Privacy Policy — MTL-Product Like Analytics

Last updated: July 01, 2026

This Privacy Policy describes how MTL-Product Like Analytics (“the App”, “we”, “us”, “our”), developed by Moinul Tech Lab, collects, uses, and protects personal data when merchants install and use the App on their Shopify store, and when the merchant’s customers interact with the App’s features (such as the like button).

By installing MTL-Product Like Analytics, the merchant agrees to the practices described in this policy.

---

1. Who We Are

MTL-Product Like Analytics is a Shopify app that allows merchants to add a product “like” button to their storefront, track customer product preferences, view wishlist/like analytics, and send automated emails (such as price drop alerts and liked-but-not-purchased reminders) to customers who have opted in by liking a product.

2. Information We Collect

a) Information collected through Shopify’s APIs (merchant data)

When a merchant installs MTL-Product Like Analytics, we receive and store:

• Shop domain (e.g. yourstore.myshopify.com)
• Shop owner name and email (for account and billing communication)
• Access tokens required to interact with the Shopify Admin API
• Product data (titles, prices, IDs) needed to display like counts and analytics
• App subscription and billing plan information

b) Information collected directly from customers (storefront visitors)

When a customer interacts with the like button or related features on a merchant’s storefront, we may collect:

• Email address — collected only when a customer signs up to receive price drop alerts or liked-but-not-purchased emails
• Name — collected only when voluntarily provided alongside email sign-up, used to personalize automated emails
• Like activity — which products a customer has liked, and when
• Anonymous identifier — a randomly generated ID (stored via browser local storage) used to track likes for guest users who have not provided an email, with no personally identifying information attached

We do not collect payment information, passwords, or government ID numbers. Payment processing is handled entirely by Shopify.

3. How We Use the Information

We use the information described above only for the following purposes:

• Operating core app functionality (recording and displaying product likes)
• Generating analytics dashboards for merchants (e.g. most-liked products, like trends)
• Sending automated emails that the merchant has enabled and the customer has opted into, such as price drop alerts and reminder emails for liked-but-not-purchased products
• Billing and subscription management via Shopify’s Admin API
• Customer support and troubleshooting
• Security monitoring and fraud/abuse prevention

We do not use customer personal data for advertising, profiling, or any automated decision-making that produces legal or similarly significant effects on individuals.

4. Legal Basis for Processing

Where applicable (e.g. under GDPR), we process personal data on the following bases:

• Consent — for email collection and automated email communications, which require an explicit opt-in action from the customer
• Legitimate interest — for operating like-tracking functionality requested by the merchant
• Contractual necessity — for processing merchant account and billing data to provide the App

5. How We Share Information

We do not sell personal data, as defined under applicable privacy laws (including the CCPA/CPRA).

We share data only with the following categories of recipients:

• Shopify — as the platform operator, in accordance with Shopify’s own Privacy Policy
• Hosting/backend infrastructure — to store and process app data securely
• Brevo (SMTP email provider) — to deliver automated emails (price drop alerts, reminders) on our behalf

We do not share customer data with advertisers, data brokers, or any third party for marketing purposes unrelated to the App’s core functionality.

Each service provider is contractually limited to using data solely to provide services to us and is required to maintain appropriate security safeguards.

6. Data Retention

• Merchant data (shop domain, access tokens, billing info) is retained for as long as the App remains installed
• Customer like and email data is retained for as long as the merchant’s store uses the App
• Upon app uninstallation, we receive Shopify’s APP_UNINSTALLED webhook and begin deleting associated merchant and customer data in accordance with Shopify’s mandatory data retention timelines
• Server access logs are retained for 30 days for security and debugging purposes, then automatically purged

7. Customer Rights

Depending on your jurisdiction, you (the customer) may have rights to:

• Access the personal data we hold about you
• Correct inaccurate personal data
• Request deletion of your personal data
• Object to or restrict certain processing
• Withdraw consent for email communications at any time (via the unsubscribe link in every email we send)

To exercise these rights, contact the merchant whose store you interacted with, or contact us directly at sajibg7@gmail.com. We will respond within the timeframe required by applicable law.

We comply with Shopify’s mandatory GDPR webhooks:

• Customer data request — provides the merchant with the customer’s data we hold
• Customer redact — deletes a specific customer’s data upon request
• Shop redact — deletes all shop data 48 hours after uninstallation, in compliance with Shopify’s data redaction timeline

8. Data Security

We implement reasonable technical and organizational measures to protect personal data, including:

• Encrypted data transmission (HTTPS/TLS)
• Access to merchant and customer data restricted to the app owner only — no third-party or staff access
• Secure storage of access tokens, with expiring offline access tokens used to limit token lifespan
• HMAC verification on all webhook communications between Shopify and our backend
• Regular review of access logs for suspicious activity

In the event of a data breach, we will notify affected merchants within 72 hours of confirming the incident, in line with applicable breach notification laws.

9. International Data Transfers

Our backend infrastructure may process and store data outside the customer’s or merchant’s country of residence. Where required by law (such as under GDPR for transfers outside the EEA/UK), we ensure appropriate safeguards are in place, such as standard contractual clauses or equivalent protections.

10. Automated Decision-Making

MTL-Product Like Analytics does not use personal data for automated decision-making that produces legal or similarly significant effects on customers. Automated emails (price drop alerts, reminders) are triggered only by a customer’s own opt-in action and merchant-enabled settings — they do not involve profiling, scoring, or decisions that materially affect a customer.

11. Children’s Privacy

MTL-Product Like Analytics is not intended for use by children under 16. We do not knowingly collect personal data from children.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated to merchants via email or in-app notice. Continued use of the App after changes take effect constitutes acceptance of the updated policy.

13. Contact Us

For privacy-related questions, data requests, or concerns, contact: