Effective: 22 September 2026 (previous version: 19 September 2026)
Marqly is operated by Box02 LLC, a Wyoming limited liability company. Our registered address is:
Box02 LLC
30 N Gould St., #5377
Sheridan, WY 82801
United States
Box02 LLC is a United States company, and Marqly is developed, operated and supported day to day from Thailand. This means that the person operating the App accesses merchant data from Thailand. Section 8 explains what that means for your data.
Contact: hello@marqly.app
This policy explains how we collect, use and protect personal data when you use the Marqly Shopify app or visit marqly.app.
From the Shopify app, we store your store's myshopify.com domain, the access token Shopify issues so the App can work on your behalf, and counters that record how many AI suggestions your store has used. We do not read or store the store owner's name, email address or user profile. Shopify's install screen lists those details under "store owner" because Shopify grants every app that access by default; Marqly never requests them from Shopify's API. We do not access customer orders, customer personal data or payment data, and the App holds no permission that would let us.
We also keep an installation record containing your store domain, whether it was recorded during the free-launch phase, when that record was created, and when replacement Shopify credentials were last observed. The phase record identifies the free-launch cohort for future entitlement handling; it is not proof of the original installation date. The credential-observation time helps prevent delayed uninstall notifications from deleting a newer installation. These records do not contain product or customer data.
The compliance configuration you enter in Marqly - manufacturer, EU responsible person and importer records, warnings, safety instructions and uploaded documents - is stored inside your own Shopify store as app metafields and metaobjects, not in Marqly's database. One exception: Marqly keeps a change-history (audit) log in its own database so you have an evidence trail for market-surveillance authorities. Those entries record the date, what changed, and the name of the operator or product affected - for example "Updated EU responsible person "Example GmbH"". Addresses, contact details and document contents are never copied into that log.
From this website, we collect standard server logs (IP address, user agent, page accessed) for security and operational purposes. The Marqly application server keeps similar operational logs, which record your store's domain and technical event identifiers so we can diagnose faults. These logs contain no customer data.
The marketing site also uses Cloudflare Web Analytics to measure page views and website performance. Its browser beacon processes the page path and referrer, browser and device information, country, page-load timings and Core Web Vitals. Cloudflare receives the source IP address as part of the normal web request, but states that it discards the address at its nearest data centre and does not store it in its analytics databases or logs. The beacon does not use cookies, browser storage or cross-site user profiles.
Marqly offers an optional AI-suggestion feature. When you click "Suggest with AI" (or run AI auto-fill in bulk), the following product data is sent to Anthropic PBC (provider of the Claude model, based in the United States) to generate the suggestion: product title, description, vendor, product type, tags, and the product's featured image. No customer personal data is ever involved - the feature only processes merchant-authored catalog data.
There is a second AI path you should know about. When you save safety instructions for a product, Marqly automatically sends that safety text to Anthropic to translate it into the other languages your storefront displays, so the safety information is understandable to consumers as the GPSR requires. This happens as part of saving, without a separate AI click. Only the safety text and the target languages are sent.
Apart from that translation step, AI processing happens only when you actively request a suggestion. Suggestions are never saved automatically - you review and apply them yourself. Anthropic's handling of API data is described in its privacy policy; API inputs are not used to train Anthropic's models by default.
We process merchant data under the legal basis of performance of a contract (Article 6(1)(b) GDPR) when you install and use Marqly. Server logs and the cookie-free website analytics described in section 3 are processed under legitimate interests (Article 6(1)(f)). AI processing is performed only at your request as part of operating the App (Article 6(1)(b)).
The legitimate interests we pursue are keeping the service available, preventing abuse, investigating faults, understanding how the marketing site performs and improving it. Cloudflare Web Analytics is limited to aggregate usage and performance measurements and does not use cookies or browser storage. Where the compliance details you enter describe a third party - for example a named individual acting as manufacturer or EU responsible person - we handle that data only on your instructions as your processor, and the duty to inform that person (Article 14 GDPR) rests with you as the controller.
Your GPSR configuration data (manufacturer, responsible-person and importer details, warnings, safety instructions and documents) is stored inside your own Shopify store as app metafields and metaobjects - not in Marqly's database. Marqly's own database holds your store's login sessions, AI-usage counters (how many AI suggestions your store has used, and a per-day count of automatic safety-text translation calls), installation records (including the free-launch cohort and credential-observation times), and the change-history (audit) log described in section 3. This application server and database are operated by Box02 LLC and hosted with Render in its Frankfurt, Germany region.
