Privacy Policy

Key data protection commitments

We use the Shopify Partner API only for read queries. We do not run mutations that change Shopify data, change or cancel app subscriptions, or issue credits. The required API permissions also allow some writes, so the token itself is not read-only.

Partner API tokens are stored encrypted and separated by organization. We use them only to provide the Service.

Imported data, aggregates and derived data are used only to provide the Service, including display and analysis for the developer and organization members they authorize. We do not sell them or use them for advertising, competitive comparisons with other customers, or AI model training or improvement. Necessary processors, integrations you configure and legally required disclosures are explained below.

We do not obtain order details or card information belonging to the shops’ shoppers. Stripe handles payment for App Rings itself; we do not store full card numbers, expiry dates or security codes.

MCP tools and API endpoints automatically receive aggregated data and context needed to understand it, such as dates, app and plan names, and metric definitions. Shop names and shop domains are excluded. They only read aggregates already stored in App Rings: calls never query the Shopify Partner API, never expose your Partner API token and cannot change data. Separately, AI chat sends your questions, part of the conversation and attachments to your selected AI provider. Information you put in those inputs is transmitted.

When you disconnect an organization, we immediately stop access to that organization and delete its stored Partner API token. We start deleting imported data, aggregates and other organization data in stages; completion may take time. Minimal records to prevent repeated free periods and legally required records remain. This differs from cancelling a paid subscription at period end or disconnecting an individual integration. See the retention and deletion section below.

1. Our approach and who we are

We handle information about App Rings users, and information users entrust to us, in accordance with Japan’s Act on the Protection of Personal Information and other applicable laws. This policy governs App Rings; advertising or other uses described in policies for our other services do not automatically apply here.

MEMENTO, LLC / Representative member: Takeshi Sakuma / RMBld. 701, 31-1, Minami 2-jo Nishi 5-chome, Chuo-ku, Sapporo, Hokkaido 060-0062, Japan

We determine the purposes and means of processing for account administration, billing, communications and fraud prevention, acting as a controller where the GDPR or UK GDPR applies. Where we import and analyze an organization’s data on its instructions, we may act as a processor under applicable law. Our role depends on the data and the actual processing.

Where the GDPR, UK GDPR or another applicable law requires a data processing agreement (DPA), the arrangement needs contractual terms covering purposes and duration, confidentiality, security, subprocessors, assistance with rights requests and incidents, and return or deletion of data. This policy alone does not establish that agreement or complete international transfer requirements. Contact us before starting processing that requires such an arrangement.

2. Information and sources

We obtain account IDs, names or display names, email addresses and profile images from you or Google/GitHub authentication. We also handle organization names, Partner IDs, members and permissions, settings and notes you enter.

Through the Shopify Partner API credentials you register, we obtain app information, install, subscription and billing events, transactions, shop names and domains. The Service does not obtain the shops’ customers’ order details or card information.

Optional GA4 integration obtains a connected Google account’s email, authorization, property and project information, and BigQuery listing views and traffic-source data; we store daily totals by traffic source and the traffic source of each install, not individual view events. App usage (GA4) reads data when you view a report and does not store it in the App Rings database.

We handle Stripe customer, subscription, invoice and payment status information, and collect billing details at checkout. Stripe directly processes full card numbers, expiry dates and security codes; these are not stored on App Rings servers. We may also handle inquiries, access times, IP addresses, browser details, necessary operational/security logs and cookies. Section 7 covers AI information.

From people who apply as affiliates, we collect the email address of the signed-in account plus the name, PayPal email, entity type (individual or company), website or social profile and promotion plan they enter. We also handle affiliate information registered by program operators (such as name, contact details and payout details). Referral link clicks are recorded only as daily counts; we do not store records that identify the person who clicked.

3. Purposes

We send every registered user up to five onboarding emails: a welcome and connection guide, a connection reminder, an initial-import notification and getting-started guidance. We use your verified email address, language and, where needed, organization name, and store unsubscribe records and delivery records to prevent duplicate sends. We do not send advertising emails or promote third-party products. We do not track opens or clicks.

We use information for identity verification, organization and permission management, obtaining, storing, analyzing and displaying data, integrations and AI responses you select, billing, payments and refunds, support, important notices, abuse prevention, incident response, contractual and payment disputes, and legal obligations. Changes of purpose follow legally required notice, publication or consent procedures.

