Privacy Policy

How AIMarketOps collects, uses, and protects your data.

Effective date: 27 May 2026

Last updated: 9 October 2026

1. Who we are

AIMarketOps ("AIM", "we", "us", "our") is a multichannel operations application operated by Kent Traders Ltd, registered in England & Wales, trading address 27 Oakfield Park Road, Dartford, DA1 2SR, United Kingdom. Kent Traders Ltd also sells on Amazon, eBay and Shopify and uses AIMarketOps for its own business.

AIMarketOps is offered in two forms:

AIMarketOps Connect — a read-only Shopify merchant dashboard installed from the Shopify App Store.
AIMarketOps platform accounts — a seller connects its own Amazon, eBay and Shopify selling accounts by authorisation, and uses AIMarketOps to import orders, track stock, reconcile settlements and fees, and make listing, price or stock changes that the seller approves.

For the purposes of UK GDPR and EU GDPR, Kent Traders Ltd is the data controller for the account data described in this policy (for example your name, email address and sign-in records). When AIMarketOps processes order and customer data from a selling account that you connect or a store that installs AIMarketOps Connect, you (the seller or merchant) are the controller and Kent Traders Ltd acts as your data processor.

2. Data we collect

2.1 Data you provide directly

Embedded app authorization: short-lived Shopify App Bridge session tokens, validated per request
Platform account sign-in: name, email address, and either a password (stored only as a one-way hash) with an authenticator-app code, or Google sign-in; we do not see or store your Google password
Communications: support emails you send to us

2.2 Data from your Shopify store(s) via the OAuth-authorized AIMarketOps Connect app

When you install AIMarketOps Connect on a Shopify store, we receive the following via the Shopify Admin API in accordance with the scopes you approved at install:

Products: product titles, descriptions, variants, SKUs, prices and inventory quantities.
Orders: order identifiers, line items, totals, dates, currency, financial status and fulfillment status.

The public Shopify app does not request or intentionally persist customer names, email addresses, phone numbers, shipping addresses or billing addresses. Product/order synchronization drops customer identity and address fields before storage.

2.3 Data from selling accounts you connect to an AIMarketOps platform account

We import data only from accounts that you authorise, and only for your own workspace.

Amazon (Selling Partner API, authorised by you in Seller Central): orders and order items (order identifiers, SKUs, quantities, prices, fees, dates and status) and the ship-to city, region, postcode and country that Amazon provides with them; listings, catalogue and pricing data; inventory and fulfilment status; settlement and financial-event data; and your seller account's marketplace participation. We do not request Amazon's restricted roles, and we do not retrieve Amazon buyer names, street addresses, email addresses or phone numbers through Selling Partner API.
eBay and Shopify (authorised by you): orders, listings and stock for your own account, including the delivery name and address that the marketplace provides so that you can dispatch your own orders.
Multichannel tools you already use and authorise (for example Veeqo or SellerDynamics): your own order and fulfilment records from those tools, which can include the delivery name and address needed to dispatch your orders.
Authorisation tokens for each connection are stored encrypted and are never displayed in full.

We use delivery names and addresses only to fulfil, track, return and account for the order they belong to.

2.4 Features not enabled for Shopify App Store merchants

The Shopify App Store merchant account exposes only a dashboard and read-only product/order views. It does not enable Amazon, eBay, SellerDynamics, Google Workspace, banking, content publishing, billing administration or AI operations.

2.5 Data we collect automatically

Authentication and session-token validation data, in-app activity (page views, feature usage)
Audit log entries describing your actions inside the platform
IP address, browser type, operating system, device identifiers
Cookies and similar technologies (see §11)

3. How we use your data

| Purpose | Lawful basis (UK/EU GDPR) | |---|---| | Provide the AIM service | Contract | | Import and synchronize your read-only Shopify dashboard | Contract | | Import, reconcile and report orders, stock, listings and settlements from selling accounts you connect | Contract | | Make listing, price or stock changes that you approve | Contract | | Authenticate users + prevent unauthorized access | Legitimate interest; Legal obligation | | Email digests + in-app notifications | Contract | | Support communications | Contract | | Compliance with marketplace, HMRC and GDPR requests | Legal obligation | | Send service announcements + product updates | Legitimate interest (opt-out at any time) |

We use data imported from a marketplace only to provide AIMarketOps to the seller who authorised it. We do not use data imported from Amazon or eBay to contact or market to their buyers, and we do not combine one seller's data with another seller's.

