Privacy Policy

When a merchant installs CartRules, MPC Trades acts as the data processor for the store-configuration data described below, on behalf of the merchant (the data controller for their own store). If you're a merchant's customer, your relationship for privacy purposes is with that store — contact the store directly for anything related to your own order or account.

AYour rule configuration

The rules you create (type, target products/collection/tag, quantity limits, customer-facing messages) and your app settings (protection on/off, storefront notice toggles, default messages). This is stored as Shopify metaobjects and metafields owned by the app, inside your own store's data — not in a separate CartRules database.

BEnforcement activity

Each time a rule actually blocks a discount code or caps a quantity, we log: your shop's .myshopify.com domain, which rule fired, the product ID/title involved, a short description of what happened, and a timestamp. This powers the Activity page and dashboard KPIs inside the app — it's how you see that CartRules is working.

CAuthentication data

A Shopify-issued access token and session identifier, created when you install or open the app, so CartRules can make the Shopify Admin API calls it needs (reading products/discounts, reading and writing its own metaobjects). This is never visible to us as a readable password or credential — it's an API token scoped to the permissions you approved at install.

• No customer names, emails, addresses, or phone numbers
• No order history, order totals, or payment details
• No browsing behavior, analytics, or advertising trackers on the storefront
• No access to your Shopify Payments or other financial account details

This matches the app's requested permissions: CartRules asks for read_products, read_discounts, and read/write access to its own metaobjects and their definitions — nothing that grants access to customer or order records.

• Enforcing your rules at checkout via the Shopify Function, and on the storefront via the optional theme app blocks
• Showing you the dashboard, Activity log, and rule-management screens inside the app
• Operating the billing plan you've chosen (Free, Growth, or Pro) through Shopify's own Billing API — CartRules never handles your card details directly
• Responding when you contact support
• Keeping the app secure and diagnosing problems when something breaks

Store-configuration and enforcement-activity data is used only to operate CartRules for you. It's shared with Shopify itself only as required to run the app (for example, the Admin API calls that read products and write the app's own metaobjects). We don't share it with data brokers, advertisers, or any other third party, and we don't use it to build profiles about your customers.

• Your access token and session are deleted immediately when you uninstall the app.
• Rules and settings are stored as metaobjects/metafields inside your own Shopify store — they're yours, and remain until you remove them yourself (independent of CartRules).
• Enforcement activity logs are retained only as long as needed to power the Activity page and are deleted on request (see below) or after prolonged inactivity.
• CartRules supports Shopify's mandatory GDPR webhooks — customers/data_request, customers/redact, and shop/redact — and responds to each. Because we don't hold customer personal data in the first place, a customer data request or redaction request will confirm there's nothing to return or delete on our side.

Email team@mpctrades.com with your store's .myshopify.com domain and what you're requesting. We'll confirm what we hold (per section 2) and act on the request within a reasonable time, consistent with applicable law.