Privacy policy

This policy explains how Caelena Software Labs (“we”, “us”) handles personal data for MergeGuard for Shopify. It has two parts, because the website and the app handle very different data:

1. The website at mergeguard.store, which anyone can visit.
2. The MergeGuard app, which merchants install from the Shopify App Store and which works with their store’s customer data.

Contact us about privacy at privacy@mergeguard.store.

Part 1: The website

What the website collects

The website collects only what our cookie policy lists, in three groups:

1. Analytics, on every visit. PostHog records the pages you view, how fast they load, and twelve actions: clicks on Install free, switching between monthly and yearly prices, opening an FAQ answer, finishing the self-check quiz at the end of a Knowledge guide, deciding a group in the Try a merge demo, switching a setting on the automatic-merging demo card, approving or undoing the demo contact fix, replaying the hero example, clicking an outcome tile in the hero, choosing a goal in the Home goal explorer, switching the win-back demo between profiles and people, and finishing all groups in the Try a merge demo. For demo decisions and settings it records which demo group or setting and what you chose; for the contact fix it records whether you approved or undid it. For a completed demo it records how many groups were merged, kept apart or protected; for a tile or a goal it records which goal; for the count switch it records the goal and whether you chose profiles or people. Replaying the hero sends no extra details. For the quiz it records which guide and which result band, never your answers. These examples are simulated and change nothing in a store. Each record holds the page path, your browser, device type and the campaign tags in the link you followed, such as utm_source. Before a record leaves your browser, we remove the query string and fragment from every page address and drop advertising click IDs. PostHog stores a random visitor ID in a cookie and in your browser’s storage. Automatic click capture, heatmaps, session recording and surveys are off, and we never tell PostHog who you are.
2. Error reports. When a page breaks, Sentry sends us the error, your browser type and the page address with any query string or fragment removed. Sentry is set not to store IP addresses.
3. YouTube, only if you click play. Videos show a preview image until you click. Then YouTube’s player loads and YouTube’s own privacy policy applies.

You can’t create an account or sign up for emails on the site, so it never asks for your contact details.

Why we use it

• Analytics shows us which pages help merchants and how fast they load, so we can improve them. We keep it to the records above. You can block it in your browser at any time, as the cookie policy explains.
• Error reports let us fix broken pages. We treat them as strictly necessary and keep them free of query strings, fragments and IP addresses.

When you email us

If you write to one of our addresses, we receive your email address, your name if you include it, and what you write. We use it to answer you and keep it with our support records. We keep support emails while you are a MergeGuard customer, and delete them when you ask.

Part 2: The MergeGuard app

Our role

When a merchant installs MergeGuard, the app works with the store’s customer data on the merchant’s behalf. For that data, the merchant decides what happens to it, and we act on the merchant’s instructions. In legal terms, the merchant is the controller and we are the processor. Our Data Processing Agreement sets this out.

For a small amount of data about the merchant’s own business, such as the store’s name, the email addresses of the team members who receive the digest, and how the team uses the app, we decide how it is used.

Customer data the app works with, and why

MergeGuard reads this data from the merchant’s Shopify store:

Shopify also sends MergeGuard an order’s contact details with each order update: the email, phone, shipping address and the browser IP address recorded on the order.

If the merchant connects Klaviyo, MergeGuard also reads Klaviyo profiles to compare them with Shopify customers. If the merchant turns on Klaviyo merging, MergeGuard reads the Klaviyo profiles of the customers it merged, including their subscription status, to find the profiles to merge and keep a copy of each.

MergeGuard asks Shopify for permission to read and change customers, read and make customer merges, read orders (including older orders), and read products, discounts and reports.

