Privacy Policy / Política de privacidad

MegaFiles — Order & Product Documents (the "App"), operated by ecomm360, lets Shopify merchants and their customers exchange documents attached to orders, products and customer accounts. This policy explains what data the App accesses, why, and how it is protected. / Esta política explica qué datos usa la App, para qué y cómo se protegen.

1. Data we access / Datos que usamos

To attach documents to the right order, product or customer, the App accesses, via the Shopify Admin API:

• Orders: to verify that an order belongs to the customer requesting or sending a document, and to link documents to orders and order lines.
• Customers — Shopify id only (and email only if the merchant enables email notifications): to show each customer exclusively their own documents. We do not access phone, address or payment data.
• Products and collections: to attach public product documentation and to restrict which products accept documents.
• Shopify Files: the store's own library, where every document is stored.
• Theme templates (read-only): only to tell the merchant whether the App's blocks are enabled.

2. How we use it / Uso

Data is used solely to deliver the App's document functionality to the merchant. We do not sell, rent or share personal data with third parties, and we do not use it for advertising or profiling. / Los datos se usan únicamente para la funcionalidad documental de la App. No se venden, alquilan ni comparten con terceros, ni se usan para publicidad o perfilado.

3. Data we store / Datos que almacenamos

The App stores document metadata (file name, description, type, visibility), the Shopify identifiers (order, product, customer ids) needed to link each document to its owner, the merchant's settings and an activity log (who did what, without personal data). The files themselves live in Shopify Files, the store's own library, encrypted by Shopify — our servers only stream them through and scan them (antivirus and content inspection) before accepting them. We do not store customer names, emails, addresses or payment data in our database. / Los ficheros viven en Shopify Files, la biblioteca de la propia tienda; nuestra base de datos solo guarda metadatos e identificadores.

4. Retention & deletion / Conservación y borrado

We honor Shopify's mandatory privacy webhooks with real logic: customers/data_request produces a downloadable export for the merchant; customers/redact deletes that customer's files and metadata; shop/redact deletes all store data approximately 48 hours after uninstall. Files attached in carts that never become orders are deleted automatically after the merchant-configured period. The activity log is kept for 365 days.

5. Sub-processors / Subencargados

• Shopify — hosting of store data, file storage (Shopify Files) and the Admin API.
• ecomm360 hosting — application server and metadata database (EU-based).

6. Security / Seguridad

Data in transit is encrypted (HTTPS); files are encrypted at rest by Shopify Files; every uploaded file is scanned (antivirus and content inspection) before being accepted; storefront endpoints are signed, rate-limited and replay-protected; optional private downloads require the customer's session; logs are scrubbed of tokens and personal data; access to production data is restricted to authorized ecomm360 staff.

7. Your rights / Tus derechos

Merchants and their customers may request access to or deletion of personal data under GDPR and applicable laws. Requests are handled through Shopify's data-request flow or by contacting us directly; end customers should address requests to the merchant of the store where they purchased, who is the data controller.

8. Contact / Contacto

ecomm360 — sat@ecommsistema.com · www.ecomm360.es

Last updated / Última actualización: 03-09-2026