4. AI features

AI features are not available in the Shopify App Store merchant surface. We do not send data imported by the public Shopify app to AI providers as part of the read-only dashboard service.

In AIMarketOps platform accounts, optional AI analysis features send the product, order or listing data needed for the analysis you ask for to our AI providers (see §7), who process it on our behalf.

5. Sharing and disclosure

We share data with:

Sub-processors providing infrastructure or services on our behalf under contract (see §7)
Shopify — for app installation, billing, and compliance webhooks
Marketplaces you connect (Amazon, eBay, Shopify) — to retrieve your data and to make the changes you approve
Government or law-enforcement authorities when required by valid legal process

We do not sell personal data. We do not share data with advertisers. We do not disclose data from a marketplace to any other party for that party's own use.

6. International data transfers

Data is stored in:

Neon PostgreSQL — Frankfurt, EU (primary database)
Vercel — London (lhr1), serving the application
Redis — same region as application For necessary transfers outside the UK/EU (for example to AI or email providers), we rely on appropriate contractual safeguards. Lists of sub-processors and their regions are maintained at §7.

7. Sub-processors

| Sub-processor | Purpose | Region | |---|---|---| | Neon | PostgreSQL hosting | EU (Frankfurt) | | Vercel | App hosting | EU (London) | | Upstash / Redis | Cache + queue | EU | | Shopify | OAuth + commerce data | Global | | Sentry | Error monitoring (when enabled) | EU | | Resend | Transactional email to your own staff (platform accounts) | Outside UK/EU possible (§6 safeguards) | | Anthropic | Optional AI analysis (platform accounts only) | United States | | OpenAI | Optional AI analysis (platform accounts only) | United States |

We notify you at least 30 days before adding any new sub-processor that materially affects your data. You may object via contact@kenttraders.co.uk.

8. Data retention

| Data type | Retention | |---|---| | Embedded merchant principal and tenant binding | While the app is installed | | Audit log entries | 90 days hot + 1 year archive, then anonymized | | Shopify product/order dashboard data | While AIMarketOps Connect is installed. On a Shopify erasure request we immediately remove credentials and customer-identifying/raw payload fields; required non-personal financial record headers may be retained only where legally required. | | Authorisation for a selling account you connect | Until you disconnect it. Disconnecting in AIMarketOps revokes and clears the stored authorisation immediately and stops imports. | | Data imported from selling accounts you connect | While your platform account is active, to provide order, stock and financial reporting. Deleted within 30 days of your request or of your account closing. | | Support tickets | 3 years | | Billing records | 7 years (UK tax law) | | Logs containing IP / device identifiers | 30 days |

You may request earlier deletion at any time per §10.

9. Security

We maintain commercially reasonable administrative, technical, and physical safeguards including:

TLS 1.2+ for all data in transit
Encryption at rest for sensitive fields (Shopify access tokens, marketplace OAuth refresh tokens) using AES-256
Role-based access control with multi-tenant row-level isolation
Shopify App Bridge session-token authentication for the embedded merchant surface
Password sign-in requires a 12-character password with mixed character types, an authenticator-app code, and a password change at least every 365 days
Audit log for every mutating action
A written incident response plan with named roles and reviews at least every six months
Independent penetration test: planned, not yet completed
SOC 2 Type II in roadmap (target 2027 Q1)

No system is perfectly secure. In the event of a personal-data breach, we will notify the relevant data-protection authority within 72 hours and affected individuals without undue delay where required. Security incidents involving data from a connected marketplace are also reported to that marketplace as its terms require (for Amazon, to Amazon's security team within 24 hours of detection).