We retain the installation record while the App is installed. When we receive and verify an uninstall notification for the current installation, we delete the store's sessions, AI-usage counters (including the daily translation-call counts), installation record and audit logs. Shopify also sends a shop-redaction request about 48 hours after uninstall, when we run another deletion pass. Delayed notifications from an older installation do not delete a newer installation; notifications that cannot be safely matched are left for retry or the later redaction pass. Data held inside your Shopify store (metafields, metaobjects and uploaded files) is governed by Shopify's own data handling once our access is revoked.
We use the following subprocessors:
A current list of subprocessors is available on request, and we will give notice before adding a new one.
Marqly is operated by Box02 LLC, a United States company, and is run day to day from Thailand. Some of our subprocessors also process data outside the European Economic Area (EEA). Where we transfer personal data of individuals in the EEA or UK to a country without an EU adequacy decision, we rely on the European Commission's Standard Contractual Clauses (SCCs), together with any supplementary measures required, as the transfer safeguard. In particular, Anthropic PBC processes AI-feature inputs under its Data Processing Addendum (which incorporates the SCCs), and Shopify processes app and merchant data under its Data Processing Addendum (which incorporates the SCCs). You can request a copy of the relevant transfer safeguards by emailing us at the address in section 1.
The Marqly application server and database are hosted in the EEA (see section 6), so that data is not moved outside the EEA for hosting. However, the person who operates and supports Marqly on behalf of Box02 LLC accesses that data remotely from Thailand, which has no EU adequacy decision. This access is carried out by Box02 LLC's own personnel and is therefore not an onward transfer to a separate recipient; it is covered by the access controls described in section 12.
For the account and operational data we decide to collect in order to run and bill the App - your store's domain, its access token, AI-usage counters, installation/cohort records, credential-observation times and our server logs - Box02 LLC acts as a data controller. For the compliance configuration you enter (manufacturer, EU responsible-person and importer details, warnings, safety instructions and documents), for the change-history log we keep on your behalf, and for the product data you submit to the AI features, Box02 LLC acts as a data processor acting on your instructions, and you are the controller. We never use data we process for you to train AI models, to build profiles across stores, or for any purpose of our own.
Because we act as your processor, Article 28 GDPR requires a written agreement between us. Sections 3 to 9 of this policy are our data-processing terms: they set out what we process for you, for which purposes, which subprocessors we use, the international transfers involved and the deletion on uninstall. They form part of our Terms, so every merchant has these terms in place automatically on install, with nothing to sign. We use the data we process for you only on your documented instructions, keep it confidential, and delete it when you uninstall (section 6). If your own compliance process requires a separately signed Data Processing Addendum, email us at the address in section 1 and we will provide one.
Under GDPR you have the right to access, correct, delete and export (port) your personal data, and to object to or restrict processing. Marqly makes no decisions about you by automated means that produce legal or similarly significant effects (Article 22 GDPR) - AI suggestions are drafts that you review and apply yourself. Write to hello@marqly.app and we will respond within one month.
You also have the right to lodge a complaint with a data protection supervisory authority. In the EEA this is the authority in the country where you live, work, or where you believe the problem occurred - the full list is published at edpb.europa.eu. In the United Kingdom it is the Information Commissioner's Office (ico.org.uk).
The marqly.app marketing site uses Cloudflare Web Analytics for the aggregate usage and performance measurements described in section 3. The analytics beacon does not use or access cookies, local storage, session storage or other browser storage, and Marqly uses no advertising or cross-site tracking technology. The marketing site sets no cookies of its own. The embedded Marqly admin runs inside Shopify and uses only the strictly necessary session tokens Shopify provides to keep you signed in; we do not set our own tracking cookies. Because these marketing-site technologies do not store or access information on your device, Marqly does not display a cookie consent banner.
All traffic between your browser, Shopify, the App and our subprocessors is encrypted in transit (HTTPS/TLS). The App authenticates every request with Shopify session tokens and verifies the signature of every Shopify webhook before acting on it. The application connects to its database over Render's private network; database credentials and API keys are held as secrets on the hosting platform, never in source code. Render is certified to SOC 2 Type 2 and ISO 27001 and keeps automatic backups of the database for up to seven days. Access to production systems is limited to the single person who operates the App. If we become aware of a personal data breach affecting your data, we will notify you without undue delay, and we will notify Shopify within 24 hours as our Partner agreement requires.
Marqly processes business/merchant account data and product information; it does not collect the personal information of your customers, and we do not sell or share personal information. We are below the size thresholds that would make us a covered "business" under the California Consumer Privacy Act or comparable US state privacy laws. If you are a US resident and believe we hold personal information about you, you may still contact us to exercise any access or deletion rights available under applicable US state privacy laws.
We announce material changes in the Marqly admin and update the Effective date at the top of this page. We encourage you to check this page when the date changes.
Box02 LLC
30 N Gould St., #5377
Sheridan, WY 82801
United States
Operated from Thailand
hello@marqly.app