Holly XML Feed Privacy Policy

Last updated: October 14, 2026

Holly XML Feed ("the App", "we", "us") is a Shopify application developed by Holly Palm. It builds product feeds from a merchant's catalog for Google Merchant Center, Meta, TikTok, price comparison sites such as Akakçe and Cimri, affiliate networks, AI shopping channels and the merchant's own systems. This Privacy Policy explains what information the App collects, how it is used, how long it is kept, and the rights available to merchants.

By installing and using the App, you agree to the collection and use of information as described in this policy.

1. Information We Collect

1.1 Information collected from Shopify

When you install the App, we access data from your Shopify store through Shopify's APIs, limited to the permissions (scopes) you approve during installation (read_products, read_inventory, read_locations, read_markets, read_translations):

• Store information: your myshopify domain, store name, primary domain, currency and the store's contact email address, and the access token Shopify issues for the installation.
• Product catalog: products and variants with their titles, descriptions, vendor, product type, category, tags, collections, options, SKUs, barcodes, prices, images and metafields. The App keeps its own copy of this catalog so feeds can be built quickly.
• Inventory: stock per location, only when you create a local inventory feed.
• Markets and translations: market prices and translated titles and descriptions, only for the countries and languages you build feeds for.
• Subscription and billing status: your App plan and its status, provided by Shopify. All payments are processed by Shopify; we never receive or store payment card details.

The App does not access or store customer or order data.

1.2 Information collected directly from you (the merchant)

• Feed settings, field mappings, rules and templates you create in the App.
• The email address you enter for feed alerts, if different from the store's contact email.
• Server details you enter for automatic delivery (host, port, user name, password or private key). Passwords and private keys are encrypted (AES-256-GCM) and never shown again.
• If you connect Google Merchant Center: an OAuth refresh token for the Google account you choose (encrypted), the Merchant Center account ID, and the approval status and issues Merchant Center reports for each of your products.
• Contact information you provide when reaching out to our support channels.
• Basic technical logs generated when you use the App (timestamps, requested actions and error information), used for security, debugging and service reliability.

1.3 Information collected when channels fetch your feeds

Your feeds are published at unguessable URLs so that the channels you choose can fetch them. Each feed contains the product information you configured for it. When a URL is fetched, the App records the kind of fetcher (for example Googlebot), its User-Agent string, the time and a count, so you can see which channels read your feed. No information about shoppers is collected.

When you run the product page check, the App opens a sample of your public product pages the way a channel's crawler does and compares the price and stock with the feed.

2. How We Use the Information

We use the information described above solely to provide and operate the App's services:

• Building, checking and publishing your product feeds, and uploading them to the servers you configure.
• Showing feed health, version changes, product page checks and Merchant Center approval status inside the App.
• Sending feed alert emails to the address you choose.
• Managing your subscription and plan limits.
• Providing customer support and maintaining the security, stability and performance of the App.

We do not sell, rent, or share your data with third parties for marketing or advertising purposes, and we do not use your data for any purpose other than providing the App's services.

3. Data Retention

• Catalog copy: updated as your products change and refreshed in full once a day.
• Feed files: the last 10 versions of each feed are kept; older versions are deleted automatically.
• Feed checks of another app's feed: the last 10 per store are kept.
• Merchant Center status: replaced at every daily sync.
• When you uninstall the App, we receive Shopify's app/uninstalled webhook and delete your store's data and feed files from our systems immediately, except where retention is required by law (for example, billing records).
• Support correspondence may be retained as long as necessary to handle your request and for our legitimate record-keeping.

4. GDPR and Data Subject Rights

We comply with Shopify's mandatory privacy webhooks:

• customers/data_request and customers/redact: the App stores no customer data, so there is nothing to return or delete; the requests are acknowledged.
• shop/redact: after uninstallation, we delete all data related to the store when Shopify sends this webhook.

If you are located in the European Economic Area (EEA), the United Kingdom, or another jurisdiction with similar data protection laws, you have the right to access, correct, export, restrict the processing of, or delete your personal data. To exercise any of these rights, contact us using the details in Section 8.

5. Data Storage, Processing, and Third-Party Services

Your data is stored and processed on secure cloud infrastructure provided by our hosting providers. These providers act as data processors on our behalf and are contractually bound to protect your data. Where data is transferred outside the EEA, transfers rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

We share data only with:

• Shopify, as the platform through which the App operates (see Shopify's own privacy policy).
• The channels and servers you choose: your feeds are read by the channels you give the feed URL to, and uploaded to the servers you configure. What happens to the data there is governed by those services' own terms.
• Google, only if you connect Merchant Center: the App reads your Merchant Center product statuses with the access you grant, and you can revoke it at any time in your Google account.
• Email delivery providers, to send the feed alerts you turn on.
• Cloud hosting and infrastructure providers, strictly for operating the App.

6. Security

We take reasonable technical and organizational measures to protect your data, including encrypted connections (HTTPS/TLS) for all data in transit, encryption of server passwords, private keys and Google tokens at rest, access tokens stored securely, and access to production systems restricted to authorized personnel. No method of transmission or storage is completely secure, but we work to protect your information against unauthorized access, alteration, or destruction.

7. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the "Last updated" date at the top of this page. Continued use of the App after changes take effect constitutes acceptance of the revised policy.

8. Contact Us

If you have questions about this Privacy Policy or want to exercise your privacy rights, contact us:

• Email: hello@hollypalm.com
• Developer: Holly Palm

We will respond to privacy-related requests within 30 days.