Privacy Policy
Last updated: October 15, 2026
1. Overview
StoreMCP ("we", "our", or "us") provides a bridge connecting Shopify stores with AI assistants and developer tools using the Model Context Protocol (MCP). This Privacy Policy explains what data we access, how it is used, and how we protect merchant information when you install and use the StoreMCP Shopify application.
2. Information We Collect and Access
When you install and authenticate StoreMCP, we access data strictly necessary to fulfill MCP tool queries authorized by you:
- Store Details: Shop domain, store name, email address, and plan configuration to provision your account and maintain access tokens.
- Product & Catalog Data: Titles, descriptions, SKUs, inventory levels, and pricing solely when your AI assistant queries catalog tools.
- Orders & Fulfillment: Order numbers, status, items purchased, and fulfillment updates when requested by your AI client.
- Usage Analytics: Anonymized query counts, tool execution latency, and error codes to monitor service health and quota enforcement.
3. How We Use Information
We use your information exclusively to:
- Authenticate requests from your configured AI assistants (Claude, Cursor, Windsurf, ChatGPT) to your Shopify store.
- Execute real-time API queries against Shopify’s Admin GraphQL/REST endpoints.
- Enforce rate limits and quotas based on your subscription tier.
- Provide customer support when requested at
hello@yanotoma.com.
We do not sell, rent, monetize, or train proprietary AI models on your store's private data or customer records.
4. Data Storage and Security
All communications between your AI client, StoreMCP servers, and Shopify Admin API are encrypted in transit using industry-standard TLS 1.3 encryption. Access tokens are stored encrypted at rest in dedicated, isolated databases. StoreMCP functions as a pass-through protocol translator: merchant data queried by your AI assistant is retrieved dynamically and not cached long-term on our servers.
5. Data Retention and Deletion
When you uninstall StoreMCP from your Shopify admin, Shopify immediately dispatches a mandatory webhook. StoreMCP automatically revokes all associated API tokens, terminates active MCP sessions, and purges store credentials within 48 hours.
6. Shopify Mandatory Webhooks
StoreMCP fully complies with Shopify's data protection requirements including Customer Data Request, Customer Data Erase, and Shop Data Erase mandatory webhooks under GDPR/CCPA.
7. Contact Us
If you have questions about this Privacy Policy or wish to exercise your data rights, contact us at: