Legal
Privacy policy
Last updated: 6 November 2026
Octopia is a professional service for Shopify merchants. This page says plainly which data we process, why, with whom, for how long, and how to exercise your rights.
1. Data controller
MG INNOVATIONS, SARL, 320 rue Saint-Honoré, 75001 Paris, France, RCS Paris 888 874 740. No data protection officer is appointed; any question about your data goes through the contact form, subject "Personal data".
2. The data we process
| Context | Data | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| Account | Name, email, password (hashed), language, two-factor secrets and passkeys if you enable them | Create and secure your access | Performance of the contract | Life of the account, then 30 days |
| Organization | Organization name, member roles, invited emails (the invitation token is stored hashed) | Work together on one catalog | Performance of the contract | Life of the account |
| Shopify store | Store domain, access token (encrypted at rest), a mirror of the catalog: products, descriptions, images, collections, translations | Read your catalog, produce and — on your decision — publish your product pages | Performance of the contract | Until the store is disconnected, then 30 days |
| Supplier sources | Product page addresses you paste (Amazon, AliExpress) and their extracted content | Build a product's evidence file | Performance of the contract | Life of the product in Octopia |
| AI processing | Product data and images sent to the models; no account data | Write, check and localize product pages | Performance of the contract | Results kept with the product; not retained by the provider (see §3) |
| Purchases | Order and payment identifiers from whichever provider took the payment — Stripe, or Shopify for a purchase made through the Shopify App Store — amount, date. No card data ever passes through Octopia | Sell credit packs, keep your balances | Performance of the contract, accounting obligations | 10 years (accounting records) |
| Contact form | Name, email, company (optional), subject, message, language, IP address, browser | Reply to you, prevent abuse | Legitimate interest (answering a request) | 24 months |
| Audience measurement | Page views, interactions, the key steps of your path (account created, store connected, first page, publication, purchase and its amount), aggregated technical data via Google Analytics, only after you agree | Understand how the Site is used | Consent | At most 14 months at Google; your choice is remembered in your browser |
| Advertising | Your visit to the “Try one of your product pages” page and the steps you reach (address accepted, code confirmed, account created), with your IP address, your browser and the Meta cookie's identifier, collected by the Meta pixel, only after you agree. Neither the page's address, nor your email, nor your store's name is passed to it | Measure and improve our ads on Facebook and Instagram | Consent | 90 days for the cookies; Meta then keeps this data under its own privacy policy |
| Acquisition measurement | Recorded on our own server, with no cookie of its own: the steps you reach (account created, address confirmed, store connected, first page, first publication, purchase), the campaign tags (utm) of the link you arrived by, the website you came from (its domain only), the page you landed on, and — for the Shopify app — your store's domain on each day the app is opened, and your answer to “How did you hear about Octopia?” if you give one. Visits to “Try one of your product pages” are counted once per session, with their campaign tags and nothing that says who made them. No IP address, no device identifier | Know which channels bring merchants to us, and where the sign-up path loses them | Legitimate interest (measuring our own service) | Life of the account; a store that never created an account: 24 months, or until Shopify asks us to erase its data |
| “Try one of your product pages” | Page address, email, language, IP address, campaign tags (utm) and the site you came from | Check your address with a code, show you your rewritten page and send you its link; prevent abuse. No other message | Performance of your request | 120 days for the email and IP address, the life of the demonstration page; a fingerprint of the email, which cannot be turned back into it, is kept to limit the trial to one page per address |
| Bot protection | Technical signals analysed by Google reCAPTCHA on sign-up, sign-in, password reset, the contact form and “Try one of your product pages” | Keep automated scripts out | Legitimate interest (security) | Not retained by Octopia |
| Technical logs | IP address, timestamp, request, errors; secrets are scrubbed before writing | Security, diagnostics | Legitimate interest (security) | At most 12 months |
We make no automated decision with legal effects about you, and we do not sell your data.
3. Recipients and processors
Your data is accessible only to the people at MG INNOVATIONS who need it, and to the following providers, each for the stated purpose:
| Provider | Role | Location |
|---|---|---|
| OVH SAS | Hosting of the Site, the application, the database and backups | France |
| Shopify Inc. | Your store; Octopia reads your catalog and writes to it only on your final decision. For merchants who installed Octopia from the Shopify App Store, Shopify also takes the payment for credit packs and invoices them | Canada (adequacy decision), United States |
| Stripe | Payment of credit packs, for merchants who signed up on octopia.pro | Ireland, United States |
| OpenAI | Language and vision models; calls are made without provider-side retention ("store: false") | United States |
| Anthropic PBC | Language models for writing descriptions; the data sent is not used to train its models | United States |
| Analytics (after consent), reCAPTCHA, YouTube player in no-cookie mode — loaded only when you press play | Ireland, United States | |
| Meta Platforms Ireland | Meta pixel on “Try one of your product pages” (after consent). Meta is a joint controller of this collection and its transmission, then sole controller of its own processing | Ireland, United States |
| Canopy API, RapidAPI | Reading the Amazon and AliExpress supplier pages you provide as sources | United States |
4. Transfers outside the European Union
Data hosted by Octopia stays in France. Providers established outside the European Union are covered by an adequacy decision of the European Commission (Canada; the EU-US Data Privacy Framework where the provider is certified) or by the European Commission's standard contractual clauses.
5. Security
Encrypted connections (HTTPS), hashed passwords, Shopify tokens encrypted at rest, two-factor authentication and passkeys available, strict separation between organizations, daily database backups kept 14 days at the host, secrets scrubbed from logs. Octopia never publishes to your store without your explicit decision.
6. Cookies and local storage
| Name | Role | Lifetime | Needs your consent |
|---|---|---|---|
octopia_session | Your session (sign-in, chosen language, status messages, where your visit came from) | Session, 2 hours of inactivity | No — strictly necessary |
XSRF-TOKEN | Protects forms against forged requests | Session | No — strictly necessary |
remember_web_* | "Remember me" at sign-in | Until you sign out | No — set at your request |
octopia.consent.v2 (local storage) | Remembers your answer to the banner, purpose by purpose | Until changed | No — needed to honour your choice |
_ga, _ga_* | Google Analytics — audience measurement | At most 13 months | Yes — set only after you agree to audience measurement |
_fbp, _fbc | Meta — measuring and improving our ads, on “Try one of your product pages” only | 90 days | Yes — set only after you agree to advertising |
Audience measurement and advertising are two separate choices. Nothing is measured and none of these cookies is set until you accept. You can change your mind at any time through the "Cookies" link in the footer. The video player on the home page only calls YouTube when you press play.
7. Your rights
You have the rights of access, rectification, erasure, restriction, portability and objection, and the right to withdraw your consent to audience measurement and to advertising at any time. To exercise them, use the contact form with the subject "Personal data"; we answer within one month. You may also lodge a complaint with the French supervisory authority, the CNIL (www.cnil.fr).
Your store and product data is processed on your behalf: you remain its controller, and Octopia acts as a processor for it.
8. Minors
Octopia is a professional service; it is not intended for anyone under 18.
9. Changes
This policy may evolve with the service. The date at the top marks the current version; a substantial change will be announced in the application.