Privacy Policy

Last updated: 5 November 2026

This Privacy Policy explains how MAX IT Solutions (“MITS”, “we”, “us”) collects, uses, shares and protects personal information when a merchant installs and uses any of our apps on the Shopify App Store, when that merchant’s customers interact with those apps, and when anyone visits maxitsolutions.tech or the websites of our apps. It applies to every MITS app, current and future, unless an app’s listing links to its own policy. Questions: info@maxitsolutions.tech.

1. Our role

• For the merchant’s own account data (store name, owner name and email, billing status) we act as a controller.
• For data about the merchant’s customers that an app processes (for example an email entered in a storefront form, a buyer on an invoice or a person returning an order) the merchant is the controller and we act as a processor on the merchant’s behalf and instructions, under the Shopify API Terms and Data Protection Addendum. Customers who want to exercise their rights should contact the store first; we help the merchant answer.

2. Information our apps collect

When you install an app. Through the Shopify API, and only within the access scopes you approve on install, an app can read the store details it needs to work: shop domain and name, owner name and email, Shopify plan, currency, locale and time zone, the access token Shopify issues to the app, and the status of the app’s charges. Payments are processed by Shopify; we never see card details.

Store data an app works on. Each app reads or changes only the kind of data its job requires, for example:

• products, variants, prices, inventory and collections, when an app edits the catalog or prices, together with a log of the changes so they can be reviewed or reverted;
• orders, refunds, fulfillments and returns, when an app creates documents or processes returns for them;
• customers and B2B companies (name, email, phone, billing and shipping address, company name, tax ID) when the app’s function needs them, for example to issue an invoice, price a wholesale order or book a return parcel;
• theme settings, only to show whether the app’s blocks or embeds are switched on.

Data from your store’s visitors and customers. Some apps run on the storefront or at checkout. They process what the visitor enters or sends — for example an email or phone number in a sign-up form, a return or withdrawal request with its items, reasons and photos, or a purchase order file — and store it for the merchant. Checkout logic that runs as Shopify Functions or checkout extensions is executed inside Shopify and does not send the cart to our servers.

Settings and credentials you give us. App settings you enter (for example your business details for document headers, prices or rules), and keys or tokens for third-party systems you choose to connect, such as a government e-invoicing system or a carrier account. Credentials are encrypted at rest and never shown back in full.

Support. Anything you send us in emails or support requests.

Technical data. Our servers log IP addresses, browser user agents, request times and errors to keep the apps secure and working. Inside Shopify admin the apps use Shopify session tokens and do not set advertising cookies.

3. Google user data (Bulk Product Edit and Google Sheets)

This section applies only to Bulk Product Edit by MITS, shown on Google’s sign-in screen as “Product Edit by MITS”. It is the only MITS app that connects to Google APIs, and it does so only when the merchant clicks “Connect Google Sheets” in the app’s Settings to export to or import from Google Sheets.

What the app accesses.

• The email address of the Google account the merchant connects (scopes openid and email).
• In Google Drive, only files the app itself created (the Google Sheets it exports to) and the single file the merchant picks in the Google Picker for an import (scope https://www.googleapis.com/auth/drive.file). The app cannot see, list or open any other file in the merchant’s Drive.

How it is used. The email is shown in Settings so the merchant knows which Google account is connected. Drive access is used only to create a spreadsheet and write the products or variants the merchant chose to export (including scheduled exports the merchant sets up), and to read the rows of the sheet the merchant picked so the app can show a preview and apply those changes to the store. Google user data is used for nothing else.

Storage and deletion.

• The app stores, per store, the connected email and a Google refresh token, encrypted at rest; short-lived access tokens are cached for up to one hour.
• Exports: the spreadsheet stays in the merchant’s own Drive; we keep only its ID so a scheduled export can update the same sheet.
• Imports: the rows of the picked sheet are copied to a temporary file on our server to run the import, and that file is deleted 7 days after the import has run or was abandoned. The changes applied to products are kept in the task’s change log, like any other edit, so they can be reviewed or reverted.
• When the merchant clicks “Disconnect” in Settings, or uninstalls the app, we revoke the token at Google and delete it together with the stored email; scheduled exports to Google Sheets can no longer run. The sheets stay in the merchant’s Drive. Any merchant can also remove the app’s access at myaccount.google.com/permissions.

Sharing. We do not sell Google user data, do not use or transfer it for advertising, do not share it with third parties except our hosting providers that run the app and where the law requires, and do not use it to train or improve AI or machine-learning models. No person at MITS reads it unless the merchant asks us to for support, it is needed for security, or the law requires it.

