Privacy notice

This Privacy notice explains how Catalog Master (“we”) processes personal and store data when providing the embedded Shopify application available at catalogmasterai.com.

1. Controller

The controller for data we process as the App provider is the Catalog Master operator. Contact: soporte@catalogmasterai.com.

For your end customers (store buyers), you are the controller and we act as a processor only to the extent such data enters the mirror (e.g. if a metafield or description contains it). Avoid syncing unnecessary end-customer data.

2. Data we process

• Shopify store data: domain, shop identifiers, country, currency, timezone, display name, install status.
• Catalog: products, variants, images, collections, identifiers (SKU/GTIN), attributes, SEO/description text and metadata needed for health, master, and enrichment.
• Authentication: Shopify access tokens encrypted at rest; not exposed in the UI or logs.
• App usage: audit events, jobs, AI consents, credit usage, billing events (no card data).
• AI (if enabled and consented): product fragments sent to the configured LLM/vision provider to generate suggestions.

We do not request or store full card numbers, CVV, or bank details: billing is handled by Shopify.

3. Purposes and bases

• Provide and improve the Service (contract / App install).
• Sync and audit catalog changes at your request.
• Billing and plan limits (legitimate interest / contract).
• Optional AI after consent when applicable.
• Security, abuse prevention, and legal compliance.
• Internal aggregated analytics (e.g. country or product_type mix) without identifying end buyers.

4. Processors and transfers

• Shopify: install platform, Admin API, and Billing.
• Hosting / database: infrastructure running the App and MySQL (operational mirror).
• LLM providers (e.g. OpenAI) only if you enable AI and consent/config is active.

International transfers may occur depending on provider location. We use reasonable contractual and technical measures.

5. Retention and Shopify compliance webhooks

We retain store and catalog data while the App is installed and for additional time needed for audit, disputes, security, or legal obligations.

We respond to Shopify mandatory webhooks at /api/webhooks/shopify:

• customers/data_request: we do not keep end-buyer profiles or orders; there is no customer PII export to generate. Contact: soporte@catalogmasterai.com.
• customers/redact: no customer tables to erase; the request is logged and completed with no further action.
• shop/redact: we delete the store’s data in our system (catalog mirror, local billing, jobs, and related records via cascade).

6. Security

We apply token encryption at rest, shop isolation (shop_id), input validation, and ops backoffice access via shared secret. No system is 100% secure; report incidents to soporte@catalogmasterai.com.

7. Your rights

Depending on your jurisdiction (e.g. GDPR/LFPDPPP), you may request access, rectification, erasure, objection, or portability of personal data we process as controller. For end-buyer data, contact the merchant (your store) as controller.

8. Minors

The Service is for businesses; it is not intended for anyone under 16.

9. Cookies

The landing and legal pages use minimal technical cookies. The ops backoffice may use an httpOnly session cookie. The embedded App runs in Shopify Admin / session tokens per Shopify’s model. We also store a language preference cookie (cm_locale).

10. Changes

We may update this notice; the “Last updated” date shows the current version. Material changes will be communicated when reasonable (e.g. on the site or in the App).

11. Contact

Support / privacy / legal: soporte@catalogmasterai.com

Spanish version: /legal/privacidad