What the app changes, and only when

• Merges. MergeGuard merges customer profiles in Shopify when the merchant confirms, or through automatic merging the merchant switched on for strong matches or groups that need the merchant’s judgment. Shopify merges are permanent. If any merged profile is subscribed to email or SMS marketing, the merged customer stays subscribed, as in Shopify’s own merge.
• Contact fixes. MergeGuard corrects a mistyped email when the merchant applies the fix, or automatically for domain typos if the merchant switched that on. A contact fix doesn’t change the customer’s subscription.
• Klaviyo lists. MergeGuard syncs lists to Klaviyo only when the merchant chooses. Syncing never changes consent.
• Klaviyo profiles. If the merchant turns on Klaviyo merging, MergeGuard asks Klaviyo to merge the Klaviyo profiles of the same customer after it merges that customer in Shopify. Klaviyo’s merge rules decide the merged profile’s consent and suppression. MergeGuard doesn’t copy or change them. Klaviyo profile merges can’t be undone.

MergeGuard never messages the merchant’s customers.

Copies we keep

• History. Every merge is recorded: a snapshot of each profile before the merge, the details kept, a timeline and Shopify’s verification.
• Snapshots. MergeGuard keeps a snapshot of each merged customer. It is a record of the profile before the merge. It can’t reverse the merge.
• Klaviyo profile copies. Before a Klaviyo merge, MergeGuard saves a copy of both Klaviyo profiles: email, phone number, external ID, the dates the profile was created and updated, subscription status, location and custom properties. Custom properties are left out when a profile’s copy would be too large. It can’t reverse the merge.
• Working data. Duplicate groups, including which details matched, and audience lists, built from the data above.

These copies live in our database. Background job messages for Shopify updates carry the customer record and the order’s contact details while the job runs. Email job messages carry the recipient’s email address, the subject line and the template data, such as the store name, summary counts and plan details. Other job messages carry IDs only. App logs record IDs and details about the merchant’s team, such as a staff member’s name or email, and identify customers by ID. Error reports can include the merchant user’s IP address, their Shopify user ID and details of the request.

History records and snapshots are kept while MergeGuard is installed. 30 days after a merchant uninstalls, we delete all of that store’s data: merge history, snapshots, customers, orders and sessions. We keep billing records.

Who receives it

• The service providers on our sub-processor list, which run the app for us.
• Klaviyo, when the merchant syncs a list to their own Klaviyo account, or when MergeGuard asks Klaviyo to merge profiles in that account.
• Shopify, because every merge and fix is made through Shopify.

We don’t sell personal data, and we don’t use it for advertising.

We don’t put merchant or customer data, or logs made from it, into AI tools. When we use AI tools, we give them only fictional or public data.

Deletion

Shopify sends apps three privacy requests, and MergeGuard acts on each:

• Customer data request. When a customer asks the merchant for their data, Shopify tells us, and we give the merchant that customer’s current profile data: email, name, phone, tags, note and addresses.
• Customer redaction. When a merchant or Shopify asks to erase a customer, we act at once. We delete the customer record, blank that customer’s merge snapshots, redact their contact-fix and activity records, anonymise their orders and delete any Klaviyo profile snapshots. History rows for their merges stay, with the personal details removed. If a merge involving that customer is still in progress, we ask Shopify to send the request again.
• Shop redaction. When Shopify asks us to erase a store’s data after the merchant uninstalls MergeGuard, we record the request. The store’s data is deleted 30 days after the uninstall.

Transfers outside the EU and UK

Where data leaves the EU or UK, we rely on our providers’ standard contractual clauses. The sub-processor list names each provider.

Your rights

You can ask us for a copy of the personal data we hold about you, ask us to correct or delete it, or object to how we use it. Email privacy@mergeguard.store.

If you are a customer of a store that uses MergeGuard, contact the store first. The store decides what happens to your data, and we help the store answer your request.

Children

MergeGuard is a service for businesses. The website and app aren’t meant for children, and we don’t knowingly collect data about them.

Changes

When this policy changes, we update it here and change the date at the top.

Contact

• Privacy: privacy@mergeguard.store
• Data Processing Agreement: dpa@mergeguard.store
• Support: support@mergeguard.store

Caelena Software Labs is the developer of MergeGuard for Shopify.