Overview
Who we are
Cyberify Google Shopping Feed ("the App", "we", "our", "us") is a Shopify embedded application developed and operated by Cyberify. The app is available at cyberify.net and is distributed through the Shopify App Store.
We built Cyberify Google Shopping Feed to help Shopify merchants automatically sync their product catalog to Google Merchant Center so their products can appear in Google Shopping ads and free listings.
This Privacy Policy explains what data we collect, why we collect it, how we store and protect it, and how you can request deletion. We aim to keep this policy clear, transparent, and free from unnecessary legal jargon.
Legal basis for processing (GDPR).
We process your data under the following legal bases:
- Contractual necessity — to provide the app's core functionality, including product feed syncing and feed management.
- Legitimate interests — to improve reliability, monitor sync performance, detect errors, and maintain platform security.
- Consent — where required, such as when you connect your Google account using OAuth.
Roles & responsibilities.
For data protection purposes:
- You (the merchant) are the Data Controller of your store data.
- Cyberify acts as the Data Processor, processing your data only to provide the app's services on your behalf.
What we collect and why.
01 Shopify store information
We collect: shop domain (e.g. yourstore.myshopify.com), Shopify access token, installation date, store currency and timezone.
Why: to identify your store, connect securely to the Shopify Admin API, read and sync product data, and manage installation status.
02 Product & catalog data
We collect:
- Product titles, descriptions, prices, images, SKUs
- Variants, inventory levels, collections, availability
- SEO titles and descriptions (if used)
- Product sync status (approved, disapproved, pending, errors)
Why: to build your Google Shopping product feed, maintain real-time synchronisation, improve feed health reporting, and help resolve product approval issues.
We store a local copy of your product catalog to enable faster syncing, feed monitoring, and error diagnostics.
Important. We do not sell or share your product data with third parties except with Google Merchant Center as part of feed submission.
03 Google account & Merchant Center data
We collect: Google OAuth access token, OAuth refresh token, Merchant Center ID, and token expiry timestamp.
Why: to connect your Google account securely, submit and manage your product feed inside Google Merchant Center, and refresh access automatically to prevent sync interruptions.
We only request the Google Content API permission required for managing product listings.
We do not access Gmail, Google Drive, Google Calendar, Google Ads, or any unrelated Google services. We do not use Google data for advertising, profiling, or any purpose unrelated to feed synchronisation.
04 Feed configuration & settings
We collect: target country, language, currency, sync frequency, product scope, variant settings, product ID format preferences, custom feed rules, attribute mappings, and notification email address (if provided).
Why: to generate the correct feed structure for each market and maintain country-specific listings.
05 Sync logs & activity data
We collect: sync timestamps, number of synced products, sync duration, Google API errors, feed health reports, and approved/disapproved product counts.
Why: to populate your dashboard, detect failures quickly, improve reliability, and provide technical support.
06 Data we do not collect
- Customer names, emails, or orders
- Payment, banking, or credit-card information
- Sensitive personal information
We do not use advertising cookies or tracking pixels. We may use minimal technical tools such as error monitoring services strictly for performance, diagnostics, and service reliability.
How we store and protect your data.
| Data type | Storage | Protection | Retention |
|---|---|---|---|
| Shopify access token | PostgreSQL (Neon · US East) | AES-256 at rest | Until uninstall |
| Google OAuth tokens | PostgreSQL (Neon · US East) | AES-256 at rest | Until disconnect or uninstall |
| Product catalog | PostgreSQL (Neon · US East) | TLS in transit | Until uninstall + 48 hrs |
| Sync logs | PostgreSQL (Neon · US East) | TLS in transit | 90-day rolling |
| Feed configuration | PostgreSQL (Neon · US East) | TLS in transit | Until uninstall |
Security measures
- HTTPS (TLS 1.2+) for all communication
- AES-256 encryption for all OAuth tokens
- Secure server infrastructure hosted on Amazon Web Services
- Firewall-restricted access — only required ports are public
- No logging of tokens, passwords, or sensitive credentials
- Restricted database and infrastructure access for authorised Cyberify personnel only
Key handling. Encryption keys are never stored inside the database.
International data transfers
Your data may be processed in countries outside your own, including the United States and the European Union, where our infrastructure providers operate. We ensure appropriate safeguards are in place, including encryption, secure infrastructure, and standard contractual protections where required by law.
Third-party services.
| Service | Purpose | Data shared |
|---|---|---|
| Google Merchant Center API | Submit product feed | Titles, descriptions, prices, images, SKUs, availability |
| Shopify Admin API | Read products and collections | Product and collection data |
| Neon PostgreSQL | Database hosting | Stored app data |
| AWS EC2 | Application hosting | Application traffic |
| Sentry | Error monitoring | Anonymised error stack traces |
| Resend | Transactional emails | Notification email address |
We do not sell, rent, or trade your data for advertising or marketing purposes.
Service dependency disclaimer
Cyberify Google Shopping Feed depends on third-party services including Shopify and Google Merchant Center. We are not responsible for service interruptions, API limitations, delays, suspensions, or data issues caused by these third-party platforms.
GDPR & Shopify compliance.
We fully comply with Shopify's required GDPR webhooks.
Customer data request
If a customer submits a data request, we identify and return any matching records. Since Cyberify Google Shopping Feed does not collect customer personal data, our response will normally confirm that no customer data is stored.
Customer data erasure
If a customer requests deletion, we permanently delete any matching records within 30 days.
Shop data erasure
When a Shopify store is deleted or permanently closes, we permanently delete all associated store data within 48 hours. This includes products, tokens, feed settings, logs, and configuration data.
Your rights as a merchant.
You have the right to:
- Access — request a copy of all data we hold about your store.
- Correction — ask us to correct inaccurate or incomplete information.
- Deletion — request permanent deletion of your store data.
- Portability — request your data in a machine-readable format such as JSON or CSV.
- Disconnect Google — disconnect your Google account at any time inside the app, immediately revoking our access and deleting stored OAuth tokens.
To exercise any of these rights, contact info@cyberify.net. We respond within 5 business days.
Data retention & deletion.
- Uninstalling the app triggers automatic deletion within 48 hours.
- Disconnecting Google removes OAuth tokens immediately.
- Sync logs are automatically deleted after 90 days.
- Database backups are retained for 7 days before permanent deletion.
Children's privacy.
This app is intended for business use by merchants and store operators. It is not intended for individuals under the age of 18, and we do not knowingly collect personal data from children.
Changes to this policy.
If we make material changes to this Privacy Policy, we will update the "Last Updated" date at the top of this page. For significant changes, we may also notify you by:
- Email to your Shopify store contact address
- In-app notification inside Cyberify Google Shopping Feed
Continued use of the app after updates are posted constitutes acceptance of the updated policy.
Questions about your data?
If you have any questions about this Privacy Policy or wish to exercise your data rights, get in touch — we respond within five business days.