10. Your rights

Under UK GDPR / EU GDPR you have the right to:

Access your personal data
Rectify inaccurate data
Erase your data
Restrict processing
Object to processing based on legitimate interest
Portability (machine-readable export)
Withdraw consent at any time
Lodge a complaint with the UK ICO (ico.org.uk) or your local DPA

To exercise any of these rights, email contact@kenttraders.co.uk. We will respond within 30 days.

If you are a Shopify merchant, Shopify's mandatory erasure webhooks trigger deletion or anonymisation of affected Shopify-derived records and revocation of app credentials.

You can disconnect a selling account at any time on the Marketplace connections page in AIMarketOps, or withdraw the authorisation from the marketplace itself (for Amazon: Seller Central → Apps and Services → Manage Your Apps).

11. Cookies

The embedded Shopify merchant surface authenticates each data request with a Shopify App Bridge session token and does not require third-party authentication cookies or local storage. Platform account sign-in uses strictly necessary authentication and CSRF cookies. We do not use analytics cookies on the AIM product itself. The marketing website (aimarketops.com) uses Vercel Speed Insights and Analytics for performance monitoring; you can opt out via the cookie banner.

12. California residents (CCPA / CPRA)

If you are a California resident, you have additional rights including:

The right to know what categories of personal information we collect
The right to delete personal information
The right to opt out of "sales" (we do not sell personal information)
The right to limit use of sensitive personal information
Non-discrimination

To exercise these rights, email contact@kenttraders.co.uk.

13. Children

AIM is not intended for individuals under 16. We do not knowingly collect data from children. If you believe we have collected data from a child, email us and we will delete it.

14. Changes to this policy

We will post material changes at least 14 days before they take effect, and email registered users for changes that materially expand our data use.

The 9 October 2026 update describes AIMarketOps platform accounts and the selling accounts sellers connect to them. It does not change how AIMarketOps Connect (Shopify App Store) processes data.

15. Contact

Kent Traders Ltd 27 Oakfield Park Road Dartford, DA1 2SR United Kingdom

Contact (general, privacy, DPO): contact@kenttraders.co.uk

AIMarketOps Back to home

Privacy Policy

How AIMarketOps collects, uses, and protects your data.

Effective date: 27 May 2026

Last updated: 9 October 2026

1. Who we are

AIMarketOps is offered in two forms:

AIMarketOps Connect — a read-only Shopify merchant dashboard installed from the Shopify App Store.
AIMarketOps platform accounts — a seller connects its own Amazon, eBay and Shopify selling accounts by authorisation, and uses AIMarketOps to import orders, track stock, reconcile settlements and fees, and make listing, price or stock changes that the seller approves.

2. Data we collect

2.1 Data you provide directly

Embedded app authorization: short-lived Shopify App Bridge session tokens, validated per request
Platform account sign-in: name, email address, and either a password (stored only as a one-way hash) with an authenticator-app code, or Google sign-in; we do not see or store your Google password
Communications: support emails you send to us

2.2 Data from your Shopify store(s) via the OAuth-authorized AIMarketOps Connect app

When you install AIMarketOps Connect on a Shopify store, we receive the following via the Shopify Admin API in accordance with the scopes you approved at install:

Products: product titles, descriptions, variants, SKUs, prices and inventory quantities.
Orders: order identifiers, line items, totals, dates, currency, financial status and fulfillment status.

2.3 Data from selling accounts you connect to an AIMarketOps platform account

We import data only from accounts that you authorise, and only for your own workspace.

Amazon (Selling Partner API, authorised by you in Seller Central): orders and order items (order identifiers, SKUs, quantities, prices, fees, dates and status) and the ship-to city, region, postcode and country that Amazon provides with them; listings, catalogue and pricing data; inventory and fulfilment status; settlement and financial-event data; and your seller account's marketplace participation. We do not request Amazon's restricted roles, and we do not retrieve Amazon buyer names, street addresses, email addresses or phone numbers through Selling Partner API.
eBay and Shopify (authorised by you): orders, listings and stock for your own account, including the delivery name and address that the marketplace provides so that you can dispatch your own orders.
Multichannel tools you already use and authorise (for example Veeqo or SellerDynamics): your own order and fulfilment records from those tools, which can include the delivery name and address needed to dispatch your orders.
Authorisation tokens for each connection are stored encrypted and are never displayed in full.

