Privacy policy — Store MCP Agent

Effective: 2026-10-27

Store MCP Agent (“the app”) is operated by Smart Noud EOOD, ul. Han Asparuh 23, Plovdiv, Bulgaria. Contact for privacy questions: office@rankfinity.app.

What the app does

The app lets an AI assistant that you choose (for example Claude or ChatGPT) work in your Shopify store. Every change is proposed first, shown to you as a before/after comparison, applied only after you approve it, and can be undone for 30 days.

What data we process and why

• Store connection data — your store domain, the access scopes you granted and the access token Shopify issues to the app. The token is stored encrypted and is used only to act on your store. Purpose: to provide the app.
• Store content the AI reads or changes — such as products, pages, blog posts, navigation menus and theme files, within the scopes you granted. It is passed to the AI assistant you connected, at your request, and is not used by us for any other purpose.
• Change history — what was changed, before and after values, who approved it and when, so that you can review and undo it. Purpose: safety and Undo.
• Activity log — which tool was called and when, with a hash and the size of the request (not its content), a salted hash of the network address and a client type. Purpose: security and abuse prevention.
• Technical webhook receipts — Shopify event ids, store domain, topic and date, so that repeated deliveries are not processed twice. No personal data.

We do not store your customers’ personal data. We do not sell data, do not use it for advertising and do not use it to train AI models. We do not collect conversation text between you and your AI assistant.

How long we keep it

• Access tokens and sessions: until you uninstall the app (deleted immediately on uninstall).
• Change history for Undo: 30 days; entries that need your attention: until resolved, at most 90 days.
• Activity log: 90 days.
• Webhook receipts: 14 days; the receipt of a store-erasure request: 90 days (only to prevent a replay).
• Backups: rotated on a fixed schedule; erased data disappears from backups as they rotate.

Uninstalling and deletion (GDPR)

When you uninstall the app we immediately remove its access to your store. Around 48 hours later Shopify sends a store-erasure request and we delete all remaining data about your store. We also acknowledge Shopify’s customer data request and customer erasure requests; since we hold no customer personal data, there is nothing to export or erase. You can also write to us to exercise your rights of access, correction, erasure, restriction, portability and objection, or to complain to your data protection authority.

Who is involved

• Shopify provides the platform, authentication and the store data, and acts as a processor of that data for the merchant.
• The AI assistant you connect is chosen and authorised by you. It receives the store data you let it read and is a separate controller under its own terms and privacy policy; we do not control what it does with the data.
• Hosting — the app runs on a server in Germany. Data is not transferred elsewhere by us.

Security

Tokens are encrypted at rest, traffic uses HTTPS, every store’s data is isolated from others, and the app cannot make a change without your approval.

Changes to this policy

If this policy changes materially we will update the date above and, where required, tell you in the app.