Privacy Policy

1. Scope and responsibilities

This Privacy Policy explains how ComplyCat (“ComplyCat”, “we”, “us” or “our”) handles information when you browse complycat.cc, contact us, request updates, create an account, connect a store or use Price Transparency, Dark Pattern Audit, Grievance Desk or related services.

For account administration, business contacts and operation of our own website and services, we determine the relevant processing purposes where the law treats us as a controller or data fiduciary. For merchant-provided buyer or complaint data handled on a merchant’s behalf, our role and instructions depend on the applicable service, agreement and law. Merchants remain responsible for their own customer notices and lawful instructions.

This policy is supplemented by Data Controls and any applicable written data-processing terms. It does not itself grant access to a store or authorize a data use that otherwise requires permission.

2. Account, business and technical information

We may process your name, email address, role, organization, store or account identifiers, authorized-user details, billing contact information, plan or charge references and support communications.

Technical information can include IP address, browser and device details, service interactions, logs, diagnostics, security signals and approximate location inferred from technical information. The categories collected depend on the website or app configuration and features in use.

An early-access request asks for your store URL, email address and phone number, and identifies the app you selected. When you submit, the request also includes its timestamp, the submitting page URL and path, referring page, and any UTM campaign parameters or advertising click identifiers present on that page.

Please avoid sending passwords, complete payment-card details or unnecessary sensitive information in a support enquiry, prompt or complaint attachment.

3. Information relevant to each app

Price Transparency: store metadata, product and variant identifiers, catalog and offer context, prices and comparison values, market or currency context, timestamps, historical imports, campaign references, disclosure settings and related records.

Dark Pattern Audit: authorized storefront URLs and content, screenshots, shopping-journey observations, relevant theme or app configuration signals, review findings, reviewer notes, remediation records, audit reports and certificate-related records. Scope can differ for public pages and authorized restricted journeys.

Grievance Desk: customer contact details included in a grievance, complaint text, attachments, order, shipping, payment-status or refund context, recorded complaint copies, correspondence, assignments, deadlines, resolution history and NCH case references where provided or lawfully connected.

Not every app needs every category. Processing is limited by enabled features, available integrations, permissions and lawful instructions. A screenshot or attachment may contain personal information even when its primary purpose is an audit or operational record; provide only the context needed for the task.

4. Where information comes from

Information may come directly from you, your organization and authorized users, Shopify or other integrations you connect, customer records you lawfully provide, service providers, and technical interactions with our website and apps.

An NCH case reference or record may be supplied through an authorized merchant workflow. This policy does not establish a public NCH API connection or bypass official registration and access requirements.

5. How information is used

We use information to administer accounts, authenticate users, connect authorized systems, provide pricing records and disclosures, organize storefront review evidence, support grievance handling, generate enabled outputs, maintain records, provide support, manage billing and send necessary service notices.

We also use appropriate information to diagnose faults, understand feature usage, improve reliability and quality, prevent abuse, protect security, investigate disputes, enforce agreements and comply with legal obligations. Marketing communications are sent only where permitted and can be opted out of.

Where a legal basis is required, we rely on the applicable basis for the activity, such as performance of an agreement, your or the merchant’s valid instructions, consent where required, legal obligations or a permitted legitimate interest. A processing basis used in one jurisdiction is not assumed to apply identically everywhere.

6. AI-assisted processing and improvement

When you use an AI-enabled feature, relevant prompts, selected store context, screenshots, findings, complaint material, correspondence or feedback may be processed to generate a summary, explanation, classification, recommendation or response draft. Third-party AI or cloud providers may process that context on our behalf as service providers or processors under the applicable arrangements.

Provide only relevant context and limit unnecessary personal information. Review output before operational use. Contact us about the controls available for a particular app, agreement or data category rather than assuming that all providers or features use identical retention or processing settings.

We may use aggregated, de-identified or otherwise privacy-preserving information to evaluate and improve the services. We do not sell personal data. This policy does not grant an unrestricted right to use merchant customer information for unrelated model training or other purposes outside the applicable permissions and processing terms.

7. Service providers and other disclosures

We may use providers for hosting and storage, operational monitoring, analytics where enabled, support, security, payments and AI infrastructure. Information is shared as appropriate to their role in providing the service, under applicable protections. Professional advisors and affiliates, if any, may receive information where necessary and lawful.

Early-access submissions are sent to a Google Apps Script web application for recording in a Google Sheet used for lead handling. After you submit, an ipapi.co lookup is used to obtain your IP-based approximate country and city. That lookup provider receives routine network information needed to answer the request; returned location fields are included in the early-access submission when available. If the lookup fails, the form continues with blank location fields.