We use delivery names and addresses only to fulfil, track, return and account for the order they belong to.

2.4 Features not enabled for Shopify App Store merchants

2.5 Data we collect automatically

Authentication and session-token validation data, in-app activity (page views, feature usage)
Audit log entries describing your actions inside the platform
IP address, browser type, operating system, device identifiers
Cookies and similar technologies (see §11)

3. How we use your data

4. AI features

AI features are not available in the Shopify App Store merchant surface. We do not send data imported by the public Shopify app to AI providers as part of the read-only dashboard service.

5. Sharing and disclosure

We share data with:

Sub-processors providing infrastructure or services on our behalf under contract (see §7)
Shopify — for app installation, billing, and compliance webhooks
Marketplaces you connect (Amazon, eBay, Shopify) — to retrieve your data and to make the changes you approve
Government or law-enforcement authorities when required by valid legal process

We do not sell personal data. We do not share data with advertisers. We do not disclose data from a marketplace to any other party for that party's own use.

6. International data transfers

Data is stored in:

Neon PostgreSQL — Frankfurt, EU (primary database)
Vercel — London (lhr1), serving the application
Redis — same region as application For necessary transfers outside the UK/EU (for example to AI or email providers), we rely on appropriate contractual safeguards. Lists of sub-processors and their regions are maintained at §7.

7. Sub-processors

We notify you at least 30 days before adding any new sub-processor that materially affects your data. You may object via contact@kenttraders.co.uk.

8. Data retention

You may request earlier deletion at any time per §10.

9. Security

We maintain commercially reasonable administrative, technical, and physical safeguards including:

TLS 1.2+ for all data in transit
Encryption at rest for sensitive fields (Shopify access tokens, marketplace OAuth refresh tokens) using AES-256
Role-based access control with multi-tenant row-level isolation
Shopify App Bridge session-token authentication for the embedded merchant surface
Password sign-in requires a 12-character password with mixed character types, an authenticator-app code, and a password change at least every 365 days
Audit log for every mutating action
A written incident response plan with named roles and reviews at least every six months
Independent penetration test: planned, not yet completed
SOC 2 Type II in roadmap (target 2027 Q1)

10. Your rights

Under UK GDPR / EU GDPR you have the right to:

Access your personal data
Rectify inaccurate data
Erase your data
Restrict processing
Object to processing based on legitimate interest
Portability (machine-readable export)
Withdraw consent at any time
Lodge a complaint with the UK ICO (ico.org.uk) or your local DPA

To exercise any of these rights, email contact@kenttraders.co.uk. We will respond within 30 days.

If you are a Shopify merchant, Shopify's mandatory erasure webhooks trigger deletion or anonymisation of affected Shopify-derived records and revocation of app credentials.

11. Cookies

12. California residents (CCPA / CPRA)

If you are a California resident, you have additional rights including:

The right to know what categories of personal information we collect
The right to delete personal information
The right to opt out of "sales" (we do not sell personal information)
The right to limit use of sensitive personal information
Non-discrimination

To exercise these rights, email contact@kenttraders.co.uk.

13. Children

AIM is not intended for individuals under 16. We do not knowingly collect data from children. If you believe we have collected data from a child, email us and we will delete it.

14. Changes to this policy

We will post material changes at least 14 days before they take effect, and email registered users for changes that materially expand our data use.

The 9 October 2026 update describes AIMarketOps platform accounts and the selling accounts sellers connect to them. It does not change how AIMarketOps Connect (Shopify App Store) processes data.