Shopify data, aggregates and derived data are used only to provide the Service to that user. We do not use them for sale, advertising, competitive benchmarking against other customers, or training or improving machine learning or AI models.

Where the GDPR or UK GDPR applies to information we handle as controller, we rely on contractual necessity for processing needed to perform a contract with you as an individual or take steps you request before entering one. We rely on legitimate interests for communicating with business contacts, operating the organization’s service, maintaining security, preventing abuse, and handling billing or disputes, only where your interests and rights do not override those interests. We send the welcome email and initial-import notification as communications necessary to perform our contract with you. We send the connection reminder and getting-started guidance based on our legitimate interest in helping you start using the Service, after informing you at registration and offering an opt-out in every email. Other processing may rely on a legal obligation recognized by applicable law. Necessary contractual, security and legal notices may be sent separately.

You have the right to object to onboarding emails at any time. Use the unsubscribe link in any onboarding email and we will stop sending them. Unsubscribing does not affect your use of the core Service.

Without information needed for registration or the contract, we may be unable to create your account or provide the Service. If you do not provide information needed for an optional integration, that integration will not be available.

App Rings’ use and transfer to any other app of information received from Google APIs (such as GA4 and BigQuery data obtained when you connect a Google account) will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use this information only to provide or improve user-facing features, such as the GA4 reports shown in App Rings. We do not sell it, use it to serve ads, or use it to train or improve AI or machine-learning models. We do not transfer it to third parties except as necessary to provide those features, for security, or to comply with applicable law. Our staff do not read it unless you consent, it is needed to investigate security issues or abuse, it is required by law, or it has been aggregated and anonymized for internal operations.

4. Shopify Partner API use

We use the Shopify Partner API only to retrieve information through queries. We do not execute mutations to create, modify or delete data, change or cancel Shopify app subscriptions, or issue Shopify app credits.

The required Manage apps and View financials permissions also permit some write operations under Shopify’s model. The token itself is not read-only. This statement does not concern changes to App Rings settings or data, or Stripe billing and cancellation operations.

5. Disclosures, processors and integrations

We do not provide personal data to third parties without consent except where permitted by Japan’s personal information law, such as where required by law or necessary to protect a person’s life, body or property. Outsourcing is limited to what is necessary for our purposes, and we exercise necessary and appropriate supervision over our contractors. Organization information is shown to members you invite according to their permissions.

Principal providers and purposes: Cloudflare (hosting, databases, storage and security), Stripe (payments, invoicing, tax calculation and fraud prevention), Resend (registration, connection-reminder, import-complete and getting-started emails), Google and GitHub (login), Google Cloud (GA4 and BigQuery you connect), and Anthropic or OpenAI (AI processing you select). Their own privacy terms also apply to account, payment and other information they process for independent purposes. Shopify’s terms apply to that source service as well.

If you set them up, at your instruction we send notifications of paid subscriptions, cancellations, installs and similar events, and summaries, to the Slack channel you choose (including shop names if you enable that), and we provide aggregated figures, without shop names or domains, to AI tools and programs that use an API key you create (MCP and API). Those destinations handle the data under their own terms.

With the consent the applicant gives when applying, affiliate application information is provided to the program operator (the app developer using App Rings) they applied to. After that, the program operator handles it under its own responsibility for approval, communication and commission payouts. Affiliate information registered by program operators is processed by us on their behalf. The affiliate portal does not show the names or domains of referred shops.

6. International processing

These providers may process or store data in the United States or other countries outside Japan. Specific countries and arrangements depend on the contracting provider and its subprocessors.

Where a disclosure to a foreign third party occurs, we establish an appropriate legal basis, such as consent after providing required information, contractual equivalent protective measures, or another basis allowed by applicable law. Where relying on equivalent measures, we check their continued implementation and provide legally required information upon request. Merely reading this policy is not treated as consent to an international transfer where separate consent is required.

Where GDPR or UK GDPR transfer restrictions apply to transfers from the EEA or UK, the destination, recipient and processing must fall within a relevant adequacy decision or be covered by safeguards required by applicable law, such as Standard Contractual Clauses (SCCs) or an approved UK transfer agreement. Any required transfer risk assessment and supplementary measures must also be addressed. Our location in Japan does not, by itself, authorize every onward transfer or provider. Contact us for information about applicable safeguards and how to obtain a copy.

