Privacy Policy

Last updated: 1 May 2026

CopyThat by MVIDEV ("the App", "we", "us") is a Shopify app that copies storefront settings — menus, collections, pages, blogs, articles, redirects, metafield and metaobject definitions — from one Shopify store to another, at the explicit request of the merchant who installs and operates the App.

This policy explains what data we process, why, and for how long.

Information we process

• Shop credentials. When you install the App, Shopify issues us an offline access token and shop domain so the App can read and write the resources you authorise.
• Pairing metadata. Short-lived pairing codes, source/destination shop pairings, and an audit log of pairing events.
• Copy job records. The list of resources you choose to copy, their handles and Shopify IDs, the success/failure status of each item, and any error messages returned by Shopify.
• Resource snapshots in transit. While a copy job runs, we read a resource from the source store, send it to the destination store, and persist a small JSON snapshot of the request only for retry/debugging. Snapshots are deleted with the job record.

We do not collect, store, or process customer personal information (names, emails, addresses, orders, payment details). The App only handles storefront configuration data.

How long we keep it

• Pairing codes expire after 24 hours or first use.
• Copy job records and audit logs are retained while the App remains installed so you can review history.
• When you uninstall the App, Shopify sends us an app/uninstalled webhook and we revoke all pairings and delete your offline session token immediately.
• 48 hours after uninstall, Shopify sends us a shop/redact webhook, at which point we delete every record tied to your shop across our database.

GDPR compliance webhooks

We honour Shopify's mandatory compliance webhooks:

• customers/data_request — we hold no per-customer data, so we have nothing to return.
• customers/redact — we hold no per-customer data, so there is nothing to delete.
• shop/redact — we delete all data associated with your shop, as described above.

Subprocessors

The App is hosted on third-party infrastructure:

• Vercel (USA) — application hosting and serverless execution.
• Neon (EU) — Postgres database for storing the data described above.
• Shopify — source and destination of every resource we copy, on your authorisation.

Sharing and selling

We do not sell, rent, or share your data with any third party for marketing, analytics, or advertising purposes.

Your rights

You can uninstall the App at any time from your Shopify admin to revoke access. You may also email us to request a copy or deletion of any data we hold for your shop.

Contact

Questions about this policy or about your data: mike@mvidev.com.

CopyThat by MVIDEV is operated by MVIDEV.