Privacy Policy
# Playecom Merchant Optimizer Privacy Policy
**Last updated:** September 3, 2026
## 1. Who we are
Playecom Merchant Optimizer is provided by Playecom Experience Consultoria LTDA, registered under Brazilian CNPJ number 48.505.985/0001-33, hereinafter referred to as "Playecom", "we", or "our".
Contact for privacy and support: apps@playecom.com.br. This address must be active and monitored before the app is published.
## 2. Scope of this policy
This Privacy Policy explains how we collect, use, store, share, and delete information related to the use of the app by Shopify merchants and their authorized users.
This policy does not replace the merchant's store privacy policy nor the policies of Shopify or Google. Each party processes data under their own legal responsibilities.
## 3. Information we collect
Store data received from Shopify: myshopify.com domain, store identifiers, store name, language, currency, time zone, plan, and administrative contact information made available through authorized scopes.
Catalog data: products, variants, titles, descriptions, handles, URLs, images, vendor or brand, product type and category, SKU, barcode or GTIN, MPN when available, variant options, weight, prices, compare-at price, inventory, availability, locations, and metafields strictly necessary for the feed.
App settings: pricing and promotion rules, percentage reported for PIX, installments, mappings, fallbacks, field labels, synchronization status, feed URL token, and operational preferences.
Technical and security data: IP address, user agent, date and time, request identifiers, authentication events, error logs, performance, and audit logs. Access tokens and secrets are stored in a protected manner.
Billing data: We receive from Shopify only the plan status, contract, and events necessary to enable features. We do not receive or store the merchant's credit card data or payment credentials.
## 4. Data we do not collect in the current version
The app does not request data on customers, orders, checkouts, transactions, or payment methods from the store and does not access the names, addresses, phone numbers, or emails of shoppers.
The app does not inject tracking scripts into the storefront and does not track consumer browsing. Should this behavior change, this policy and the app scopes will be updated before the feature is made available.
## 5. How we use information
To authenticate installation and maintain the app session.
To import and synchronize the catalog authorized by the merchant.
To apply rules configured by the merchant and to generate, store, and serve the XML feed.
To display diagnostics, warnings, and the app's operational history.
To process subscription status and control access to contracted features.
To prevent fraud, abuse, security failures, and downtime.
To handle support requests and comply with legal obligations and Shopify requirements.
## 6. Legal bases
When the General Data Protection Law (LGPD) is applicable, we process data to execute the app contract, comply with legal or regulatory obligations, and protect legitimate interests related to security, fraud prevention, support, and operational improvement.
Consent will only be used when required for a specific optional purpose, such as marketing communications. Withdrawing consent does not affect processing carried out under another valid legal basis.
## 7. Sharing and operators
We may share information only with providers necessary to operate the app, such as Shopify, cloud hosting, database, storage, CDN, observability, email delivery, and support services. These providers must process data according to a contract and defined purpose.
When the merchant registers or shares the feed URL with Google Merchant Center, the product data present in the feed will be accessed by Google in accordance with Google's terms and policies.
We do not sell personal data and we do not use app data for third-party behavioral advertising.
## 8. Public feed URL
The feed URL uses an opaque token to reduce unauthorized access. The feed contains product information intended for publication, such as title, image, price, availability, and product URL.
The merchant is responsible for sharing this URL only with authorized platforms. The token can be rotated in the app; rotation invalidates the previous URL.
## 9. International transfers
Infrastructure providers may process data outside of Brazil. In such cases, we adopt appropriate contractual and technical measures and select providers with security and data protection commitments compatible with applicable legislation.
## 10. Retention and deletion
We keep data as long as the subscription is active and for the period necessary to provide the service, resolve incidents, comply with legal obligations, or exercise rights.
After uninstallation, store access is revoked, and the feed URL must be deactivated promptly. When Shopify sends the shop/redact webhook, store data will be deleted or anonymized within 30 days, except for legal retention obligations.
Technical backups may remain for up to 90 days before being overwritten. Tax, billing, fraud, or security records may be retained for the period required by law, with restricted access.
## 11. Security
We adopt HTTPS, HMAC verification on webhooks, access control, per-store isolation, encryption or equivalent protection for credentials, restricted logs, backups, and security reviews.
No environment is completely immune to incidents. In the event of a significant incident, we will adopt containment and notification measures in accordance with applicable legislation and contracts.
## 12. Data subject rights
The data subject may request confirmation of processing, access, correction, information about sharing, portability where applicable, anonymization, blocking, deletion, or objection by contacting us via email at apps@playecom.com.br.
We may request additional information to validate identity and authority. When a request is related to data processed on behalf of a store, we may direct the request to the merchant controller.
## 13. Cookies and similar technologies
The app may use cookies or storage strictly necessary for authentication, security, and session functionality. The embedded app must work with session tokens and does not rely on third-party cookies.
We do not use advertising cookies in the app. Any future use will be communicated and, when necessary, submitted for consent.
## 14. Minors
The app is intended for companies and professionals authorized to manage stores. It is not directed at children or adolescents and does not intentionally collect data from this audience.
## 15. Changes to this policy
We may update this policy to reflect legal, technical, or functional changes. The date of the last update will be changed, and when the change is material, the merchant will be informed via the app or email.
## 16. Contact
Playecom Experience Consultoria LTDA - CNPJ 48.505.985/0001-33.
Email: apps@playecom.com.br.