Privacy Policy

1. Overview & Commitment

TagHorizon ("we", "our", or "the App") is an automated product tagging and bulk catalog management application engineered specifically for the Shopify platform. This Privacy Policy describes how we collect, process, store, and protect merchant and store data when you install and use TagHorizon on your Shopify store.

2. Information We Collect

To provide bulk tag editing, rule automations, and 1-Click Rollbacks, TagHorizon requests access only to the necessary Shopify Admin APIs and collects the following categories of information:

A. Merchant Account Information

• Store Domain: Your primary .myshopify.com domain and custom domain (used as your unique store identifier).
• Merchant Contact: Store name and merchant email associated with your Shopify account (used for administrative communication, service alerts, and support requests).
• Billing Information: Subscription tier and transaction records processed securely through Shopify's official Billing API. (We never access or store raw payment card data).

B. Catalog & Product Metadata

• Product Identifiers: Shopify Product IDs, Variant IDs, and SKU numbers.
• Product Attributes: Titles, active tags, vendors, product types, price points, and inventory stock counts.
• Tag Snapshots: Encrypted, point-in-time snapshots of product tag arrays captured immediately before a bulk operation to enable our 1-Click Rollback feature.

C. Operational & Diagnostic Logs

• Job execution IDs, timestamps, status logs (Pending, Completed, Failed), and mutation error reports required to ensure reliable batch execution and debugging.

3. How We Use Your Information

We process your information solely for the following legitimate business purposes:

• Executing Bulk Tag Operations: Performing merchant-requested ADD, REMOVE, and REPLACE tag operations via Shopify GraphQL Admin API mutations.
• Real-Time Catalog Automations: Listening to real-time products/update webhooks to automatically apply or remove tags according to the rules you define (e.g. low inventory alerts, price tier tags).
• 1-Click Rollback Safety: Restoring previous tag configurations when you request an undo action on the Job Execution Board.
• Subscription & Plan Management: Tracking active plan quotas (SKU batch sizes, active automation rules) and handling Shopify Billing API charges.
• Technical Support & Troubleshooting: Resolving technical inquiries submitted via our in-app support portal.

4. Data Sharing & Third-Party Service Providers

We never sell, rent, monetize, or trade your store or catalog data to data brokers, third-party marketers, or advertisers. We share information only with trusted cloud infrastructure providers strictly necessary to operate our service:

• Shopify Inc.: The host platform providing OAuth 2.0 authentication, GraphQL APIs, and billing infrastructure.
• Database & Queue Infrastructure: Managed PostgreSQL and Redis hosting with end-to-end encryption in transit (TLS 1.3) and at rest (AES-256) to maintain sessions and asynchronous BullMQ job queues.

5. Storefront & Theme Impact

6. Data Retention, Uninstallation & Erasure

A. Active Retention

We retain your store settings, automation rules, and tag snapshot history for as long as TagHorizon remains installed on your Shopify store. Tag snapshots are retained according to your plan tier (3 to 90 days) and automatically expire thereafter.

B. App Uninstallation

When you uninstall TagHorizon from your Shopify admin, Shopify sends an app/uninstalled webhook. Upon receipt, your store access tokens are immediately revoked and background automation workers are terminated.

C. Mandatory Shopify Privacy Webhooks (GDPR / CCPA)

We fully implement and respond to all mandatory Shopify compliance webhooks:

• customers/data_request: TagHorizon does not store customer personal records. We promptly verify and report that no customer data is held.
• customers/redact: Since no customer PII is collected or stored, no customer records exist to redact.
• shop/redact: Within 48 hours of receiving a shop redaction request from Shopify (and immediately via automated database cascading delete), all stored sessions, store configurations, support tickets, automation rules, and snapshot histories associated with your shop domain are permanently purged from our database.

7. Data Security

We implement industry-standard administrative, technical, and physical safeguards to protect your store data:

• All network communications utilize HTTPS with TLS 1.3 encryption.
• Database connections require SSL with secure connection pooling.
• Shopify API access tokens are encrypted and never exposed to client-side code.
• Strict access controls and automated dependency vulnerability audits are enforced.

8. Your Rights Under GDPR & CCPA/CPRA

Depending on your location, you and your store may have rights regarding your data under the General Data Protection Regulation (GDPR), California Consumer Privacy Act (CCPA/CPRA), or other applicable privacy laws, including:

• The right to access and receive a copy of your stored store metadata.
• The right to request rectification or correction of inaccurate information.
• The right to request complete deletion and erasure of your store records.
• The right to withdraw consent at any time by uninstalling the application.

9. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect operational, legal, or regulatory changes. When updates occur, we will revise the "Last Updated" date at the top of this page. Significant changes will be communicated via in-app notifications or email.

10. Contact Us & Data Protection Officer

If you have questions, feedback, or requests regarding this Privacy Policy or your store data, please contact our privacy and support team: