01Roles and scope
TNL Medikal Sanayi Ticaret Limited Şirketi operates OwnBatch and determines how OwnBatch account and website data are used. When a merchant authorizes CataBatch to process shop catalog information, the exact controller or processor role depends on the specific processing activity and applicable law.
02Data categories and purpose
Relevant information can include account email and authentication state, Shopify shop identifiers, membership and access records, product, collection and image content, credit activity, authorized change jobs, support messages and operational security logs. Processing is limited to operating the selected OwnBatch service, securing access, maintaining account isolation and supporting the merchant.
03Service providers and safeguards
Cloudflare supports website delivery and security; Supabase supports authentication, database and backend operations; Shopify provides the authorized store platform and app billing. Providers may process information across borders according to their actual infrastructure and applicable safeguards. We use scoped access and merchant-level isolation and do not intentionally request customer or order data for core CataBatch catalog features.
04Retention periods
Valid account and shop-data deletion requests are completed within 30 days unless a legal retention obligation or another lawful exception applies. Support tickets, transaction histories and operational audit logs are retained for up to 90 days and then deleted or minimized, subject to mandatory tax, accounting, dispute and security requirements.
05Requests, deletion and Shopify compliance
Request access, correction, deletion or account closure by emailing [email protected] or [email protected]. We may verify the request before acting. Required Shopify customer-data requests, customer deletions and shop deletions must also be handled through the applicable Shopify privacy compliance workflows.
06Separate marketing consent
Promotional email consent is optional and separate from the service agreement or privacy acknowledgement. You can withdraw it at any time. Essential authentication, billing, security and service communications may still be sent where necessary.