Privacy policy
Last updated: 2 October 2026
MerchLight is a Shopify app that scans a merchant's store and, if the merchant chooses, their Google Merchant Center account, to find problems that affect sales. This policy explains what data MerchLight uses, why, and the choices you have.
Who we are
MerchLight is operated by Paulo Lopes, London, United Kingdom ("MerchLight", "we", "us"). We are the data controller for the information described in this policy. For any privacy question or request, email privacy@merchlight.com.
Information we collect
From your Shopify store
When you install MerchLight, Shopify gives us read-only access to:
- Store details: your store's domain and the access token Shopify issues to the app.
- Products and inventory: product titles, status, variants, SKUs, whether a product has an image, and stock levels.
- Orders (last 60 days): order number, dates, totals, payment and fulfilment status, the products in each order and whether a shipment has tracking.
- Sales figures: sales totals per product for the last 30 days, calculated from your orders, to show your best-seller and the sales at risk.
- Your choices in the app: issues you mark as ignored, and when they should be checked again.
To check your whole catalog, Shopify prepares temporary export files with your products and recent orders. MerchLight reads them once to run the checks and does not keep them.
From Google Merchant Center (optional)
If you choose to connect Google Merchant Center, we receive, with your permission through Google's sign-in:
- An access token to read your Merchant Center data, stored encrypted.
- Your Merchant Center account ID.
- Product status information: product identifiers and titles, approval status by country and destination, and the issues Google reports for your products and account.
Information you send us
If you email us, we keep the message and your email address to reply and help you.
How we use information
- To run scans, calculate your store health score and show you the problems found.
- To compare scans over time and run automatic scheduled scans.
- To keep the service secure and fix errors.
- To answer your support requests.
We do not sell your data, use it for advertising, or use it to train artificial intelligence models.
Google user data
MerchLight's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We only read Merchant Center data to show you the status of your products and account inside MerchLight. We never change your Merchant Center data, and no person at MerchLight reads it unless you ask us to for support, it is needed for security, or the law requires it.
Legal basis (UK and EU GDPR)
We process this information to provide the service you installed (performance of a contract) and, for security and service improvement, on the basis of our legitimate interests. Connecting Google Merchant Center is your choice, and you can disconnect it at any time.
Service providers
| Provider | Purpose |
|---|---|
| Shopify | App platform and access to your store data |
| Merchant Center data, only if you connect it | |
| Railway | Hosting of the MerchLight servers and database |
| Squarespace | Domain and forwarding of support emails |
| GitHub | Hosting of this website (merchlight.com) |
These providers process data on our behalf and only for these purposes. Some of them store data outside the UK and EEA, for example in the United States. Where this happens, we rely on appropriate safeguards such as standard contractual clauses.
How long we keep information
- Google connection: deleted, and the access revoked with Google, as soon as you disconnect Google or uninstall MerchLight.
- Scan history: kept while MerchLight is installed, so you can see how your store changes over time.
- Store data and scan history after uninstalling: deleted within 48 hours, when Shopify sends us the deletion request.
- Merchant Center product lists: we keep only the latest two lists and delete older ones automatically.
- Support emails: kept for as long as needed to help you, and no longer than 2 years.
Security
Data is encrypted in transit. Google access tokens are encrypted at rest. Access to production systems is limited to what is needed to run the service.
Your rights
You can ask to access, correct, delete or export your information, and you can object to or ask us to restrict its use. Email privacy@merchlight.com and we will reply within 30 days. You can also complain to the UK Information Commissioner's Office (ico.org.uk) or your local data protection authority.
If you are a customer of a store that uses MerchLight, please contact that store. We do not hold your personal details.
Cookies
This website does not use tracking or advertising cookies. Its fonts and images are served from the site itself, so visiting it doesn't send your information to other companies besides our website host. Inside Shopify, MerchLight only uses the session tokens Shopify needs to sign you in.
Children
MerchLight is a business tool and is not meant for anyone under 18.
Changes
If we change this policy, we will update the date above. For important changes, we will tell you inside the app.