Privacy policy: Merivirta AI Translate
Last updated: 20 October 2026
This privacy policy explains what information the Shopify app Merivirta AI Translate (“the app”) collects, how it is used, where it is stored and how it is deleted. The app is provided by Merivirta Digital Oy (“Merivirta”, “we”, “us”).
1. Who we are
| Company | Merivirta Digital Oy |
| Country | Finland |
| Privacy contact | jere@merivirta.com |
| App URL | https://translate.merivirta.com |
2. What the app does
The app translates the content of the merchant’s Shopify store (products, collections, pages, blog posts, navigation, metafields, theme texts and other content exposed by Shopify’s translation API) into languages the merchant has already enabled in Shopify. AI translation is included in every plan: translations are made by Merivirta’s AI service, which uses Anthropic’s Claude models through Merivirta’s own Anthropic account. The merchant does not need an AI account or API key. The merchant can review and edit translations before they are published. Nothing is written to the store and nothing is sent to AI until the merchant allows it in the app’s Settings.
3. Information we collect and store
The app stores only what it needs to translate the merchant’s store. It does not collect, request or store information about the store’s customers, and it does not read orders. The app does not use Shopify’s protected customer data.
| Information | Source | Why we need it |
|---|---|---|
| Store’s myshopify domain, installation and uninstall times, granted access scopes | Shopify, when the app is installed and opened | To identify the store and route requests |
| Shopify access token and refresh token for the store (expiring offline access) | Shopify token exchange | To call the Shopify Admin API on the store’s behalf, including continuous automation if the merchant turns it on |
| A short-lived online access token for the signed-in staff member | Shopify token exchange, when a staff member publishes translations | Interactive writes are made with the staff member’s own Shopify permissions; the app checks that the staff member may change translations. No staff names or emails are stored. |
| Consent settings, languages excluded from AI jobs, resource and field exclusions | Entered by the merchant | To respect the merchant’s choices |
| Translation drafts saved in the editor, and fingerprints of the source text each translation was made from | Entered by the merchant / created by the app | To keep drafts, detect outdated translations and verify that published translations reached Shopify |
| Translation jobs: chosen languages, content types, policy, token budget, progress counts, errors and the per-field write records needed to resume a job safely (the last 30 finished jobs are kept) | Created by the app | To show progress and to never repeat a write whose outcome is unknown |
| Continuous automation settings and status (languages, content types, policy, 24-hour token budget, schedule, last runs, webhook delivery times) | Entered by the merchant / created by the app | To run automation only as the merchant configured it |
| Monthly word usage (count of translated words per month) | Created by the app | To apply the plan’s monthly word allowance and show the merchant their usage |
| Current app plan (cached for 5 minutes) | Shopify Partner API (activeSubscription) | To apply the plan’s language and monthly word limits |
Store content (titles, descriptions and other texts) is read from Shopify when the merchant browses the catalog or a job runs. It is business data about the store, not personal data.
Information we do not collect: customer names, emails, addresses or orders; payment card details (Shopify handles all billing); staff names or emails; browser cookies for tracking or advertising. The app has no analytics, advertising or tracking scripts. Page-performance metrics (Web Vitals: metric name, value and page path, with the store domain) are sent from the app page to our own server and written to the server log only. Unsaved editor changes stay in the merchant’s browser window and are never sent to us automatically.
The app no longer asks merchants for an AI provider API key. API keys stored by earlier versions of the app are no longer used and are deleted.
4. AI processing
- The app sends store text to AI only after the merchant turns on AI consent in Settings and confirms the job (or opts in to continuous automation). Estimates never call AI.
- Translations are made by Merivirta’s AI service with Anthropic’s Claude models, through Merivirta’s own Anthropic API account. The merchant does not need an AI account or API key, and AI usage is included in the merchant’s plan.
- What is sent with each request: the source text of one field, the field’s key and content type (for example “product title”), the source and target language, and instructions for the translation. No customer, order or staff data is sent; the app has no access to customer or order data.
- Anthropic processes the text under its Commercial Terms of Service, which state that “Anthropic may not train models on Customer Content from Services”. Data sent through Anthropic’s services is processed under Anthropic’s Data Processing Addendum, which is part of those terms.
