DealScout Privacy Policy

DealScout is a Shopify application provided by MCL Digital (“we”, “us”, or “our”). This Privacy Policy explains how we collect, use, store, share, and protect information when Shopify merchants install or use our application.

This Privacy Policy applies to information processed by DealScout through Shopify, through our application interface, and through any related support or documentation services we provide.

By installing or using DealScout, you agree to the collection and use of information in accordance with this Privacy Policy.

1. Information we collect

When a merchant installs or uses DealScout, we may collect and process certain information from the merchant’s Shopify store and from the merchant directly.

The exact information collected depends on the features the merchant enables and the permissions granted during app installation.

1.1 Information collected through Shopify APIs

We may collect the following types of information from Shopify:

• Store name

• Shopify shop domain

• Store email address

• Store currency

• Store locale and timezone

• Shopify plan or store configuration information where relevant

• Product, collection, variant, pricing, and inventory information where required for app functionality

• Theme, asset, or app embed status where required to display or manage app widgets

• Discount, promotion, or pricing configuration data where required to provide the app’s services

• App installation status, access scopes, and Shopify access tokens

Depending on the features used by the merchant, we may also process limited customer, cart, checkout, or order-related information where required to display discounts, apply promotional logic, or support app functionality.

We only request access to Shopify data that is reasonably necessary for the operation of the app.

1.2 Information collected directly from merchants

We may collect information that merchants provide directly through the app, including:

• Merchant name

• Business name

• Email address

• Support contact details

• App settings and preferences

• Discount rules, widget settings, display preferences, and configuration data

• Messages, files, or information provided through support requests

1.3 Information collected from merchant customers

DealScout is primarily designed for merchants. However, depending on how the merchant configures the app, we may process limited information relating to visitors or customers of the merchant’s Shopify store.

This may include:

• Information required to determine whether a discount, promotion, or widget should be displayed

• Cart, product, variant, or checkout-related context

• Technical information such as browser, device, IP address, and usage logs where required for security, debugging, analytics, or app performance

Unless specifically required for enabled app functionality, we do not intentionally collect directly identifying customer information such as customer names, email addresses, phone numbers, or postal addresses.

If future app features require access to protected customer data, we will only request and process the minimum information required to provide that functionality.

1.4 Automatically collected technical information

When merchants use the app, we may automatically collect technical information such as:

• IP address

• Browser type and version

• Device type

• Operating system

• Referring URLs

• Pages or features accessed within the app

• Date and time of access

• Error logs and diagnostic information

This information is used to operate, secure, debug, and improve the app.

2. How we use information

We use the information we collect to provide, maintain, secure, and improve DealScout.

This includes using information to:

• Install and authenticate the app on a Shopify store

• Provide app functionality requested by the merchant

• Display, configure, or manage app widgets

• Create, manage, or display discount and promotion-related functionality

• Store merchant settings and preferences

• Provide customer support

• Troubleshoot errors and technical issues

• Monitor app performance and reliability

• Prevent fraud, abuse, unauthorised access, or misuse

• Comply with Shopify requirements, applicable laws, and legal obligations

• Communicate with merchants about service updates, support issues, or important app changes

We do not sell merchant or customer personal data.

We do not use merchant or customer personal data for unrelated advertising purposes.

3. Legal basis for processing

Where applicable under UK GDPR, EU GDPR, or similar privacy laws, we process personal data on the following legal bases:

• Performance of a contract: to provide the app and related services requested by the merchant.

• Legitimate interests: to operate, maintain, secure, and improve the app.

• Consent: where consent is required for a specific feature, communication, or tracking technology.

• Legal obligation: where processing is required to comply with legal, regulatory, tax, accounting, or Shopify platform obligations.

4. Shopify access tokens and authentication

When a merchant installs DealScout, Shopify provides access credentials that allow the app to interact with the merchant’s Shopify store according to the permissions approved during installation.

We store Shopify access tokens securely and use them only to provide app functionality.

If the app is uninstalled, we stop using the store’s access token and begin the data deletion process described in this Privacy Policy.

5. Sharing information with third parties

We may share information with trusted third-party service providers that help us operate the app.

These providers may include:

• Hosting providers

• Database and storage providers

• Error monitoring and logging providers

• Analytics providers

• Email and support tools

• Payment or billing providers where applicable

• Shopify and related Shopify services

These third parties are only authorised to process information as necessary to provide services to us and must protect the information appropriately.

We may also disclose information where required to:

• Comply with applicable law or legal process

• Respond to lawful requests from public authorities

• Enforce our terms or protect our rights

• Investigate fraud, security, or technical issues

• Protect the rights, property, or safety of merchants, customers, Shopify, us, or others

We do not sell personal data to third parties.

6. International data transfers

We may process and store information in the United Kingdom, the European Economic Area, the United States, or other countries where we or our service providers operate.

Where personal data is transferred outside the UK or EEA, we take appropriate steps to protect that information in accordance with applicable privacy laws. This may include using contractual safeguards, data processing agreements, or other lawful transfer mechanisms.

7. Data retention

We retain information only for as long as necessary to provide the app, comply with legal obligations, resolve disputes, enforce agreements, and maintain security.

In general:

• Merchant account and store data is retained while the app is installed.

• App settings and configuration data may be retained for a reasonable period after uninstall to support reinstallation, troubleshooting, or legal obligations.

