Privacy Policy — Magezon Mega Menu

Effective date: 2026-10-20 App: Magezon Mega Menu (the "App") Provider: Magezon, 15 Pham Hung road, My Dinh 2 ward, Nam Tu Liem district, Ha Noi, Viet Nam ("we", "us") Contact: support@magezon.com

This Privacy Policy explains what data the App accesses and stores, why, and the rights you and your customers have. It applies to merchants who install the App on their Shopify store.

1. Summary

The App builds your store's navigation menus. The menus you create are stored in your own Shopify store, not in our database — and never your customers' personal data.
The App accesses your store's data through the Shopify Admin API only to save and publish the menus you build, and to read the products, collections and pages they link to. Publishing a menu uploads its stylesheet and the icon fonts it uses to your store's Files.
On our servers we keep your access token, how you organise files in the File Manager, and per-item menu click counts for the Insights report — never who clicked.
The App does not sell data, and does not set third-party tracking cookies on your storefront.
When you uninstall, all data the App holds for your store is erased.

2. What Mega Menu stores, and where

We authenticate with Shopify session tokens — we use no third-party cookies and no browser storage for authentication.
Your store domain and the Shopify access token you granted at install.
How you organise files in the app’s File Manager — folder names, boards, tags and their history. Kept per store and erased when you uninstall or ask us to erase your data. The files themselves stay in your own store’s Files.
Menu click counts for the Insights report — per menu item and per day, how many times it was clicked, and the item’s visible text. No shopper is identified: a click records which item, not who clicked it. Kept per store and erased when you uninstall or ask us to erase your data.
Nothing else. Your menus themselves live in your own store, in app-reserved metaobjects — we keep no copy of them.

3. Data we do NOT collect

We do not collect, store, or process your storefront customers' personal data. A menu is navigation: it renders links you authored, and reads nothing about whoever is looking at it.
We do not access order, payment, or customer records except where a feature you enable requires it and says so first.
We do not sell or rent any data.

3a. Your customers' rights, honored automatically

We implement Shopify's three mandatory privacy webhooks, each verified with an HMAC signature:

customers/data_request — we hold no personal data about your storefront customers, so we confirm that none is held for the requested person.
customers/redact — same: we confirm there is none to erase.
shop/redact — we erase everything the App holds for your store, which is the stored access token, how you organised files in the File Manager (folder names, boards, tags, history) and the menu click counts behind Insights; your menus are stored in your own store rather than on our servers, so we hold no copy of them to erase. Runs automatically ~48 hours after uninstall.

Each handler returns a machine-readable record of what it erased, and that record is what our own verification asserts on — not merely the HTTP status.

4. Sub-processors

Sub-processor	Purpose
Shopify Inc.	Platform, Admin/Storefront API, hosting the menus you publish
Fly.io, Inc.	Hosting the App and its database — access token, File Manager organisation, menu click counts (United States, region `iad`)
HubSpot, Inc.	In-app support chat — the message you send us, and, when you open the chat, your store's contact email address, so we can see which store is asking and reply in the right place. HubSpot keeps a support contact record against that address
Functional Software, Inc. (Sentry)	Error reports from the editor — the error message, where in our code it happened, your browser details, and an identifier of the install it came from

The editor reports its own errors to Sentry so we can find and fix them. The App sends no product-analytics data to any third party.

A current sub-processor list is available on request at support@magezon.com.

6. Data retention

Your saved menus live in your own store, so retention is yours: they last as long as you keep them, and are removed with the App.
On our servers we retain your store's access token, your File Manager organisation and the menu click counts, for as long as the App is installed. When you uninstall we erase them, and again when Shopify sends shop/redact.

7. Security

All data in transit is encrypted with TLS.
Webhook and OAuth authenticity is verified with constant-time HMAC-SHA256.
Access to your store's Admin API is limited to the scopes the App requests and you approve.

8. Changes

We may update this policy. Material changes will be notified in-app and/or by email to the store owner. The "Effective date" above reflects the latest version.

9. Contact

Magezon, 15 Pham Hung road, My Dinh 2 ward, Nam Tu Liem district, Ha Noi, Viet Nam, support@magezon.com.