15. Contact

Kent Traders Ltd 27 Oakfield Park Road Dartford, DA1 2SR United Kingdom

Contact (general, privacy, DPO): contact@kenttraders.co.uk

AIMarketOps Back to home

Privacy Policy

How AIMarketOps collects, uses, and protects your data.

Effective date: 27 May 2026

Last updated: 9 October 2026

1. Who we are

AIMarketOps is offered in two forms:

AIMarketOps Connect — a read-only Shopify merchant dashboard installed from the Shopify App Store.
AIMarketOps platform accounts — a seller connects its own Amazon, eBay and Shopify selling accounts by authorisation, and uses AIMarketOps to import orders, track stock, reconcile settlements and fees, and make listing, price or stock changes that the seller approves.

2. Data we collect

2.1 Data you provide directly

Embedded app authorization: short-lived Shopify App Bridge session tokens, validated per request
Platform account sign-in: name, email address, and either a password (stored only as a one-way hash) with an authenticator-app code, or Google sign-in; we do not see or store your Google password
Communications: support emails you send to us

2.2 Data from your Shopify store(s) via the OAuth-authorized AIMarketOps Connect app

When you install AIMarketOps Connect on a Shopify store, we receive the following via the Shopify Admin API in accordance with the scopes you approved at install:

Products: product titles, descriptions, variants, SKUs, prices and inventory quantities.
Orders: order identifiers, line items, totals, dates, currency, financial status and fulfillment status.

2.3 Data from selling accounts you connect to an AIMarketOps platform account

We import data only from accounts that you authorise, and only for your own workspace.

Amazon (Selling Partner API, authorised by you in Seller Central): orders and order items (order identifiers, SKUs, quantities, prices, fees, dates and status) and the ship-to city, region, postcode and country that Amazon provides with them; listings, catalogue and pricing data; inventory and fulfilment status; settlement and financial-event data; and your seller account's marketplace participation. We do not request Amazon's restricted roles, and we do not retrieve Amazon buyer names, street addresses, email addresses or phone numbers through Selling Partner API.
eBay and Shopify (authorised by you): orders, listings and stock for your own account, including the delivery name and address that the marketplace provides so that you can dispatch your own orders.
Multichannel tools you already use and authorise (for example Veeqo or SellerDynamics): your own order and fulfilment records from those tools, which can include the delivery name and address needed to dispatch your orders.
Authorisation tokens for each connection are stored encrypted and are never displayed in full.

We use delivery names and addresses only to fulfil, track, return and account for the order they belong to.

2.4 Features not enabled for Shopify App Store merchants

2.5 Data we collect automatically

Authentication and session-token validation data, in-app activity (page views, feature usage)
Audit log entries describing your actions inside the platform
IP address, browser type, operating system, device identifiers
Cookies and similar technologies (see §11)

3. How we use your data

4. AI features

AI features are not available in the Shopify App Store merchant surface. We do not send data imported by the public Shopify app to AI providers as part of the read-only dashboard service.

5. Sharing and disclosure

We share data with:

Sub-processors providing infrastructure or services on our behalf under contract (see §7)
Shopify — for app installation, billing, and compliance webhooks
Marketplaces you connect (Amazon, eBay, Shopify) — to retrieve your data and to make the changes you approve
Government or law-enforcement authorities when required by valid legal process

We do not sell personal data. We do not share data with advertisers. We do not disclose data from a marketplace to any other party for that party's own use.

6. International data transfers

Data is stored in:

Neon PostgreSQL — Frankfurt, EU (primary database)
Vercel — London (lhr1), serving the application
Redis — same region as application For necessary transfers outside the UK/EU (for example to AI or email providers), we rely on appropriate contractual safeguards. Lists of sub-processors and their regions are maintained at §7.

7. Sub-processors

We notify you at least 30 days before adding any new sub-processor that materially affects your data. You may object via contact@kenttraders.co.uk.

8. Data retention

You may request earlier deletion at any time per §10.

