Privacy Policy
Last updated: October 6, 2026
PriceMaestro ("we", "us", "our") is a Shopify application operated by Tatemono. This Privacy Policy explains how we collect, use, and protect information when you use PriceMaestro (the "Service").
1. Information We Collect
1.1 Shopify Store Data
When you install PriceMaestro, we access the following data from your Shopify store through Shopify's API. The exact permissions are listed on Shopify's approval screen before you install.
- Product data: Product titles, variants, SKUs, prices, compare-at prices, inventory quantities, collections, and vendor information.
- Market data: Market configurations, currencies, country assignments, price lists, and contextual pricing.
- Order data (aggregated): We access order line items (product/variant IDs, quantities, amounts) and shipping destination country codes to analyze sales performance by market. We do not store customer names, email addresses, phone numbers, or full addresses.
- Sales channels: The identifiers and names of your sales channels, used for catalog pricing.
- Shop information: Store name, email, domain, currency, timezone, and Shopify plan.
1.2 User Identity
We collect the first name, last name, and email address of Shopify staff members who log into PriceMaestro. This is used for:
- Displaying who published price changes (audit trail)
- Role-based access control (owner, admin, editor, viewer)
- Sending email notifications (publication confirmations, promotion alerts, weekly digest)
1.3 Data We Do NOT Collect
- Customer personal information (names, emails, phone numbers, full addresses)
- Payment or financial account information
- Browsing behavior or tracking cookies
- Data from other Shopify apps
2. How We Use Your Data
| Data |
Purpose |
Retention |
| Product prices & variants |
Display and edit prices across markets |
Cached up to 5 minutes |
| Price change history |
Audit trail, undo capability, price evolution charts |
Two years for every store, whatever the subscription status; deleted on uninstall + 48h |
| Order line items + shipping country |
Product classification by sales, revenue by market analysis |
Daily totals per product, market and day, kept 1 year. Orders themselves are not stored |
| Staff identity (name, email) |
Audit trail, roles, email notifications |
Until app uninstall + 48h |
| Shop configuration |
App functionality (currency, timezone, markets) |
Until app uninstall + 48h |
| AI assistant connections (which assistant, for which staff member, what it may do, when it was last used; its access codes stored only as one-way hashes) |
Let a staff member's own Claude or ChatGPT read the store and prepare drafts, and take that access away |
Until disconnected; deleted on uninstall + 48h |
3. Data Storage & Security
- Infrastructure: Data is stored on Hetzner Cloud servers in the EU (Germany), in a PostgreSQL database with a Redis cache.
- Encryption: All data in transit is encrypted via TLS/HTTPS. Shopify access tokens are encrypted at rest using AES-256-GCM.
- Access control: Each store's data is isolated from every other store's. Database access is restricted to the application and to the operator of the Service for maintenance and support. The application enforces role-based access control for all operations.
4. Data Sharing
We do not sell, rent, or share your data with third parties, except:
- Shopify: We read from and write to your Shopify store via Shopify's API (price updates, product data).
- Resend: Email notifications are sent via Resend (resend.com). Only staff email addresses are shared for delivery purposes.
- Sentry: Error reports (technical details of the error, the store, and the signed-in staff member) are sent to Sentry for application reliability. They contain no shopper data.
- Mistral AI (France), only if a staff member uses the built-in assistant: the question typed and the store data the assistant reads to answer it (products, prices, costs, margins, history, promotions) are sent to Mistral AI to write the answer. No shopper data, email address or access token is sent. The daily checks and the Monday email make no such call.
- Your own AI assistant, only if you connect one: a staff member can connect their own Claude (Anthropic) or ChatGPT (OpenAI) on the Account page, after a consent screen. The assistant then receives what it asks PriceMaestro for, on that staff member's behalf: products, variants and SKUs, prices and crossed-out prices in every market, sourcing costs and margins, minimum margins, price history and publications with the names of the staff members who made them, promotions, alerts, exchange rates, and the drafts it prepares. It receives no shopper data, no email address and no access token. What it receives is processed by Anthropic or OpenAI under that staff member's own account and their terms, not by us. Disconnecting on the Account page stops it at once.
We do not use any advertising, analytics, or tracking services that access your store data.
5. Data Retention & Deletion
- Active use: Data is retained while the app is installed.
- After uninstall: Your data is preserved for 48 hours to allow reinstallation without data loss. After 48 hours, Shopify sends a mandatory data erasure webhook and all data is permanently deleted, including: price history, publications, promotions, sourcing costs, sales data, AI assistant connections, user records, and shop configuration.
- Subscription expiry: If your subscription ends, your data is retained and the app becomes read-only. We stop reading your prices and orders. The weekly email keeps going to team members who have not unsubscribed. Data is only deleted on uninstall.
6. GDPR Compliance
We comply with Shopify's mandatory GDPR webhooks:
- Customer data request: We respond to data access requests. Since we do not store customer personal data, responses confirm no data is held.
- Customer data erasure: We respond to erasure requests. Since we do not store customer personal data, no deletion is required.
- Shop data erasure: All shop data is permanently deleted within 48 hours of app uninstall.
7. Your Rights
As a merchant using PriceMaestro, you can:
- Access your data: Your history, publications and settings are visible in the app.
- Export your data: Use the CSV export to download your prices, history and costs at any time, including after your subscription ends.
- Delete your data: Uninstall the app — all data is permanently deleted after 48 hours.
- Manage notifications: Configure email notification preferences per user on the Account page, or use the unsubscribe link in any email.
- Control access: Manage team member roles (owner, admin, editor, viewer) on the Account page.
8. Cookies
PriceMaestro uses a single HTTP-only session cookie (shopify_session) for authentication. This cookie:
- Contains an encrypted session identifier (shop ID, user role)
- Is set with
Secure and SameSite=Lax flags
- Expires after 14 days
- Is not used for tracking or analytics
Short-lived technical cookies are also set while you sign in through Shopify, and removed afterwards. We do not use any third-party cookies, tracking pixels, or analytics scripts.
9. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated via email to store administrators. The "Last updated" date at the top of this page indicates when this policy was last revised.
10. Contact
For privacy-related questions or concerns: