1. Overview & Data Roles (Controller vs. Processor)

PGS TECH LIMITED ("Company", "we", "us", or "our") operates the GP Translate software application for Shopify merchants worldwide. We are committed to robust privacy governance while maintaining clear regulatory boundaries regarding data responsibility.

Under applicable data protection frameworks (including the EU/UK General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA/CPRA)), the Merchant acts as the Sole Data Controller regarding their store content and storefront visitor data. PGS TECH LIMITED acts strictly as a Data Processor (or Service Provider). By installing GP Translate, the Merchant instructs us to process data solely to execute automated storefront localization and currency switching on their behalf.

2. Information We Process & Data Minimization

GP Translate strictly adheres to the principle of data minimization. We only access and process information strictly required to perform translation and currency functions:

• Merchant Store Account Data: Myshopify domain name, store primary language, authorized contact email, and subscription tier metadata authorized via official Shopify OAuth handshake.
• Store Content for Machine Translation: Product titles, descriptions, collection details, blog posts, pages, navigation menus, and theme strings submitted by the merchant for translation via Shopify GraphQL Admin APIs.
• Transient Geolocation Data: Storefront visitor IP addresses are evaluated strictly in-memory and in real time solely to detect geographic location for currency/language recommendations. Visitor IP addresses are neither persisted to disk nor used to build behavioral profiles.
• Excluded Sensitive Data: We do NOT collect, process, or store credit card credentials, customer passwords, government IDs, bank details, or shopper checkout payment information.

3. Purposes & Legal Basis for Processing

All data processing activities are conducted strictly pursuant to the Merchant’s operational instructions under the following legal bases:

• Contractual Performance: To translate store copy, execute glossary replacements, and publish translated strings directly into the merchant’s Shopify multi-language architecture.
• Real-Time Currency Conversion: To query current foreign exchange indices and display converted prices and currency symbols on live storefront themes.
• Technical Support & Debugging: To diagnose liquid template compatibility, switcher layout issues, and translation synchronization queues requested by the merchant.
• Shopify Partner Compliance: To maintain strict fidelity with Shopify App Store requirements, mandatory webhook subscriptions, and platform security standards.

4. AI & Third-Party BYOK (Bring Your Own Key) Processing

GP Translate incorporates an optional Bring-Your-Own-Key (BYOK) framework allowing direct communication with major AI model providers (including OpenAI, Google Gemini, DeepSeek, and DeepL):

• Direct Merchant Authorization: When configuring a BYOK API key, the Merchant explicitly directs and authorizes GP Translate to transmit requested store texts to the chosen AI provider’s official commercial endpoints on the merchant’s behalf.
• Zero AI Training: Merchant API requests routed to enterprise commercial endpoints are governed by enterprise commercial terms prohibiting AI providers from utilizing transmitted merchant strings or prompts for model training.
• Encryption at Rest: Merchant-provided API keys are encrypted in our datastores using AES-256 encryption. Keys are never logged in plaintext or shared with other merchants.
• Third-Party Liability Exclusion: PGS TECH LIMITED exercises no control over third-party AI service continuity, server uptime, content safety filters, or API modifications. The Merchant bears sole responsibility for monitoring their AI provider quotas, costs, and terms.

5. Security Protocols, Retention & Automated Purging

We maintain industry-standard administrative, physical, and technical safeguards. All data in transit is encrypted using modern TLS 1.3 cryptographic protocols.

Immediate Webhook Deletion: Upon receiving an official Shopify app/uninstalled webhook, our automated systems instantly revoke session credentials and schedule permanent deletion of all stored API keys, glossaries, and cached records within forty-eight (48) hours.

Shopify Mandatory Privacy Webhooks: We fully automate compliance with Shopify mandatory privacy endpoints: customers/data_request, customers/redact, and shop/redact to guarantee prompt data erasure across all jurisdictions.

6. Merchant Legal Obligations & Global Privacy Compliance

Because the Merchant is the legal Data Controller of storefront end-user data, the Merchant expressly warrants and covenants that:

• The Merchant maintains a comprehensive, legally compliant storefront privacy policy informing shoppers about language selection cookies, currency detection, and automated translation practices.
• The Merchant has acquired all required user consents and cookie permissions under GDPR, ePrivacy Directive, CCPA/CPRA, and relevant local jurisdictions prior to deploying storefront tracking.
• The Merchant shall promptly forward and handle any data subject rights (access, correction, erasure) requested by their store shoppers.

7. Limitation of Security Liability, Amendments & Contact

No Guarantee of Absolute Infallibility: While we implement robust commercially reasonable protections, no electronic transmission or cloud repository is invulnerable. To the fullest extent permitted by law, PGS TECH LIMITED shall not be held liable for unauthorized access or security breaches resulting from events beyond our reasonable control, zero-day vulnerabilities, or merchant credential compromises.

Policy Updates: We reserve the right to revise this Privacy Policy periodically to reflect technological or legal enhancements. Merchants are advised to review this policy periodically.

Data Protection Inquiries: Direct all privacy compliance correspondence to our designated compliance officer:

• Entity: PGS TECH LIMITED (GrayPoplar)
• Direct Email: [email protected]
• Instant Support: +86 13135652957
• Governing Jurisdiction: Hong Kong Special Administrative Region (HKSAR)