Privacy Policy

Last updated: 1 November 2026

This policy explains how Grovlix LTD, a company registered in England and Wales (company number 17552126), registered address Suite 2309, 60 Tottenham Court Road, Area 1/1, Fitzrovia, London, W1T 2EW, United Kingdom ("we", "us"), collects, uses and protects personal data in PopAutomate: the website popautomate.com (including the help center and the blog), the PopAutomate dashboard, and the PopAutomate apps for Salla, Zid and Shopify. We are the controller of the merchant data described here.

In short

PopAutomate schedules changes to your products: prices, discounts, categories or collections, promotional text and visibility. It reads your products and changes them only as your schedules say.
PopAutomate does not read or store orders, customers or any data about your shoppers, and adds nothing to your storefront.
On Shopify we ask for two permissions only: write_products and write_publications.
When you uninstall from Shopify we delete your shop's data 48 hours later, unless you install the app again before then.
We do not sell personal data.

Data we collect from merchants

Account data: on Salla and Zid, the name, email address and mobile number your platform shares with us when you install the app, your store name and address, and your user and store identifiers on the platform. On Shopify, see PopAutomate on Shopify.
Platform connection: the access tokens your platform issues to PopAutomate, kept in access-restricted databases. Shopify tokens are also encrypted.
Schedules and settings: the schedules and rules you create, the products and categories they target, files you upload for bulk schedules (CSV or Excel), discount permit numbers and dates you save, reminders, alert preferences, time zone and language.
Run history: for each run, the time, the result, and each changed product's value before and after the change, so we can put the original values back and show you what changed.
Support: the messages, email address or WhatsApp number you use when you contact us.
Technical data: IP address, browser type and request logs when you use our website and dashboard, kept for security and troubleshooting.

What PopAutomate reads from and changes in your store

PopAutomate only uses the access your platform grants when you install it.

Salla and Zid: PopAutomate uses the product and category permissions you approve at install, with offline access so your schedules run while you are away. It reads your products (name, SKU, price, sale price, image, categories, visibility, stock and sold counts) and your categories, and changes prices, sale prices, categories, promotional text and product visibility exactly as your schedules say, then restores the original values when a schedule ends. It does not read orders or customers.
Shopify: see PopAutomate on Shopify.

PopAutomate on Shopify

PopAutomate: Sale Scheduler runs inside your Shopify admin and changes your products only as your schedules say. It adds no script, theme code or app block to your storefront and never sees your shoppers. The app inside your Shopify admin loads no analytics or advertising trackers.

Permissions (access scopes) we ask for, and why:

write_products (includes reading products): to list your products, variants and collections, read stock levels, change variant prices and compare-at prices, add products to or remove them from collections, and put the original values back when a schedule ends.
write_publications: to publish or hide products on your Online Store sales channel when a schedule says so, without changing the product's status on other channels.

We do not ask for access to orders, customers, checkouts or any other protected customer data.

What we store for your shop:

your shop's myshopify.com address and the access token Shopify issues to the app (encrypted);
your shop's currency, time zone, country and the countries it ships to, read from your Shopify settings so schedules run in your local time and the seasonal calendar matches your markets;
the products and variants your schedules target (IDs, names, SKUs, prices, images, collections and visibility), and each variant's price and compare-at price before and after every run, so we can restore them and show you every change;
your schedules and settings, and a log of each run (time, result and any error);
your plan and subscription status, which Shopify tells us.

We do not store your shop owner's name, email address or phone number.

Shopify's privacy webhooks:

customers/data_request and customers/redact: PopAutomate holds no data about your customers, so there is nothing to export or delete. We record that the request arrived and answer Shopify.
shop/redact, which Shopify sends 48 hours after you uninstall the app: we delete all the data listed above for your shop, including your schedules, run history and uploaded files. If you have installed the app again by then, we keep your data, because you are using it again.

When you uninstall: we drop your access tokens straight away and pause all your schedules. Your data stays until Shopify's shop/redact request 48 hours later. If you reinstall within those 48 hours, your data is still there, and your schedules stay paused until you turn them back on.

Your store's shoppers

PopAutomate works on your products only. It does not run on your storefront and does not collect, receive or store any data about your shoppers or customers.

Payments

You pay for PopAutomate through your platform: the Salla App Store, the Zid App Market, or Shopify, which bills PopAutomate through Shopify App Pricing on your Shopify invoice. Your platform takes the payment and keeps the payment data under its own privacy policy. We do not receive or store your card details. The platform tells us the plan you chose and the subscription status, so we can turn PopAutomate's features on or off.

How we use data and our legal bases

To run your schedules, provide and secure PopAutomate, run your account and support you (performance of a contract, and our legitimate interests).
To send service emails, such as alerts when a run fails or your store disconnects, and reminders you set (contract, legitimate interests). You can turn alert emails off in the dashboard settings.
To understand and improve how our website and dashboard are used (legitimate interests, or consent where the law requires it).
To measure which marketing brings merchants to PopAutomate (legitimate interests, or consent where the law requires it).
To meet legal duties and protect our rights (legal obligation, legitimate interests).

