Privacy Policy

1. Introduction

This Privacy Policy explains how Megatronic Ltd (“we”, “us”, “our”) collects, uses, stores and protects personal data when you visit this website and when merchants install and use our applications (“the Apps”) on the Shopify App Store.

We operate in full compliance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the UK Privacy and Electronic Communications Regulations (PECR). We are registered with the Information Commissioner’s Office (ICO) under registration number ZC156233. Where the EU GDPR or another country’s law applies to you, section 14 explains how we meet it.

How this policy is organised

This document is the master policy. It sets out everything that is true of every Megatronic app and of this website. Each app then has a short supplement describing the data that app specifically handles, where that goes beyond the master. The master and the relevant supplement together form the complete privacy notice for that app, and where a supplement is more specific, the supplement applies.

By installing any of the Apps, the merchant agrees to this Privacy Policy and to the supplement for that App. If you do not agree, please do not install or use the App.

Supersedes Privacy Policy v2.1 of 19 September 2026. Version 2.2 names Google as the AI provider for Image Optimizer Pro, corrects what Batch Dispatch keeps and for how long, sets one deletion and backup period for every App, and adds our Data Processing Terms to the Terms and Conditions.

2. Who We Are and How to Contact Us

For all data protection enquiries, data subject access requests, or deletion requests, contact us at the privacy email address above. We will acknowledge all requests within 72 hours and respond fully within one calendar month.

3. Who This Policy Covers, and Our Role

This policy applies to three groups with different legal relationships to Megatronic Ltd:

Our role

• ›For your account, settings and billing information, we are the controller: we decide how that information is used, as described in this policy.
• ›For your store’s content and your customers’ data that an App works on (products, images, alt text, orders and shipping details), we act on your instructions as your processor, and use it only to provide the App to you. The Data Processing Terms in our Terms and Conditions govern that processing.

We have no direct relationship with end customers. Where we process their data at all, we do so solely to fulfil the merchant’s instruction. We never contact end customers, sell their data, profile them, or use their data for any purpose beyond providing the App.

4. What We Collect From Every Merchant

4.1 Merchant Account Data (we are data controller)

When a merchant installs any of the Apps, we collect and store the following:

• ›Shopify store domain and store ID, received via Shopify OAuth at installation
• ›The access credentials Shopify issues so the App can work with the store, stored encrypted and never sent to the browser
• ›Subscription tier, plan status and usage counts, used for billing via Shopify's native billing system
• ›App configuration settings

4.2 What varies by app

Each App also collects the data it needs for its own job. In brief, with full detail in each supplement:

Image Optimizer Pro and Product Badges Pro do not collect or store the names or email addresses of merchants or their staff.

5. How We Use Information and Our Legal Bases

We use the information described in this policy and the supplements only to:

• ›Provide, operate and support the App you have installed, including the specific processing described in its supplement
• ›Apply your plan's limits and bill you through Shopify
• ›Keep the Apps secure and reliable, diagnose faults and prevent misuse
• ›Answer your questions and handle privacy requests
• ›Where we hold your contact email address, tell you about changes to the App or this policy, and occasionally about our other Shopify apps. Every such message carries an unsubscribe link, and we honour every opt-out
• ›Meet our legal obligations, including those under Shopify's terms

We do not sell personal data, use it for advertising, or use it to train AI models. The only use of AI in any App is the optional alt text feature of Image Optimizer Pro, which runs only when the merchant turns it on and is described in full in its supplement.

We make no decisions about you by automated means that have legal or similarly significant effects.

Legal bases

• ›Performance of a contract (Article 6(1)(b) UK GDPR): providing the App and billing for it. This is the basis for all core processing.
• ›Legitimate interests (Article 6(1)(f)): security, error logging and keeping the Apps reliable, always limited to the shortest useful retention; and, for merchants that are businesses, telling you about our other apps, which you can stop at any time.
• ›Consent (Article 6(1)(a)): analytics cookies on this website only, see section 12; and the AI alt text feature of Image Optimizer Pro, which you switch on and can switch off in the App’s settings.
• ›Legal obligation (Article 6(1)(c)): where the law requires it.

6. Where Data Is Stored and International Transfers

All Megatronic Ltd server infrastructure is located in the United Kingdom (Hostinger VPS, UK datacentre). All data stored on our servers is encrypted at rest. Each supplement describes exactly what its App stores there.

Transfers outside the UK and EEA

With two exceptions, no personal data processed by us is transferred outside the United Kingdom or the European Economic Area (EEA).

Shopify, as the platform provider, processes data under its own privacy policy and transfer safeguards.