9. Security

We maintain commercially reasonable administrative, technical, and physical safeguards including:

TLS 1.2+ for all data in transit
Encryption at rest for sensitive fields (Shopify access tokens, marketplace OAuth refresh tokens) using AES-256
Role-based access control with multi-tenant row-level isolation
Shopify App Bridge session-token authentication for the embedded merchant surface
Password sign-in requires a 12-character password with mixed character types, an authenticator-app code, and a password change at least every 365 days
Audit log for every mutating action
A written incident response plan with named roles and reviews at least every six months
Independent penetration test: planned, not yet completed
SOC 2 Type II in roadmap (target 2027 Q1)

10. Your rights

Under UK GDPR / EU GDPR you have the right to:

Access your personal data
Rectify inaccurate data
Erase your data
Restrict processing
Object to processing based on legitimate interest
Portability (machine-readable export)
Withdraw consent at any time
Lodge a complaint with the UK ICO (ico.org.uk) or your local DPA

To exercise any of these rights, email contact@kenttraders.co.uk. We will respond within 30 days.

If you are a Shopify merchant, Shopify's mandatory erasure webhooks trigger deletion or anonymisation of affected Shopify-derived records and revocation of app credentials.

11. Cookies

12. California residents (CCPA / CPRA)

If you are a California resident, you have additional rights including:

The right to know what categories of personal information we collect
The right to delete personal information
The right to opt out of "sales" (we do not sell personal information)
The right to limit use of sensitive personal information
Non-discrimination

To exercise these rights, email contact@kenttraders.co.uk.

13. Children

AIM is not intended for individuals under 16. We do not knowingly collect data from children. If you believe we have collected data from a child, email us and we will delete it.

14. Changes to this policy

We will post material changes at least 14 days before they take effect, and email registered users for changes that materially expand our data use.

The 9 October 2026 update describes AIMarketOps platform accounts and the selling accounts sellers connect to them. It does not change how AIMarketOps Connect (Shopify App Store) processes data.

15. Contact

Kent Traders Ltd 27 Oakfield Park Road Dartford, DA1 2SR United Kingdom

Contact (general, privacy, DPO): contact@kenttraders.co.uk

AIMarketOps Back to home

Privacy Policy

How AIMarketOps collects, uses, and protects your data.

Effective date: 27 May 2026

Last updated: 9 October 2026

1. Who we are

AIMarketOps is offered in two forms:

AIMarketOps Connect — a read-only Shopify merchant dashboard installed from the Shopify App Store.
AIMarketOps platform accounts — a seller connects its own Amazon, eBay and Shopify selling accounts by authorisation, and uses AIMarketOps to import orders, track stock, reconcile settlements and fees, and make listing, price or stock changes that the seller approves.

2. Data we collect

2.1 Data you provide directly

Embedded app authorization: short-lived Shopify App Bridge session tokens, validated per request
Platform account sign-in: name, email address, and either a password (stored only as a one-way hash) with an authenticator-app code, or Google sign-in; we do not see or store your Google password
Communications: support emails you send to us

2.2 Data from your Shopify store(s) via the OAuth-authorized AIMarketOps Connect app

When you install AIMarketOps Connect on a Shopify store, we receive the following via the Shopify Admin API in accordance with the scopes you approved at install:

Products: product titles, descriptions, variants, SKUs, prices and inventory quantities.
Orders: order identifiers, line items, totals, dates, currency, financial status and fulfillment status.

2.3 Data from selling accounts you connect to an AIMarketOps platform account

We import data only from accounts that you authorise, and only for your own workspace.

Amazon (Selling Partner API, authorised by you in Seller Central): orders and order items (order identifiers, SKUs, quantities, prices, fees, dates and status) and the ship-to city, region, postcode and country that Amazon provides with them; listings, catalogue and pricing data; inventory and fulfilment status; settlement and financial-event data; and your seller account's marketplace participation. We do not request Amazon's restricted roles, and we do not retrieve Amazon buyer names, street addresses, email addresses or phone numbers through Selling Partner API.
eBay and Shopify (authorised by you): orders, listings and stock for your own account, including the delivery name and address that the marketplace provides so that you can dispatch your own orders.
Multichannel tools you already use and authorise (for example Veeqo or SellerDynamics): your own order and fulfilment records from those tools, which can include the delivery name and address needed to dispatch your orders.
Authorisation tokens for each connection are stored encrypted and are never displayed in full.

