after the user approved them (with store domain and connection ID; tokens, emails and phone numbers are filtered out) | Support and fixing bugs | Contract; legitimate interest in improving the service |
| Server logs (IP address, time, requested URL) and a cookie remembering the store domain on the sign-in page | Operating and securing the service, rate limiting | Legitimate interest (Art. 6(1)(f)); the cookie is strictly necessary |
Store data the AI client requests (for example products, orders or customers) is passed through to the AI client and not stored by us, except for what appears in the shortened request arguments of the audit log. When the merchant switches customer data off for a connection, names, email addresses, phone numbers and addresses are removed before the response leaves MCPify.
4. AI clients
The merchant chooses which AI client (for example Claude, Cursor or Codex) connects to their store. Data the AI client receives is processed by its provider under the merchant's agreement with that provider. We do not send store data to AI providers on our own and do not use store data to train AI models.
5. Recipients
- Hosting: Render Services, Inc. (region Frankfurt, EU). Data is stored in the EU.
- Shopify International Ltd. and Shopify Inc., to provide the app, billing and authentication.
Where a provider is located outside the EU/EEA or may access data from there, transfers rely on the EU-U.S. Data Privacy Framework or the EU Standard Contractual Clauses.
6. How long we keep data
- Audit log: 7 days (Free), 30 days (Starter), 365 days (Pro and Agency).
- Issue reports: 30 days.
- Stored responses for safe retries: 24 hours.
- OAuth consents: up to 90 days (staff: up to 7 days), or until revoked.
- When the app is uninstalled, all AI client access ends immediately. All data of the store is deleted when Shopify sends the shop redaction request, 48 hours after uninstalling.
7. Your rights
You have the right to access, rectification, erasure, restriction of processing, data portability and to object to processing based on legitimate interests (Art. 15–21 GDPR). Contact us at support@getmcpify.app. You may also lodge a complaint with a data protection supervisory authority. Requests from a store's customers are handled through Shopify's customer data requests, which MCPify answers automatically.
8. Security
Connections use HTTPS. API keys, OAuth tokens and codes are stored only as hashes; staff access tokens are encrypted. Every AI request is checked against the merchant's rules before it reaches Shopify.
9. Changes
We update this policy when the service changes. The date at the top shows the latest version.