7. Third-Party Sub-Processors

We use the following sub-processors. Each is contractually bound to handle data only as instructed and in accordance with applicable data protection law. The final column shows which Apps each one supports.

Any new sub-processor will be named in this policy before it goes live, and merchants of the affected App will be told inside the App first. Merchants may request an up-to-date list at any time by contacting hello@mega-tronic.com.

8. Data Retention, and What Happens When You Uninstall

We keep data only for as long as we need it to provide the App and meet our obligations, in line with the UK GDPR storage limitation principle. Each supplement contains a full retention table for its App. The principles below apply to every App.

Our promise

Every copy of your store’s data that we hold is deleted within 30 days of the day you uninstall. For each App the actual period is shorter, as the table shows. The only things that outlast it are records the law requires us to keep, for example billing records for tax purposes, which we keep only for as long as the law requires and use for nothing else.

When you uninstall or stop subscribing

• ›Shopify revokes the App's access to your store the moment you uninstall. The App can no longer read from or write to your store.
• ›Shopify then sends us its shop/redact compliance webhook, about 48 hours after uninstallation. Every App we publish subscribes to it.
• ›Your store's data is permanently deleted from our active systems within the period shown below for that App. Nothing is kept for marketing, and nothing is kept in a form that could identify your store, except a count and date of the deletion where noted.
• ›We do not take our own backups of merchant or customer data. Our hosting provider takes encrypted server backups, which are replaced within 14 days. So a deleted store's data is gone from backups within 14 days of its deletion from our systems.

Deleting sooner

You can ask us to delete your store’s data before these periods end by emailing hello@mega-tronic.com from, or on behalf of, the store. A valid Shopify shop/redact or customers/redact webhook always overrides any retention period and triggers immediate deletion from our active systems.

“Deletion” means removed from our active systems and databases. Backups are replaced on the cycle stated above and are never restored in a way that would revive deleted store data.

9. Security Measures

• ›All data is encrypted in transit using TLS/HTTPS
• ›All data stored on our servers is encrypted at rest, and our hosting provider's server backups are encrypted
• ›Shopify access credentials, third-party API keys and any storage credentials are encrypted in our database and never sent to the browser
• ›Every webhook the Apps receive is verified as genuinely coming from Shopify before it is acted on
• ›The Apps have no staff login of their own. Merchants sign in through Shopify, and access to our hosting and Shopify Partner accounts is restricted to authorised Megatronic Ltd personnel
• ›Access logs are maintained for all systems that hold personal data
• ›In the event of a personal data breach we will notify the ICO within 72 hours and affected merchants without undue delay, as required by UK GDPR Article 33. Where the breach involves data obtained through Shopify, we also notify Shopify within 24 hours, as its terms require

10. Data Subject Rights

How we handle a request

• ›We may need to confirm that the request comes from the store before acting on it.
• ›We respond within one calendar month, or sooner where the law requires.
• ›If we cannot do what you ask, we explain why, and you can ask us to reconsider by replying to that email.
• ›Using a right never affects your price or the service you get.
• ›You can stop AI processing in Image Optimizer Pro at any time by switching off AI suggestions in the App's settings. Nothing is sent to Google unless you ask for a suggestion.
• ›You can also complain to your local data protection authority, see sections 14 and 16.

11. Shopify Mandatory Compliance Webhooks

Every App we publish subscribes to and verifies all three mandatory Shopify compliance webhooks, and completes each one within 30 days of receipt:

12. Cookies

Cookies in the Apps

Our Apps run on two different technical stacks, so their use of cookies differs. None of them uses tracking, analytics, advertising or preference cookies.

• ›Batch Dispatch uses a small number of strictly necessary session cookies, listed in its Batch Dispatch supplement. Because they are strictly necessary, they do not require consent under UK PECR.
• ›Image Optimizer Pro and Product Badges Pro set no cookies at all. Merchants are signed in with short-lived tokens from Shopify. Each keeps one or two display preferences in your browser’s local storage, which never leave the browser. Details are in each supplement.
• ›Every app in the Shopify admin runs Shopify’s App Bridge script, which Shopify uses to measure how quickly apps load. This is Shopify’s processing and is covered by Shopify’s Privacy Policy.

Cookies on this website

This website (mega-tronic.com) uses one optional analytics service: Google Analytics 4, provided by Google LLC. It helps us understand how visitors use the site (pages viewed, approximate location, device type). We do not use advertising or cross-site tracking cookies.

Analytics cookies are set only if you accept themvia the cookie banner. If you reject them, or make no choice, no analytics cookies are set and no data is sent to Google. You can change your choice at any time using the “Cookie Settings” link in the website footer, which also removes any analytics cookies already set. We also honour the Global Privacy Control browser signal as a valid opt-out, as required for California residents under the CCPA/CPRA.

