Legal
Privacy policy
Last updated: 3 September 2026
Octopia is a professional service for Shopify merchants. This page says plainly which data we process, why, with whom, for how long, and how to exercise your rights.
1. Data controller
MG INNOVATIONS, SARL, 320 rue Saint-Honoré, 75001 Paris, France, RCS Paris 888 874 740. No data protection officer is appointed; any question about your data goes through the contact form, subject "Personal data".
2. The data we process
| Context | Data | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| Account | Name, email, password (hashed), language, two-factor secrets and passkeys if you enable them | Create and secure your access | Performance of the contract | Life of the account, then 30 days |
| Organization | Organization name, member roles, invited emails (the invitation token is stored hashed) | Work together on one catalog | Performance of the contract | Life of the account |
| Shopify store | Store domain, access token (encrypted at rest), a mirror of the catalog: products, descriptions, images, collections, translations | Read your catalog, produce and — on your decision — publish your product pages | Performance of the contract | Until the store is disconnected, then 30 days |
| Supplier sources | Product page addresses you paste (Amazon, AliExpress) and their extracted content | Build a product's evidence file | Performance of the contract | Life of the product in Octopia |
| AI processing | Product data and images sent to the models; no account data | Write, check and localize product pages | Performance of the contract | Results kept with the product; not retained by the provider (see §3) |
| Purchases | Order and payment identifiers from whichever provider took the payment — Stripe, or Shopify for a purchase made through the Shopify App Store — amount, date. No card data ever passes through Octopia | Sell credit packs, keep your balances | Performance of the contract, accounting obligations | 10 years (accounting records) |
| Contact form | Name, email, company (optional), subject, message, language, IP address, browser | Reply to you, prevent abuse | Legitimate interest (answering a request) | 24 months |
| Audience measurement | Page views, interactions, aggregated technical data via Google Analytics, only after you agree | Understand how the Site is used | Consent | At most 14 months at Google; your choice is remembered in your browser |
| Bot protection | Technical signals analysed by Google reCAPTCHA on sign-up, sign-in, password reset and the contact form | Keep automated scripts out | Legitimate interest (security) | Not retained by Octopia |
| Technical logs | IP address, timestamp, request, errors; secrets are scrubbed before writing | Security, diagnostics | Legitimate interest (security) | At most 12 months |
We make no automated decision with legal effects about you, and we do not sell your data.
3. Recipients and processors
Your data is accessible only to the people at MG INNOVATIONS who need it, and to the following providers, each for the stated purpose:
| Provider | Role | Location |
|---|---|---|
| OVH SAS | Hosting of the Site, the application, the database and backups | France |
| Shopify Inc. | Your store; Octopia reads your catalog and writes to it only on your final decision. For merchants who installed Octopia from the Shopify App Store, Shopify also takes the payment for credit packs and invoices them | Canada (adequacy decision), United States |
| Stripe | Payment of credit packs, for merchants who signed up on octopia.pro | Ireland, United States |
| OpenAI | Language and vision models; calls are made without provider-side retention ("store: false") | United States |
| Analytics (after consent), reCAPTCHA, YouTube player in no-cookie mode — loaded only when you press play | Ireland, United States | |
| Canopy API, RapidAPI | Reading the Amazon and AliExpress supplier pages you provide as sources | United States |
4. Transfers outside the European Union
Data hosted by Octopia stays in France. Providers established outside the European Union are covered by an adequacy decision of the European Commission (Canada; the EU-US Data Privacy Framework where the provider is certified) or by the European Commission's standard contractual clauses.
5. Security
Encrypted connections (HTTPS), hashed passwords, Shopify tokens encrypted at rest, two-factor authentication and passkeys available, strict separation between organizations, daily database backups kept 14 days at the host, secrets scrubbed from logs. Octopia never publishes to your store without your explicit decision.
6. Cookies and local storage
| Name | Role | Lifetime | Needs your consent |
|---|---|---|---|
octopia_session | Your session (sign-in, chosen language, status messages) | Session, 2 hours of inactivity | No — strictly necessary |
XSRF-TOKEN | Protects forms against forged requests | Session | No — strictly necessary |
remember_web_* | "Remember me" at sign-in | Until you sign out | No — set at your request |
octopia.consent.v1 (local storage) | Remembers your answer to the measurement banner | Until changed | No — needed to honour your choice |
_ga, _ga_* | Google Analytics — audience measurement | At most 13 months | Yes — set only after "Accept" |
Nothing is measured and no measurement cookie is set until you accept. You can change your mind at any time through the "Cookies" link in the footer. The video player on the home page only calls YouTube when you press play.
7. Your rights
You have the rights of access, rectification, erasure, restriction, portability and objection, and the right to withdraw your consent to audience measurement at any time. To exercise them, use the contact form with the subject "Personal data"; we answer within one month. You may also lodge a complaint with the French supervisory authority, the CNIL (www.cnil.fr).
Your store and product data is processed on your behalf: you remain its controller, and Octopia acts as a processor for it.
8. Minors
Octopia is a professional service; it is not intended for anyone under 18.
9. Changes
This policy may evolve with the service. The date at the top marks the current version; a substantial change will be announced in the application.