Legal & trust
Privacy Policy
This policy explains how Pcnaid Inc. processes information when a merchant installs or uses Auto Merch & Content Toolkit (the “Service”). The Service is an embedded Shopify application for collection merchandising, hierarchy management, and structured storefront content.
Information we process
Shop and account context: the shop domain, Shopify installation identifiers, granted access scopes, subscription status, and the identity context Shopify supplies for authentication.
Commerce configuration: collections, products, pages, metafields, metaobjects, merchandising rules, hierarchy relationships, content blocks, and job results that the merchant asks the Service to read or manage.
Operational information: request metadata, application errors, security events, feature usage, and performance measurements needed to operate and improve the Service.
Integration information: configuration a merchant supplies for optional services, such as analytics settings. Secrets and access tokens are used only to provide the requested integration and are not displayed publicly.
How we use information
We use information to authenticate the shop, provide requested merchandising and content operations, process subscription status, maintain job history, prevent abuse, diagnose failures, and support merchants.
We do not sell merchant or customer personal information. We do not use Shopify customer data for independent advertising. Access is limited to the purposes described here and the instructions a merchant gives through the Service.
Shopify data and permissions
The Service requests Shopify permissions needed for its active features. Shopify shows those permissions during installation or reauthorization. A merchant can revoke access by uninstalling the app.
Where a feature writes to Shopify, the Service performs the operation for the authenticated shop and records enough result information to show whether it succeeded. Shopify remains the system of record for products, collections, and storefront resources.
Service providers and transfers
We use infrastructure, database, queueing, error monitoring, analytics, and communication providers to run the Service. They may process limited information on our behalf under contractual and security obligations.
Information may be processed in countries other than the merchant’s own. Where required, we use appropriate contractual or legal safeguards for cross-border processing.
Retention and deletion
We retain active-shop configuration and operational records for as long as needed to provide the Service. Retention periods may differ for security logs, billing evidence, backups, and records required by law.
Shopify’s mandatory privacy webhooks are used to handle data-access and deletion requests. After uninstall or a valid deletion request, we delete or de-identify app data unless a limited record must be retained for legal, fraud-prevention, or accounting purposes.
Security
We use access controls, encrypted transport, tenant-scoped data access, signed Shopify requests, and operational monitoring intended to protect information. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.
Your choices and rights
Depending on location, merchants and individuals may have rights to access, correct, delete, restrict, or object to certain processing. Requests can be sent to privacy@pcnaid.com. We may need to verify the requester and the relevant shop before acting.
Merchants can remove the Service through Shopify Admin. Optional analytics or integration configuration can be removed from the corresponding settings surface.
Contact and changes
Questions or privacy requests may be sent to privacy@pcnaid.com. We may update this policy as the Service or legal requirements change; the date above identifies the current version.