Google’s processing of analytics data is described in the Google Privacy Policy. The record of your consent choice is stored locally in your browser and is not transmitted to us.

13. Our Position on Children’s Data

Our Apps are business-to-business tools for Shopify merchants. They are not intended for, or directed at, anyone under 18, and we do not knowingly collect information from anyone under 18. Megatronic Ltd has no direct relationship with end customers and no mechanism to identify the age of any end customer whose data an App may process on a merchant’s behalf.

The merchant is the data controller for their customers’ data and is solely responsible for ensuring that their store’s data collection and processing practices are lawful, including any obligations relating to customers who may be under the age of 18.

14. Region-Specific Information

We apply the protections in this policy to every merchant, wherever the store is based. This section adds what particular laws require.

European Economic Area, United Kingdom and Switzerland

The UK GDPR, the EU GDPR and the Swiss Federal Act on Data Protection apply. The legal bases in section 5 are the ones we rely on under each. Megatronic Ltd is established in the United Kingdom. We have not appointed a representative in the EU, relying on the exemption in Article 27(2)(a) EU GDPR for occasional processing that is unlikely to result in a risk to the rights of individuals; we keep this under review. You can complain to the UK Information Commissioner’s Office, the data protection authority in your EU country, or the Swiss Federal Data Protection and Information Commissioner.

United States

This covers the California Consumer Privacy Act, as amended by the CPRA, and the similar laws of other US states. In the last 12 months we have collected the categories of information described in section 4 and the supplements: identifiers (your store’s address, and in server logs the IP address a request came from), commercial information (your plan, billing and credit records), your store’s product content, and, for Batch Dispatch, your customers’ names and delivery addresses on your behalf. We collect them for the purposes in section 5 and disclose them only to the sub-processors in section 7.

• ›We do not sell or share personal information, and we do not use it for targeted advertising or for profiling that produces legal or similarly significant effects.
• ›We do not collect sensitive personal information.
• ›You can ask to know, access, correct and delete your information as described in section 10, and you can use an authorised agent to make a request for you.
• ›If we refuse your request, you can appeal by replying to our decision. If the appeal is refused, you can contact your state's Attorney General.
• ›On this website we honour the Global Privacy Control signal as an opt-out, as described in section 12.

Canada

The Personal Information Protection and Electronic Documents Act and applicable provincial laws, including Quebec’s Law 25, apply. Our person in charge of the protection of personal information can be reached at hello@mega-tronic.com. Your information is stored in the United Kingdom and, for AI suggestions only, processed in the United States, where it may be accessible to authorities under local law. You can complain to the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d’accès à l’information.

Brazil

The Lei Geral de Proteção de Dados applies. We rely on the legal bases in section 5: contract, legitimate interests, consent and legal obligation. Our contact for LGPD matters can be reached at hello@mega-tronic.com. You can also ask which companies we share your information with (section 7) and complain to the Autoridade Nacional de Proteção de Dados.

Australia

We handle personal information in line with the Australian Privacy Principles. The overseas recipients we are likely to disclose information to, and their countries, are listed in section 7. You can complain to us first, then to the Office of the Australian Information Commissioner.

Japan, South Korea and other countries with transfer notice rules

When you ask Image Optimizer Pro for an alt text suggestion, the items in section 6 (a resized image, the product name and your chosen language) are sent to Google in the United States over an encrypted connection, at the moment you ask, and used only to write the suggestion. Google keeps them for 55 days for abuse monitoring. You can avoid this transfer by not turning on AI suggestions. Information about the data protection laws of the United States is available from your national data protection authority.

India

The Digital Personal Data Protection Act, 2023 applies. Our grievance contact is hello@mega-tronic.com. If you are not satisfied with our response, you can complain to the Data Protection Board of India.

Other countries

If your local law gives you further rights, contact us and we will honour them.

15. Changes to This Policy

Where changes are material, for example a new sub-processor receiving your information, we will:

• ›Update the version number and last updated date at the top of this document and of any supplement affected
• ›Give notice inside the affected App before the change takes effect
• ›Where we hold a contact email address for the merchant, also notify by email before the change takes effect

A supplement may commit to stronger notice than this for its App. Where it does, the supplement applies.

16. Complaints and Regulatory Authority

If you have a concern about how we handle personal data, please contact us at hello@mega-tronic.com in the first instance. We aim to resolve all concerns within 30 days.

You also have the right to lodge a complaint directly with the UK supervisory authority:

Privacy contact: hello@mega-tronic.com. Depending on where you live, you may also have the right to complain to your local data protection authority, see section 14.