Privacy Policy

Last updated: March 29, 2026

ShopMCP ("we", "our", or "us") operates the ShopMCP Shopify app and the website at shopmcp.app. This Privacy Policy explains what data we collect, how we use it, and your rights.

1. Data We Collect

When you install ShopMCP, we collect and store the following data:

• Shop data: Your shop domain, access token (encrypted), and Shopify session information required to authenticate API requests.
• Connection data: Names, permissions, and hashed API keys for MCP connections you create.
• Audit logs: Records of MCP tool calls made through your connections, including the tool name, timestamp, and whether the request was permitted.
• Theme backups: File content of theme assets as they existed before an AI-assisted edit, stored to enable restore functionality.

2. How We Use Your Data

• To authenticate and process MCP requests from connected AI tools on your behalf.
• To enforce the permissions you configure for each connection.
• To display audit logs and theme backups in the app interface.
• To comply with legal obligations, including Shopify's GDPR webhook requirements.

We do not sell, rent, or share your data with third parties for marketing purposes.

3. Data Retention

• Audit log entries are retained for as long as the connection exists, up to a maximum of 500 entries per connection.
• Theme backups are retained until you manually delete them.
• All shop data is deleted within 48 hours of app uninstallation, in accordance with Shopify's shop/redact webhook.

4. Third-Party Services

ShopMCP is hosted on Fly.io (fly.io). Your data is stored on servers within Fly.io's infrastructure. Please refer to Fly.io's privacy policy for details on their data handling practices.

We use Shopify's API to access your store data. Your use of Shopify is subject to Shopify's own privacy policy.

5. Security

API keys are stored as SHA-256 hashes — we never store the full key in plaintext. Shopify access tokens are stored encrypted in our database. All connections are made over HTTPS.

6. Your Rights (GDPR)

If you are located in the European Economic Area, you have the right to:

• Access the personal data we hold about you.
• Request correction or deletion of your data.
• Object to or restrict our processing of your data.

To exercise these rights, contact us at the email below.

7. Customer Data

ShopMCP may access customer data (names, email addresses, order information) from your Shopify store when your connected AI tool requests it via an MCP tool call. This access is governed by the permissions you configure. We do not use customer data for any purpose other than fulfilling the requested API operation.

If a customer requests access to or deletion of their data, please contact us at the email below and we will provide or delete any stored data within 30 days.

8. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by updating the date at the top of this page.

9. Contact

If you have questions about this Privacy Policy or your data, contact us at:
support@shopmcp.app