Privacy Policy

Account information

When you create or use a Mobile Connect account, we may collect your name, email address, password, store name, and Shopify store domain (*.myshopify.com).

Passwords are stored using secure hashing mechanisms and are not stored in plain text.

Shopify store data

When you connect your Shopify store, Mobile Connectaccesses information through Shopify’s official APIs so that we can build and operate your mobile application. Depending on the features you enable, this may include:

• Product catalog and product information
• Collections and related store information
• Cart information
• Customer account information required for customer authentication and account functionality
• Checkout-related information required for supported checkout functionality
• Abandoned checkout information when cart-recovery functionality is enabled
• Other Shopify store information required to provide features that you explicitly enable

Shopify remains the source of the store and product information used by your mobile application.

Google account and Google API data

Mobile Connect uses Google OAuth to allow Shopify merchants to securely authorize specific Google services from the Mobile Connect vendor interface. Google authentication and authorization are used primarily for the following purposes:

1. Firebase integration:to access the Google/Firebase services required to create or configure a Firebase project associated with the merchant’s mobile application.
2. Google Play Console integration:to connect the merchant’s Google Play Console account with Mobile Connect so that the merchant can publish the Android App Bundle (AAB) generated for their mobile application directly through the Mobile Connect vendor interface.

Depending on the Google permissions you authorize, Google may provide Mobile Connect with information associated with your Google account and the specific Google services or resources you authorize. This may include your Google account identity information, account identifier, authorization information, and information required to access the Firebase or Google Play services that you have explicitly authorized.

Mobile Connect only requests and uses the Google permissions necessary to provide these integrations.

Mobile Connect does not access the contents of your personal Gmail, Google Drive, Google Photos, contacts, or other Google services unless a specific permission is requested, explicitly authorized by you, and required for a feature provided by Mobile Connect.

Contact form data

If you use the contact form on our website, we may collect your name, email address, store information if provided, and the contents of your message.

We use the information we collect to:

• Build, host, operate, and maintain the mobile application created for your Shopify store.
• Synchronize your mobile application with your live Shopify store.
• Display your Shopify products, collections, and other supported store information in your mobile application.
• Support customer account, cart, checkout, and other enabled Shopify functionality.
• Send cart-recovery push notifications where this feature has been enabled.
• Provide Firebase integration and configuration required for your mobile application.
• Connect your Google Play Console account to Mobile Connect when you authorize this integration.
• Upload or submit the generated Android App Bundle (AAB) to Google Play Console when you initiate publishing through the Mobile Connect vendor interface.
• Authenticate and authorize access to services that you explicitly connect to Mobile Connect.
• Respond to support and contact requests.
• Maintain the security of Mobile Connect and maintain appropriate operational and audit records.
• Diagnose, troubleshoot, and improve the functionality of the Mobile Connect platform.

Use of Google user data

Google user data accessed through Google OAuth is used only to provide the Google/Firebase and Google Play functionality that you explicitly request and authorize. For example, Google authorization may be used to:

• Determine which Google account has authorized the connection.
• Obtain the authorization required to access the Firebase services associated with your account.
• Create or configure Firebase resources required for your mobile application.
• Establish the authorized connection between Mobile Connect and your Google Play Console.
• Perform Google Play publishing actions that you initiate through the Mobile Connect vendor interface.
• Maintain the authorization required for these integrations.

We do not use Google user data for targeted advertising, personalized advertising, retargeting, selling to data brokers, providing information to data resellers, determining creditworthiness, lending purposes, or other unrelated purposes.

We do not use Google user data to develop, improve, or train generalized or non-personalized artificial intelligence or machine-learning models.

Mobile Connectuses Google’s OAuth authorization mechanism so that you remain in control of which Google services Mobile Connect can access. When you choose to connect a Google service:

1. You are redirected to Google’s authorization interface.
2. Google displays the permissions requested by Mobile Connect.
3. You decide whether to grant those permissions.
4. Mobile Connect receives the authorization information necessary to perform the services you have authorized.
5. Mobile Connect uses that authorization only for the functionality described in this Privacy Policy.

You may revoke Mobile Connect’s access to your Google account through the applicable Google account or service settings. Revoking authorization may prevent Mobile Connect from performing Firebase or Google Play actions that require that authorization.

