Privacy Policy

MRP Discount · Last updated July 14, 2026

This Privacy Policy describes how MRP Discount ("the App", "we", "us") — provided by Durakart Marketing Private Limited — collects, uses, and shares information when a Shopify merchant installs and uses the App.

1. Information the App accesses

When a merchant installs the App, Shopify grants the App access to the following categories of shop data, strictly to provide the App's functionality:

• Discount codes — the App creates and reads discount codes it has created (Shopify scope write_discounts).
• Product data — the App reads product IDs, titles, images, and compare-at prices to display them in the discount-creation UI (Shopify scope read_products).
• Shop identifier — a Shopify-issued shop domain and access token are stored in the App's database so the App can call Shopify APIs on behalf of the shop.

The App does not access, request, or store customer personal data such as names, email addresses, shipping addresses, or payment information.

2. How the App uses information

All information accessed by the App is used solely to:

• Create and manage discount codes on the merchant's behalf.
• Display product and collection lists inside the App's admin UI.
• Authenticate the merchant's Shopify session.

We do not sell, rent, trade, or otherwise transfer merchant or shop data to any third party.

3. Data storage and retention

Session data (shop domain, access tokens) is stored in a PostgreSQL database hosted on Railway. This data is retained only for as long as the App remains installed on the merchant's shop.

When a merchant uninstalls the App, Shopify sends a shop/redact webhook 48 hours later. Upon receiving this webhook, the App deletes all associated session records from its database.

4. Customer data requests (GDPR / CCPA compliance)

The App implements Shopify's mandatory compliance webhooks:

• customers/data_request — acknowledged with HTTP 200. Because the App stores no customer data, no data can be returned.
• customers/redact — acknowledged with HTTP 200. Because the App stores no customer data, no deletion is required.
• shop/redact — the App deletes the shop's session records from its database.

5. Security

All communication between the App and Shopify occurs over HTTPS. Access tokens are stored encrypted at rest via the hosting provider's managed database service. Access to the database is restricted to the App's production process.

6. Third-party services

The App relies on the following third-party services to operate:

• Shopify — for authentication, discount management, and product data.
• Railway — for application hosting and database.

Each service has its own privacy policy governing how it handles data on our behalf.

7. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be reflected in the "Last updated" date at the top of this page.

8. Contact

Questions about this Privacy Policy or the App's data handling can be sent to support@durakart.in.

Durakart Marketing Private Limited · 32 Lake Temple Road, Kolkata 700029, India