Leer esta política en español (the Spanish version prevails)

Multicanal Sync Privacy Policy

Last updated: November 12, 2026. Courtesy translation of the Spanish policy, which prevails.

Multicanal Sync is an app by OberaLabs that connects a Shopify store with a Mercado Libre seller account and keeps products, stock, prices and sales in sync. This policy explains which personal data we process, why, who we share it with, how long we keep it and how to exercise your rights. It also covers the oberalabs.com website.

Merchant is the business that installs the app; buyer is the person who buys, asks or writes on Mercado Libre.

1. Who we are and our role

The controller is OberaLabs (oberalabs.com), an independent software studio based in Argentina. Privacy contact: privacidad@oberalabs.com.

For merchant data we are the controller. For buyer data we are a processor: we handle it on behalf of and under the instructions of the merchant, who decides what it is used for. If you are a buyer, your first contact for any question about your data is the store you bought from.

2. What data we process and why

• Merchant account data: store domain, contact email, Shopify session data and data of the connected Mercado Libre account, including the access credentials the platforms give us. To operate the account, sign in and send notifications.
• Catalogue data: products, variants, stock, prices and locations. To keep both channels in sync.
• Mercado Libre sales, questions and messages: buyer identification, shipping data, billing data and the text of questions and messages. To create the order in Shopify and show them to the merchant so they can ship, invoice and reply.
• Emails you send us: to answer support requests and data requests.

The app does not request permissions over the Shopify store's customer list. Buyer data arrives from Mercado Libre with each sale, question or message. We do not process sensitive data.

We do not sell personal data, use it for advertising or to profile people, or combine or share it across different stores.

3. Legal basis

We process merchant data to provide the service the merchant signs up for by installing the app. We process buyer data under the merchant's instructions; the merchant needs it to fulfil the sale and meet tax obligations, and is the one who informs buyers about its own use. We process contact emails to reply to you.

4. Artificial intelligence

The app uses language models from an external provider to suggest listing data from the product and to suggest answers to buyer questions. Every suggestion is reviewed and approved by the merchant before it is applied. The provider does not use what we send to train its models and deletes it within a short period. We make no automated decisions with legal or similarly significant effects on people.

5. Who we share data with

Shopify and Mercado Libre process store and sales data under their own policies (Shopify, Mercado Libre). To operate we use providers for hosting and database, email delivery, artificial intelligence models, and website and email, located in the United States. They process data only on our behalf, under contract and with security and confidentiality measures. The list naming each provider is available on request.

We may disclose data when a law, authority or court order requires it, to protect our rights and those of merchants, or in a sale or reorganisation of the business, notifying merchants beforehand.

6. International transfers

Data is processed in the United States, outside the merchant's and buyer's country. By installing the app, the merchant authorises this transfer, which is necessary to provide the service. If a merchant needs a data processing or transfer agreement to comply with its own law, it can request one at the privacy email.

7. How long we keep data

• On uninstall: we delete all the store's data, including buyer data and credentials, within the time limits Shopify sets.
• While the app is installed: we anonymise buyers' personal data 24 months after the sale, question or message. We keep the transaction data without personal data, needed for stock and sales to reconcile.
• Technical logs, backups and data held by providers: removed in short cycles of at most 30 days.
• Contact emails: up to 24 months after the request is closed.

8. Your rights

You can request access to your data, correct or update it, delete it, object to its processing, and withdraw any consent you gave, by writing to privacidad@oberalabs.com. Include a way to reply to you and, if you are a buyer, the sale number. We may ask for something that confirms your identity. Requests are free of charge.

If you are a buyer, the store you bought from decides about your data, so writing to them is the fastest path. The merchant can handle access and deletion requests from their buyers in the app, and we help when needed.

Withdrawing consent and limiting use: the merchant can turn off optional features, such as email notifications and AI suggestions, in the app at any time, and withdraw all consent by uninstalling it.

Argentina

Law 25.326: access requests are answered within 10 calendar days, and correction, update or deletion requests within 5 business days. Access is free at intervals of no less than six months, unless a legitimate interest is shown. The Agencia de Acceso a la Información Pública, as the supervisory body under Law 25.326, handles complaints from anyone whose rights are affected by a breach of the data protection rules in force. Website: argentina.gob.ar/aaip.

Mexico

You have the rights of access, rectification, cancellation and objection (ARCO) and to revoke consent, which we handle within the time limits set by law. The authority is the Secretaría Anticorrupción y Buen Gobierno.

Other countries

If Brazil's LGPD, the GDPR or a similar law applies to you, you also have the rights to portability and restriction, and to lodge a complaint with your country's authority. In any country we handle the rights your local law grants you in the same way.

9. Security

Data is encrypted in transit and at rest, including platform access credentials, which are additionally protected with application-level encryption. Production access is restricted and protected with two-factor authentication, every action on data is logged, and error logs contain no personal data. If an incident affects personal data, we notify affected merchants within 72 hours of confirming it.

10. Shopify mandatory webhooks

The app handles the three privacy webhooks Shopify requires: a customer data request, a customer deletion, and the store deletion on uninstall.

11. The oberalabs.com website

The website uses no cookies, analytics or trackers. The provider that serves it records technical data of each visit to operate and protect it. Inside Shopify, the app uses only the session Shopify gives it; it adds no cookies of its own.

12. Minors

The app and the website are aimed at businesses, not at people under 18.

13. Changes, governing law and contact

If we change this policy materially, we notify merchants by email at least 30 days in advance. Continuing to use the app after that period means accepting the new version. This policy is governed by the laws of the Argentine Republic and disputes are resolved before the ordinary courts of the City of Buenos Aires, without prejudice to the rights your local law grants you. The Spanish version prevails over this translation.

Questions: privacidad@oberalabs.com. Support: soporte@oberalabs.com.