7. Asking AI

If you configure an API key and send a question, we send aggregated numbers, your question, part of the conversation history and attached files to Anthropic or OpenAI, as selected. Automatically included aggregates exclude shop names, domains and other information identifying individual shops. Information you include in your questions or attachments is transmitted.

API keys are stored encrypted. App Rings stores up to the 50 most recent conversations, with up to 60 messages in each, separated by user and organization. Only attachment names are kept in the history. You can delete conversations. Provider-side retention and abuse monitoring are governed by your API agreement, settings and the provider’s conditions. We do not use the data for model training or improvement.

8. Cookies and external services

Cookies and browser storage maintain login, selected organization, language and similar preferences. You can disable them in your browser, but login and other functions may stop working. Google/GitHub login and Stripe checkout also use their providers’ technologies and terms. The GA4 data you connect concerns your own apps or listings; App Rings does not use it for advertising.

If we introduce advertising, optional analytics or other technologies that require prior consent by law, we will explain their purposes and your choices and obtain consent before using them. Continued browsing or general acceptance of this policy will not replace any required specific consent.

9. Security and incidents

We use access controls, organization-level data separation, encrypted communications and encrypted storage of API keys and tokens. We review processor safeguards and limit personnel access to what is necessary. In the event of a data incident, we investigate, contain harm and take preventive action, and notify affected people and authorities as required by law. Contact us under Section 12 about safeguards.

10. Retention and deletion

Organization integration data is kept while needed to provide the Service. Upon organization disconnection, we stop access and begin deleting credentials, imported data, aggregates and conversations, and process subscription termination. Completion may take time. Simply canceling a paid subscription at period end does not delete the organization’s data or account. Deselecting an app or pausing updates also does not delete saved source data. We continue obtaining necessary events and calculating organization-wide MRR, including paused and unselected apps, to determine billing and check free eligibility and activity. Records of selected apps, update timestamps, pauses, resumption, processing volume and progress are used to operate the Service and administer usage limits.

We retain minimal organization ID and billing determination records to prevent repeated free periods. Payment and accounting records are retained for legally required periods; dispute records only while necessary for those disputes. We do not keep inquiries or operational logs longer than needed for their purposes. Backups and external providers’ records follow their retention schedules, deletion procedures and legal obligations.

Disconnect Google in Settings to delete stored authorization credentials and revoke the permission at Google. You can also manage access in your Google account. Contact us for account deletion; we check other organization memberships and legally required retention before responding.

Affiliate applications, affiliates, commissions and related records are deleted when the program operator’s organization is disconnected. Affiliates who want their application records deleted can contact the program operator or the contact point in Section 12.

11. Access, correction and other requests

As provided by applicable law, you may request notification of purposes, access, correction, additions, deletion, suspension of use, erasure, cessation of third-party disclosure and disclosure records. Email the contact below from your registered address with the request. We perform the minimum necessary identity verification and verify an agent’s authority where applicable.

Where the GDPR, UK GDPR or similar laws apply, you may have rights of access, rectification, erasure, restriction, portability and objection, subject to their conditions and exceptions. You may withdraw consent to consent-based processing at any time; this does not affect the lawfulness of processing before withdrawal. We explain if we cannot fulfill a request, for example because retention is legally required. We do not disadvantage you for exercising your rights.

You may complain to a competent supervisory authority without contacting us first. In the EEA, this may include the authority where you habitually reside, work or believe an infringement occurred. In the UK, you can contact the Information Commissioner’s Office (ICO).

For information we process on an organization’s instructions as processor, that organization generally decides how to respond to requests. We direct requests we receive to the appropriate controller and assist in accordance with applicable law and our contract.

12. Contact and changes

MEMENTO, LLC / Representative member: Takeshi Sakuma / RMBld. 701, 31-1, Minami 2-jo Nishi 5-chome, Chuo-ku, Sapporo, Hokkaido 060-0062, Japan

Email: info@app-rings.com / Phone: +81-11-600-0825. Hours: weekdays 10:00–17:00 Japan time, excluding Japanese public holidays and the year-end/New Year period. We recommend email so that there is a written record.

Use this contact for privacy questions, complaints and rights requests. We publish revisions and the updated date here, notify users of material changes through the Service or another appropriate channel, and obtain prior consent when required by law.