We do not sell personal data, and we do not use your store data to train AI models.

Who receives data

These service providers process data for us under contract (as processors), described by their role and location:

Recipient	What for	Data involved
A hosting provider in the EU (servers in France)	Hosting popautomate.com, the dashboard and their databases	All service data; IP addresses in server logs
A content delivery and security network	DNS, content delivery and firewall	IP address, browser and page data
An email delivery provider	Sign-in, password reset and alert emails	Email address, name and email content
Analytics and advertising providers, named in Cookies	Usage analytics and ad measurement on our website and dashboard	Pages, clicks, browser and cookie data
Internal team communication tools	Alerts to our team when a run fails	Store identifier, schedule and error details

Your store platform (Salla, Zid or Shopify) is not on this list: it is an independent controller under its own privacy policy, and PopAutomate exchanges store data with it as described above. We may also disclose data where the law requires it or to protect our rights. If we are part of a merger or sale, data may transfer to the new owner under this policy.

International transfers

Our hosting provider's servers are in France. Some of our service providers, such as the analytics and advertising providers and our content delivery network, process data in other countries, including the United States. For transfers out of the UK and the European Economic Area we rely on the EU-US Data Privacy Framework and its UK extension where the provider is certified under it, and otherwise on standard contractual clauses.

If you are in Saudi Arabia, your personal data is transferred and processed outside the Kingdom: on our hosting provider's servers in France and by the providers above in the countries where they operate.

Cookies and browser storage

Necessary: laravel_session and XSRF-TOKEN keep you signed in and protect forms (they expire after 2 hours of inactivity).
Attribution: our own cookie pa_attr (90 days) records the page, campaign or site that brought you to popautomate.com, so we can tell which marketing leads to app installs.
Analytics and advertising: our website and dashboard load Google Tag Manager, which loads Google Analytics (_ga and _ga_*, up to 2 years) and advertising measurement tags from ad networks we use, such as Google, X, TikTok and Snapchat, and Hotjar (_hjSessionUser_* and _hjSession_*, up to 1 year). These companies receive the data their cookies collect, under their own privacy policies.
Shopify: the PopAutomate app inside your Shopify admin uses no analytics or advertising cookies.

You can block or delete cookies in your browser settings. Some parts of the dashboard will then not work.

How long we keep data

Account, store and schedule data: while your account is active.
Shopify: deleted 48 hours after you uninstall, unless you reinstall first (see PopAutomate on Shopify).
Salla and Zid: when you uninstall, your schedules stop running. We keep your data so it is there if you install again, and delete it when you ask us to.
Deletion requests are completed within 30 days, except records we must keep for tax, accounting, fraud prevention or legal claims. Aggregated statistics that no longer identify anyone may be kept.

Security

We use encryption in transit (HTTPS), one-way hashing of passwords, encryption of Shopify access tokens, access-restricted databases and monitoring. No system is completely secure, so we cannot guarantee absolute security.

Your rights

Depending on where you live (including under the UK GDPR, the EU GDPR and the Saudi Personal Data Protection Law), you may have the right to access, correct, delete or export your personal data, to object to or restrict some processing, to withdraw consent, and to complain to your data protection authority. Email support@popautomate.com from the address on your account, or with your store address. We may ask you to confirm your identity.

Grovlix LTD is established in the United Kingdom, so the UK GDPR and the Data Protection Act 2018 apply to the personal data we control; users in the EEA keep equivalent rights under the EU GDPR. You have the right to:

access the personal data we hold about you and get a copy;
have inaccurate data corrected;
have your data erased, unless we must keep it by law;
receive your data in a structured, machine-readable form and have it transferred to another provider;
object to processing based on our legitimate interests, and to direct marketing at any time;
withdraw consent at any time, without affecting what happened before.

We answer within one month. For complex or numerous requests the law allows us to extend that by up to two further months; if we do, we will tell you within the first month and explain why. You also have the right to complain to the Information Commissioner's Office (ICO), ico.org.uk, or to the authority in the EEA country where you live or work.

Children

PopAutomate is for businesses and is not directed to people under 18. We do not knowingly collect personal data from children.

Changes to this policy

We may update this policy. We will tell you about material changes by email or with a notice in the dashboard. The date at the top shows the latest version.

Language

This policy is written in English and translated into Arabic. If the two versions differ, the English version governs.

Contact us

Email: support@popautomate.com
Data controller: Grovlix LTD, a company registered in England and Wales (company number 17552126), Suite 2309, 60 Tottenham Court Road, Area 1/1, Fitzrovia, London, W1T 2EW, United Kingdom

See also the Terms of Service and the Refund Policy.