We may disclose information where required or permitted by law, valid legal process, protection of safety or rights, security investigations, or a merger, acquisition, financing, reorganization or transfer of relevant business assets, subject to applicable requirements.

For information about providers relevant to your app or a processing arrangement, contact [email protected]. Shopify and independently used third-party services may process information under their own notices and terms.

8. Cookies, storage and the marketing website

Cookies or similar technologies may support authentication, security, preferences and app operation. Analytics or marketing technologies, where enabled, are subject to the notices, choices and consent requirements applicable to that use. Browser settings and available service controls can manage some storage; restricting necessary storage may affect functionality.

The marketing website serves fonts locally and uses Cloudflare Web Analytics for page-view and page-performance reporting. Cloudflare’s browser beacon measures performance using the browser Performance API. The current configuration includes no advertising pixels. Website hosting may also process routine request information for delivery and security.

The Cloudflare analytics beacon may load when a page is visited. This is separate from the early-access form’s IP-location lookup, which runs only after a valid submission—not merely when a page loads or the form opens. If that optional lookup fails or times out, the form continues with blank location fields.

Cloudflare describes its Web Analytics service as privacy-first and states that it does not track individual users across customer websites. See Cloudflare’s data-collection documentation for the service’s current behavior.

Campaign fields include utm_source, utm_medium, utm_campaign, utm_term, utm_content, gclid, fbclid and msclkid when present in the submitting page URL. The form reads them for that submission without adding tracking cookies or persistent attribution storage. IP-derived country is approximate visitor-location metadata, not verified evidence of your store’s country or precise device location.

Submitting the form requests email updates about the selected app. It is not a separate opt-in to marketing calls or text-message campaigns. If the web request cannot be confirmed, a draft addressed to [email protected] may be opened in your email application; you choose whether to send it. Your email provider then handles that message under its own terms.

9. International processing

Information may be stored or processed in countries other than where you or your business are located, including where service providers operate. Data-protection rules may differ between countries.

Where required, appropriate contractual, organizational or other lawful transfer safeguards are used. We do not promise a particular hosting region or data-localization arrangement unless it is expressly agreed for the relevant service.

10. Retention, deletion and account closure

We retain information for the purposes for which it is needed, including providing the service, maintaining relevant pricing, audit or complaint records, supporting the account, complying with law, resolving disputes and protecting security. Retention depends on data type, authorized configuration, contractual or legal requirements, account status and operational or backup needs.

When information is no longer needed, it is deleted, anonymized or de-identified as appropriate. Verified deletion requests and valid Shopify data requests are handled subject to applicable law and platform requirements. Uninstalling or disconnecting an app stops the corresponding authorized connection as supported by the platform, but does not necessarily erase every already-retained billing, security, backup or other lawful record instantly.

Any retention exception is limited to a legitimate and legally permitted purpose; it does not override a mandatory erasure obligation. See Data Controls for requesting deletion or export and for the distinction between source-system data and retained app records.

11. Security and access

We use reasonable technical and organizational measures designed to protect information, which may include access controls, encryption, logging, monitoring and provider review appropriate to the service. No internet-based system can promise absolute security.

Protect your credentials and devices, assign appropriate Shopify and app permissions, and keep customer information out of unnecessary prompts or support channels. Contact us if you believe access or information has been compromised.

12. Privacy rights and requests

Depending on your location, role and applicable law, you may have rights to access, correct, delete, obtain a copy of, restrict or object to processing of personal information, withdraw consent, or exercise other applicable privacy choices. The scope of these rights can depend on whether the request concerns your account, a business-managed workspace or a merchant’s buyer.

Send requests to [email protected]. We may verify identity and authority and coordinate with the relevant merchant or administrator. A Shopify buyer should normally direct an order or customer-data request to the merchant, with ComplyCat assisting where it processes the relevant information on that merchant’s behalf.

We respond within the time required by applicable law and explain any lawful limitation where required. You may also have a right to complain to an appropriate supervisory or regulatory authority. A service contact process does not remove that right.

13. Children and communications

The services are intended for business use and are not directed to children. Do not intentionally provide children’s information unless it is necessary for an authorized feature and you have the authority and safeguards required by applicable law. Contact us if you believe children’s information has been handled improperly.

You can opt out of marketing communications using an available unsubscribe mechanism or by contacting us. Necessary service, security, billing and transactional messages may continue where appropriate.

14. Updates and contact

We may update this policy to reflect changes in the services, practices or legal requirements. The revised date will appear on this page; material changes will be communicated as required through an appropriate notice. An update does not remove existing mandatory privacy rights.

Operator: ComplyCat. Privacy, support and legal enquiries: [email protected]. Also see our Terms of Service and Data Controls.