Privacy Policy

Who we are

The business behind this app and controller of account data is MerchLift, 87 Mesnes Road, Wigan, WN1 2QT, United Kingdom. For store data we process on your behalf, you remain the controller.

Data we access

• Shopify: products, collections, prices, inventory levels and locations, sales channels and order line items from the last 60 days. We calculate daily product and variant sales, units, discounts and refund totals and store only these aggregates. Collection membership and ordering change only when you save or explicitly enable collection sorting automation.
• Google Analytics 4 (read-only): aggregated page, product-list and sales metrics for the property you choose.
• Account: email addresses, sign-in details, Shopify staff identifiers, team members and invitations.

Customer data

MerchLift reads order line items to calculate product sales totals and stores only aggregated totals. We do not request or store customer names, emails, addresses or phone numbers, raw orders or order-level personal data. Google Analytics figures are aggregated.

Google user data

MerchLift's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google data is used only to show you performance figures inside the app. It is never sold or used for advertising. Service providers process it only to operate the app. Humans do not read it except where needed for security, support you request, or legal reasons.

How we store it

Each store's data is kept separately and is only visible to that store's team and authorised support staff where necessary. Shopify access tokens and Google Analytics access and refresh tokens are encrypted at rest using AES-GCM. Data is transferred over HTTPS.

Service providers and location

We use Lovable Cloud for hosting, authentication and database services. The app runs on Cloudflare's global hosting network; our primary database is in Ireland (EU). Shopify provides store data, app installation and billing. Google provides the Analytics and sign-in services you connect. These providers may process data internationally through their infrastructure and subprocessors. Where UK/EU data protection law requires it, international transfers require appropriate safeguards, such as applicable adequacy decisions or standard contractual clauses.

Retention and deletion

When you uninstall the app, we remove its stored Shopify and Google access credentials. On Shopify's shop/redact erasure request, or your verified deletion request, we delete the store's data, emails, team memberships and invitations. Accounts used only for that store are deleted too; shared accounts retain only the access needed for their other stores. Platform support accounts are not store-owned accounts. Minimal webhook delivery records, containing no email addresses or analytics data, remain to prevent duplicate processing. You can disconnect Google Analytics at any time in Settings, or at myaccount.google.com/permissions.

Your UK and EU GDPR rights

You can request access to your personal data, correction of inaccurate information, deletion, restriction of processing, portability, or object to processing where these rights apply. You can withdraw consent where we rely on it. Email hello@merchlift.ai to exercise your rights; we may verify your identity and aim to respond within one month. You can complain to the UK Information Commissioner's Office (ICO) at ico.org.uk, or your local EU supervisory authority.

Contact

Questions or deletion requests: hello@merchlift.ai.