Leer esta política en español (the Spanish version prevails)
Multicanal Sync Privacy Policy
Draft under review. Items marked [PENDING] are not defined yet. This is a courtesy translation of the Spanish policy, which prevails.
Last updated: [PENDING: publication date]
1. Who we are
Multicanal Sync is an app by OberaLabs (oberalabs.com) that connects a Shopify store with a Mercado Libre seller account.
- Controller: Iván Alejandro Pereira Alegre
- Tax ID (CUIT): [PENDING: to be confirmed for publication]
- Address: [PENDING: to be confirmed for publication]
- Privacy contact: privacidad@oberalabs.com
For buyer data, the merchant who installs the app decides what it is used for, and Multicanal Sync processes it on the merchant's behalf. [PENDING: confirm roles with a professional under the law of each country]
2. What data we process and why
| Data | Whose | Source | Purpose |
|---|---|---|---|
| Buyer id, nickname and, when Mercado Libre provides them, first name, last name and email | Buyer | Mercado Libre sale | Identify the sale and create the order in Shopify |
| Shipping address and phone, and recipient name | Buyer | Mercado Libre shipment | Complete the Shopify order so it can be shipped |
| Identity document, tax status and billing address | Buyer | Mercado Libre billing info | Complete the order and its note so the merchant can invoice |
| Text of questions and answers, and the asker's id | Buyer | Mercado Libre questions | Show them in the app and suggest an answer |
| Text of post-sale messages and the sender's id, if the merchant enables the feature | Buyer | Mercado Libre messaging | Show them in the app so the merchant can reply |
| Store domain and notification email | Merchant | Shopify and Settings | Operate the account and send notifications |
| Shopify session; may include the store user's name and email | Merchant | Shopify | Sign in to the app |
| Mercado Libre account nickname and id, and access credentials | Merchant | Mercado Libre | Sync stock, prices, orders and listings |
| Products, variants, stock and prices | Merchant | Shopify and Mercado Libre | Keep both channels in sync |
We do not request access to the Shopify customer list. The orders we create in Shopify carry the sale data. When Mercado Libre provides the buyer's email, the order is attached to a Shopify customer record created or updated with their name and email; otherwise the order has no customer record.
We do not sell personal data, nor use it for advertising or to profile buyers.
3. Automated decisions and artificial intelligence
The AI feature is active in production (Claude model, by Anthropic).
- Listings: the app uses AI to suggest a category, title and attributes from product data. It does not use buyer data.
- Questions: the text of the question is sent to Anthropic to suggest an answer. The suggestion is never sent on its own: the merchant reviews and sends it.
- By default Anthropic does not use API inputs or outputs to train models, and deletes them on its side within 30 days.
- We make no automated decisions with legal or similarly significant effects on people.
4. Who we share data with
Data originates from Shopify and Mercado Libre, which process it under their own policies (Shopify, Mercado Libre). To run the app we use these providers (processors):
| Provider | Purpose | Region | Data it receives |
|---|---|---|---|
| Fly.io | App servers | United States (Ashburn, Virginia) | All data in section 2, in transit and in technical logs |
| Supabase | Database | United States (us-east-1, Virginia) | All data in section 2 |
| Resend | Notifications and daily digest email to the merchant | United States (us-east-1) | Merchant notification email and the notification content (sale numbers, products; no buyer data) |
| Anthropic | AI suggestions | United States | Product data; text of the buyer's question |
| Cloudflare | oberalabs.com website and routing of inbound mail to privacidad@ and soporte@ | United States and global network | IP and technical data of site visitors; inbound mails, in transit |
| Google (Gmail) | Mailbox for privacidad@ and soporte@ | United States | Content of support emails and of data-rights requests |
Because all providers are in the United States, data is transferred outside Argentina and Mexico. [PENDING: legal basis and transfer mechanism per country; in Argentina the United States is not deemed adequate by the AAIP, so a transfer agreement (Disposición 60-E/2016) or consent applies]
5. How long we keep data
- On uninstall: Shopify notifies us after 48 hours and we delete all the store's data. Only a receipt without personal data remains, with a hash of the domain and the row count.
- While the app is installed: 24 months after the sale, question or message we anonymize the buyer's data. We keep the sale number, items and quantities. [PENDING: confirm the period with a professional, e.g. against the merchant's tax obligations]
- Server logs (Fly.io): Fly.io log search keeps 7 days; we do not export logs to another service. Logs contain no credentials or sensitive parameters; of each request only the path and the store domain are kept.
- Backups (Supabase): [PENDING: depends on the project plan. Free plan: Supabase takes no automatic backups. Pro plan: daily backups kept 7 days; with the PITR add-on, 7, 14 or 28 days]
- Sent emails (Resend): Resend keeps the content and logs of each email for 30 days.
- AI suggestions (Anthropic): Anthropic deletes inputs and outputs within 30 days.
6. Your rights
Buyers should first contact the merchant, who decides about their data.
- Access: when Shopify notifies us that a customer requested their data, we prepare the details for the merchant, who sees them in Settings and delivers them.
- Erasure: when Shopify notifies us, we anonymize the data. We keep the sale number, items and quantities because stock must reconcile.
Limitation: Mercado Libre usually does not provide the buyer's email, and without an email the orders we create have no customer in Shopify, so a Shopify notice may not reach those sales. In that case the merchant must write to privacidad@oberalabs.com with the sale number. The merchant can also erase them from Settings > Customer data requests, using the sale number.
Argentina (Law 25,326)
You have the right to access your data and to request its rectification, update or deletion. Access requests are answered within 10 calendar days, and rectification or deletion within 5 business days of receipt. Write to privacidad@oberalabs.com. Access is free of charge at intervals of no less than six months, unless a legitimate interest is shown.
The Agencia de Acceso a la Información Pública (AAIP), as the supervisory authority under Law 25,326, is empowered to handle complaints and claims from anyone whose rights are affected by non-compliance with data protection rules. Site: argentina.gob.ar/aaip.
Mexico (Federal Law on the Protection of Personal Data Held by Private Parties)
You have the right to access, rectify and cancel your data, and to object to its processing (ARCO rights), as well as to withdraw consent. Request them at privacidad@oberalabs.com, stating your name, a means to reply to you and the data concerned; we reply within the period set by law [PENDING: confirm the response period in the text of the law published 20 March 2025, amended 14 November 2025]. The authority is the Secretaría Anticorrupción y Buen Gobierno, which took over the functions of the former INAI in this matter on 21 March 2025. Site: gob.mx/buengobierno.
7. Security
- Data travels encrypted over HTTPS.
- Shopify and Mercado Libre credentials are stored encrypted with AES-256-GCM.
- The database has row-level security enabled and no privileges for public roles.
- Web request logs do not store parameters containing credentials.
8. Changes and contact
If we make material changes to this policy, we notify merchants by email to the notification address set in Settings, at least 30 days in advance. The last-updated date appears at the top. Questions: privacidad@oberalabs.com.
Governing law and jurisdiction: [PENDING: controller's decision, to be reviewed with a professional].