- Merivirta does not use store content to train any AI model.
- The app counts the words it sends for translation to apply the plan’s monthly word allowance. Only the count is stored, not the text.
5. How we use the information
We use the information only to provide the app’s features to the merchant:
- read the store’s languages and translatable content and show coverage;
- estimate and run translation jobs and continuous automation as configured;
- publish translations the merchant approved, and check them against Shopify afterwards;
- apply the limits of the merchant’s plan;
- provide support when the merchant contacts us;
- keep the app secure and fix errors.
We do not sell, rent or share the information for marketing, and we do not use one store’s data for another store.
Legal basis (GDPR). Most of the information is business data about the store and is not personal data. Where personal data is processed (for example the store’s domain when it identifies a sole trader, or the name and email of a merchant who contacts support), the legal basis is the performance of our contract with the merchant (Art. 6(1)(b)) and our legitimate interest in running and securing the service (Art. 6(1)(f)). Merivirta acts as controller for support communication and as processor for data processed on the merchant’s instructions.
6. Where the information is stored and who processes it
All app data is stored in a PostgreSQL database and processed by the app’s web server and background worker hosted by Render in the Frankfurt (EU) region.
| Service provider | Purpose | Location |
|---|---|---|
| Render Services, Inc. | Hosting of the app’s web server, background worker and database | Frankfurt, Germany (EU). Any transfer to Render’s US company is covered by Render’s data processing agreement and Standard Contractual Clauses. |
| Anthropic, PBC | AI translation of store content (the text described in section 4) | United States. See Anthropic’s Commercial Terms of Service. |
| Shopify | The platform the app runs on: authentication, Admin API, webhooks, billing (Shopify App Pricing) and the Partner API | See Shopify’s privacy policy |
We do not use any other subprocessors.
7. Security
- All traffic uses HTTPS.
- All translation data (drafts, exclusions, jobs, automation settings, word usage, plan cache) is stored encrypted with AES-256-GCM, with a key separate from other Merivirta apps.
- Shopify webhooks are verified with HMAC signatures.
- Access tokens, API keys, store content, translations and raw Shopify or AI responses are never written to logs.
- Each store’s data is kept separate and is only used for that store.
- Store writes and AI processing are off until the merchant explicitly turns them on.
8. How long we keep the information
| Situation | What happens |
|---|---|
| While the app is installed | Data is kept so drafts, jobs and automation keep working. Only the last 30 finished jobs are kept in the job history. |
| The merchant uninstalls the app | The store’s access tokens are deleted immediately, running jobs and automation stop, and both consents (store writes and AI) are cleared. |
48 hours after uninstall (Shopify shop/redact) | All data stored for the store is deleted: drafts, exclusions, jobs, automation settings, word usage, plan cache and installation records. |
| Moving between Merivirta AI Translate apps | If the store still has another version of Merivirta AI Translate installed (for example it moved from a custom app made for it to the public App Store app), the store’s data is kept for that installation and only the uninstalled app’s access tokens are deleted. |
| Database backups | Backups made by our hosting provider are deleted on their normal rotation. |
| Server logs | Logs contain technical details (for example the store domain, request path and status, job IDs) but no tokens, API keys, store content or translations. |
Translations that the app published are part of the merchant’s Shopify store and are not deleted when the app is uninstalled.
9. Shopify privacy requests
customers/data_requestandcustomers/redact: the app does not store any customer data, so there is nothing to export or delete. These requests are acknowledged.shop/redact: all of the store’s data is deleted as described above.
10. Your rights
Merchants, and any person whose personal data we process, can ask us to access, correct, delete or export their data, or object to or restrict its processing. Contact us at jere@merivirta.com. A merchant can also delete all data by uninstalling the app.
You have the right to lodge a complaint with a data protection authority. In Finland this is the Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto), tietosuoja.fi.
11. Changes to this policy
We will update this page when the app’s data handling changes and change the “Last updated” date above. Material changes will also be announced in the app.
12. Contact
Merivirta Digital Oy, Finland
Email: jere@merivirta.com