Privacy Policy

MTO Discount Manager — Last updated: May 2026

1. Overview

MTO Discount Manager ("the App") is a Shopify discount management app developed by MTO Management. This policy explains what data the App collects, how it is used, and how it is protected.

2. Data We Collect

The App collects and stores the following information from the merchant's Shopify store:

• Shop domain — used to associate discount rules with the correct store.
• OAuth session tokens — used to authenticate API requests to Shopify on behalf of the merchant.
• Discount rules and tiers — configuration data entered by the merchant (rule names, discount values, targeting settings, scheduling, customer tags). No personally identifiable information about end customers is stored.
• App install record — records when the app was installed on a store.
• Order-level discount analytics — to report how the merchant's discounts perform, the App records, for orders placed since launch, the Shopify order ID, the order total, and the discount amount attributed to each rule. This data is stored only as aggregate statistics (per rule and per day) and is used to power the App's analytics dashboard. No customer personally identifiable information (names, email addresses, phone numbers, or shipping/billing addresses) is collected or stored alongside it.

The App does not collect, store, or process personally identifiable customer data (names, emails, addresses, payment details). The only order data retained is the aggregate analytics described above.

3. How We Use Your Data

Collected data is used solely to operate the App:

• Authenticate and authorize Shopify API calls.
• Store discount rule configuration so rules persist across sessions.
• Sync discount rules to Shopify metafields so the discount Function can read them at checkout.

4. Data Sharing

We do not sell, rent, or share merchant data with third parties. Data is processed exclusively within the App's infrastructure (hosted on Fly.io, Amsterdam (ams) region) and Shopify's platform.

5. Data Retention

All merchant data (discount rules, sessions, install records) is deleted within 48 hours of the App being uninstalled, in response to a shop/redact GDPR compliance webhook from Shopify.

6. Security

All data is transmitted over HTTPS. Database credentials and API secrets are stored as environment secrets and are never exposed in source code.

7. Your Rights (GDPR)

Merchants who have uninstalled the App may request deletion of any remaining data by emailing support@mtomanagement.com. Requests are processed within 30 days.

8. Contact

For any privacy-related questions, contact:
MTO Management
support@mtomanagement.com