We use reasonable technical and organizational safeguards designed to protect your information against unauthorized access, disclosure, alteration, or destruction. Our security measures may include:

• Encryption of sensitive credentials and access tokens at rest.
• Secure transmission of information using encrypted connections.
• Secure server-side processing of Shopify and Google authorization credentials.
• Restricting access to production systems and data to authorized personnel.
• Authentication and authorization controls for administrative access.
• Logging and monitoring of relevant system activity for security and operational purposes.

Shopify access tokens are encrypted at rest and decrypted only on our server when a request to Shopify is required. They are not provided to the mobile application or exposed to your customers.

Google OAuth credentials and authorization information are handled through our server-side systems and are not intentionally exposed to the end users of the mobile application.

We do not sell your personal information or Google user data.

We may share or transfer information only where necessary to provide, operate, secure, or support Mobile Connect and the services you have requested. Depending on the features you use, this may include:

• Shopify— as the source of your Shopify store data and for Shopify platform functionality.
• Google/Firebase — when you authorize Mobile Connect to create or configure Firebase resources for your mobile application.
• Google Play Console / Google Play services— when you authorize Mobile Connect to connect to your Play Console account and publish your Android application.
• Push-notification providers— when cart-recovery or other supported push-notification functionality is enabled.
• Transactional email providers— for account-related, transactional, or support communications.
• Hosting and database providers— for hosting and operating Mobile Connect.
• Other service providers— where reasonably necessary to provide, secure, maintain, or support functionality that you have requested.

We do not transfer or disclose Google user data to third parties for advertising, selling data, data brokerage, credit assessment, lending, or other purposes unrelated to providing or improving Mobile Connect functionality.

Where service providers process information on our behalf, they are expected to process that information only for the services they provide to Mobile Connect and in accordance with applicable contractual and security requirements.

We retain account, Shopify, and other service data for as long as necessary to provide Mobile Connect and the features you have enabled, maintain your account, comply with legal obligations, resolve disputes, maintain security records, and enforce our agreements.

For Google user data, we retain only the information and authorization credentials necessary to provide the Google services you have authorized.

When you disconnect a Google integration, we stop using the associated Google authorization for new operations, subject to any actions already initiated by you and any information that we are legally required to retain.

When you disconnect your Shopify store or close your Mobile Connect account, we stop accessing new Shopify data and will delete or anonymize stored information within a reasonable period, except where retention is required or permitted for legal, accounting, security, fraud-prevention, dispute-resolution, or other legitimate operational purposes.

You may request deletion of your Mobile Connect account and associated personal information.

You may also request deletion of information associated with your Google integrations by contacting us through the contact information provided below.

When a deletion request is received, we will delete or anonymize applicable information within a reasonable period, subject to information that we are required or permitted to retain by law or that is reasonably necessary for security, fraud prevention, dispute resolution, or other legitimate business purposes.

Disconnecting a Google account or integration may also be used to stop Mobile Connect from accessing the relevant Google services. Information that is no longer required for the provision of the service will be deleted or anonymized in accordance with our retention practices.

Depending on applicable law, you may request to:

• Access the personal information we hold about you.
• Correct inaccurate or incomplete information.
• Delete your account and associated personal information.
• Disconnect an authorized Google integration.
• Request information about how your data is processed.
• Request deletion of information associated with your Google integration.

You can make a request through the contact form on the Mobile Connect website.

Mobile Connect is a business tool intended for Shopify merchants and business users. It is not directed at children, and we do not knowingly collect personal information from children.

Mobile Connect relies on third-party platforms and services, including Shopify, Google/Firebase, Google Play services, hosting providers, database providers, notification providers, and email providers.

Your use of those third-party services may also be subject to their respective terms and privacy policies.

Mobile Connect does not control the privacy practices of third-party services, and you should review their applicable policies when using those services.

We may update this Privacy Policy from time to time to reflect changes to Mobile Connect, our services, or our data-processing practices.

If we make material changes, we will update the “Last updated” date at the top of this page and, where appropriate, provide additional notice.

You should periodically review this Privacy Policy to remain informed about how we handle your information.

If you have questions about this Privacy Policy, your personal information, Google authorization, Shopify data, or a data deletion request, please contact us through the contact form available on the Mobile Connect website.