• Technical logs are retained for a limited period unless needed for security, debugging, fraud prevention, or legal reasons.

• Support messages may be retained for customer service, audit, and business record purposes.

• Data required for tax, accounting, legal, or compliance purposes may be retained for the period required by applicable law.

When information is no longer needed, we delete, anonymise, or securely retain it in accordance with this Privacy Policy and applicable law.

8. App uninstall and data deletion

When a merchant uninstalls DealScout, Shopify notifies us that the app has been removed from the store.

After uninstall, we will stop accessing the merchant’s Shopify store and will delete or anonymise personal data associated with the store unless retention is required for legitimate business, legal, security, or compliance reasons.

Merchants may request deletion of their data by contacting us using the details in the “Contact us” section below.

9. Shopify mandatory privacy webhooks

We comply with Shopify’s mandatory privacy and data protection webhook requirements.

This may include responding to Shopify webhooks relating to:

• Customer data requests

• Customer data erasure requests

• Shop data erasure requests

Where we receive a valid request through Shopify, we will process it in accordance with Shopify’s requirements and applicable privacy laws.

10. Security

We take reasonable technical and organisational measures to protect information against unauthorised access, loss, misuse, alteration, or disclosure.

These measures may include:

• Secure authentication

• Access controls

• Encrypted connections

• Secure storage of credentials and access tokens

• Monitoring and logging

• Separation of development and production environments where appropriate

• Limiting access to information to those who need it to operate or support the app

No method of transmission or electronic storage is completely secure, so we cannot guarantee absolute security.

11. Cookies and tracking technologies

DealScout may use cookies or similar technologies where required to operate the app, maintain sessions, improve performance, or understand how the app is used.

If the app uses storefront widgets, we may use limited technical storage or tracking technologies necessary to display or operate those widgets.

We do not use cookies to sell personal data.

Where required by law, merchants are responsible for informing their customers about cookies, tracking technologies, or third-party services used on their storefront.

12. Merchant responsibilities

Merchants are responsible for ensuring that their use of DealScout complies with applicable laws and their own privacy policies.

This includes responsibility for:

• Informing customers where the app affects storefront behaviour

• Ensuring their privacy policy accurately describes apps and third-party services used on their store

• Obtaining customer consent where required

• Configuring the app in a lawful way

• Responding to customer privacy rights requests where applicable

13. Individual privacy rights

Depending on location, merchants and individuals may have rights relating to their personal data.

These rights may include the right to:

• Access personal data

• Correct inaccurate personal data

• Request deletion of personal data

• Object to or restrict certain processing

• Request a copy of personal data

• Withdraw consent where processing is based on consent

• Lodge a complaint with a data protection authority

Requests can be made by contacting us using the details below.

Where a request relates to data controlled by a Shopify merchant, we may direct the individual to contact the relevant merchant directly.

14. Children’s privacy

DealScout is intended for use by Shopify merchants and is not directed at children.

We do not knowingly collect personal data from children. If we become aware that we have collected personal data from a child without appropriate consent, we will take reasonable steps to delete that information.

15. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to the app, legal requirements, Shopify requirements, or our data practices.

When we make changes, we will update the “Last updated” date at the top of this page.

If changes are material, we may notify merchants through the app, by email, or by another appropriate method.

Continued use of DealScout after changes become effective means the updated Privacy Policy applies.

16. Contact us

If you have any questions about this Privacy Policy, how we process data, or how to make a privacy request, please contact us at:

MCL Digital
Email: support@deal-scout.co.uk
Website: www.mcl-digital.com

17. Data controller and data processor position

For most app functionality, the Shopify merchant is the controller of customer data processed through their Shopify store, and MCL Digital acts as a processor or service provider on behalf of the merchant.

For information relating to merchant accounts, app usage, support, billing, security, and service administration, MCL Digital may act as an independent controller.

18. Subprocessors

We may use subprocessors to help provide DealScout. These subprocessors may process information only as required to provide services to us.

A current list of subprocessors is available on request by contacting support@deal-scout.co.uk.

19. No sale of personal data

We do not sell personal data.

We do not share personal data for cross-context behavioural advertising unless clearly disclosed and permitted by applicable law.

20. Data minimisation

We aim to collect and process only the information necessary to provide DealScout.

Where a feature can be provided without accessing personal data, we will avoid collecting personal data. Where personal data is required, we will limit collection to the minimum information needed for the relevant feature.

21. Automated decision-making

DealScout may use automated logic to determine how discounts, promotions, or storefront widgets are displayed based on merchant configuration and store context.

This automated logic is used to provide app functionality and does not make legal or similarly significant decisions about individuals.

22. Support communications

If a merchant contacts us for support, we may collect and process the information included in the support request.

This may include contact details, store information, screenshots, technical logs, or other details needed to investigate and resolve the issue.

We use support information only to provide assistance, improve the app, and maintain appropriate business records.

23. Billing information

If DealScout uses Shopify Billing, billing and subscription charges are processed through Shopify.

We may receive limited billing-related information from Shopify, such as subscription status, charge status, plan name, and billing confirmation details.

We do not directly collect or store full payment card details through the app.

24. Contact for data protection matters

For privacy or data protection enquiries, contact:

Email: support@deal-scout.co.uk

Please include the name of your Shopify store and enough detail for us to identify and respond to your request.