Limited Use. Bulk Product Edit’s (Product Edit by MITS) use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

4. Our websites

maxitsolutions.tech, bulkproductedits.com and popupsdiscount.com use Ahrefs Web Analytics to count visits, pages, referrers, countries and devices. It sets no cookies, stores nothing on your device and collects no personal data (visits are counted without identifying you), so it runs without a consent prompt. maxitsolutions.tech is a static site and does not use tracking cookies. The app websites bulkproductedits.com and popupsdiscount.com use Microsoft Clarity (heatmaps and session recordings with personal input masked, using cookies), and popupsdiscount.com also uses the Google Ads conversion tag, to see which pages help merchants find and install the apps. Visitors from the EEA, the UK and Switzerland are asked first: these tools set cookies only after they accept in the cookie banner, and anyone can change the choice with the “Cookie settings” link at the bottom of each page. Website data is not combined with app data.

5. How we use information and legal bases

We do not sell personal information, do not use one store’s customer data for another store, and do not use it for advertising or to train AI models.

6. Who receives information

We share personal information only with the categories of recipients below, and service providers only under contracts that require confidentiality and security:

• Shopify — app installation, billing and webhooks.
• Hosting, database, storage and content delivery providers — running the apps, storing their data, network security.
• Messaging and email delivery providers — delivering webhooks and inbound emails to us, sending service emails and emails the merchant asks an app to send.
• Systems the merchant connects — for example a tax authority’s e-invoicing system, a carrier, a trading partner or the merchant’s own Google account (Google Sheets, see section 3). They receive only what is needed for the task the merchant starts (an invoice, a parcel booking, an order message) and act as the merchant’s own partners or as public authorities, not as our processors.
• Website analytics and ad measurement (Ahrefs Web Analytics on all our websites, cookieless; Microsoft Clarity and Google Ads on the app websites only, after consent where required); not used inside the apps.

Merchants can request the current list of sub-processors at info@maxitsolutions.tech. We may also disclose information to comply with law, a court order or another lawful request, or to protect our rights, users or the public.

7. International transfers

Our application servers are located in the United States. When personal data from the EEA, the UK or Switzerland is transferred there, we rely on the EU–US Data Privacy Framework where the recipient is certified, and otherwise on the European Commission’s Standard Contractual Clauses with additional safeguards (encryption in transit and at rest).

8. Security

• All traffic is encrypted with TLS; the apps’ admin screens are reachable only through authenticated Shopify sessions.
• Credentials for connected systems are encrypted at rest and never shown back in full.
• Each store’s data is isolated; access to production systems is restricted to authorised staff.
• No method of transmission or storage is completely secure; we notify affected merchants and authorities of a personal data breach as the law requires.

9. Retention

• Store data: while the app is installed. After you uninstall, Shopify sends us a shop/redact request 48 hours later and we delete your store’s data from our databases; backups roll over within 30 days.
• Documents with a legal retention period (for example invoices): kept while the app is installed so you can meet your retention duty, and deleted with the store data after uninstall — export them before uninstalling. Copies already filed with a public authority stay there under its rules.
• Data about one of your customers: deleted or anonymised when Shopify sends us a customers/redact request, except what the merchant must keep by law, which is reduced to the minimum.
• Google connection (Bulk Product Edit): until the merchant disconnects Google or uninstalls the app; imported sheet copies are deleted within 7 days (section 3).
• Server logs: up to 30 days.

10. Your rights

Depending on where you live (including under the GDPR, UK GDPR and US state laws such as the CCPA/CPRA) you may have the right to:

• access the personal data we hold about you and receive a copy (portability);
• have inaccurate data corrected;
• have data erased or its processing restricted, unless it must be kept to comply with a legal obligation;
• object to processing based on legitimate interests;
• withdraw consent at any time where processing is based on consent;
• lodge a complaint with the data protection authority in your country.

Send requests to info@maxitsolutions.tech; we answer within 30 days. Shopify customer data requests (customers/data_request, customers/redact, shop/redact) are handled through Shopify’s mandatory privacy webhooks.

11. Children

Our apps are business tools and are not directed to children under 16. We do not knowingly collect their personal information.

12. Third-party websites

The apps and our websites may link to third-party websites, such as Shopify or the portal of a connected system. Their own privacy policies apply.

13. Changes

We may update this policy to reflect changes to the apps, our providers or the law. The date at the top shows the latest version; material changes are announced to merchants inside the apps or by email.

14. Contact

MAX IT Solutions — info@maxitsolutions.tech