We use delivery names and addresses only to fulfil, track, return and account for the order they belong to.

2.4 Features not enabled for Shopify App Store merchants

2.5 Data we collect automatically

Authentication and session-token validation data, in-app activity (page views, feature usage)
Audit log entries describing your actions inside the platform
IP address, browser type, operating system, device identifiers
Cookies and similar technologies (see §11)

3. How we use your data

4. AI features

AI features are not available in the Shopify App Store merchant surface. We do not send data imported by the public Shopify app to AI providers as part of the read-only dashboard service.

5. Sharing and disclosure

We share data with:

Sub-processors providing infrastructure or services on our behalf under contract (see §7)
Shopify — for app installation, billing, and compliance webhooks
Marketplaces you connect (Amazon, eBay, Shopify) — to retrieve your data and to make the changes you approve
Government or law-enforcement authorities when required by valid legal process

We do not sell personal data. We do not share data with advertisers. We do not disclose data from a marketplace to any other party for that party's own use.

6. International data transfers

Data is stored in:

Neon PostgreSQL — Frankfurt, EU (primary database)
Vercel — London (lhr1), serving the application
Redis — same region as application For necessary transfers outside the UK/EU (for example to AI or email providers), we rely on appropriate contractual safeguards. Lists of sub-processors and their regions are maintained at §7.

7. Sub-processors

We notify you at least 30 days before adding any new sub-processor that materially affects your data. You may object via contact@kenttraders.co.uk.

8. Data retention

You may request earlier deletion at any time per §10.

9. Security

We maintain commercially reasonable administrative, technical, and physical safeguards including:

TLS 1.2+ for all data in transit
Encryption at rest for sensitive fields (Shopify access tokens, marketplace OAuth refresh tokens) using AES-256
Role-based access control with multi-tenant row-level isolation
Shopify App Bridge session-token authentication for the embedded merchant surface
Password sign-in requires a 12-character password with mixed character types, an authenticator-app code, and a password change at least every 365 days
Audit log for every mutating action
A written incident response plan with named roles and reviews at least every six months
Independent penetration test: planned, not yet completed
SOC 2 Type II in roadmap (target 2027 Q1)

10. Your rights

Under UK GDPR / EU GDPR you have the right to:

Access your personal data
Rectify inaccurate data
Erase your data
Restrict processing
Object to processing based on legitimate interest
Portability (machine-readable export)
Withdraw consent at any time
Lodge a complaint with the UK ICO (ico.org.uk) or your local DPA

To exercise any of these rights, email contact@kenttraders.co.uk. We will respond within 30 days.

If you are a Shopify merchant, Shopify's mandatory erasure webhooks trigger deletion or anonymisation of affected Shopify-derived records and revocation of app credentials.

11. Cookies

12. California residents (CCPA / CPRA)

If you are a California resident, you have additional rights including:

The right to know what categories of personal information we collect
The right to delete personal information
The right to opt out of "sales" (we do not sell personal information)
The right to limit use of sensitive personal information
Non-discrimination

To exercise these rights, email contact@kenttraders.co.uk.

13. Children

AIM is not intended for individuals under 16. We do not knowingly collect data from children. If you believe we have collected data from a child, email us and we will delete it.

14. Changes to this policy

We will post material changes at least 14 days before they take effect, and email registered users for changes that materially expand our data use.

The 9 October 2026 update describes AIMarketOps platform accounts and the selling accounts sellers connect to them. It does not change how AIMarketOps Connect (Shopify App Store) processes data.

15. Contact

Kent Traders Ltd 27 Oakfield Park Road Dartford, DA1 2SR United Kingdom

Contact (general, privacy, DPO): contact@kenttraders.co.uk