Last updated: 28 July 2026
Privacy Policy & GDPR
M4 SAS provides the SEO Alpin application (“the Service”) to merchants using Shopify to manage their online stores. This Privacy Policy describes how personal information is collected, used, and shared when you install or use the Application in connection with your Shopify store.
A Note on GDPR
Privacy is a topic we take very seriously at M4 SAS. The General Data Protection Regulation (GDPR) came into effect on May 25, 2018. We are committed to complying with these regulations by providing full transparency and allowing users of our applications to request data deletion upon request.
Personal Information We Collect
When you install the Application, we automatically gain access to certain types of information from your Shopify account. The full list of permissions available through Shopify can be found here.
Additionally, we collect certain types of personal information from you and/or your customers once the Application is installed, such as visitor data, including IP addresses, web browser details, time zones, and information about cookies installed on their device.
We collect personal information directly from the relevant individual, through your Shopify account, or using the following technologies: “Cookies,” which are data files placed on your device or computer that often include an anonymous unique identifier. For more information about cookies and how to disable them, visit All About Cookies. “Log files,” which track actions occurring on the site and collect data such as your IP address, browser type, Internet service provider, referring/exit pages, and timestamps. “Web beacons,” “tags,” and “pixels,” which are electronic files used to record information about how you browse the site.
How We Use Your Personal Information
We use the personal information we collect from you and your customers in order to provide the Service and ensure the proper functioning of the Application. Additionally, we use this information to communicate with you, optimize and improve the Application, and provide you with information or marketing communications related to our products or services.
Sharing Your Personal Information
Your information is never shared for advertising purposes. However, we may share your personal information to comply with applicable laws and regulations, respond to a subpoena, search warrant, or other lawful requests for information, or otherwise protect our rights.
Your Rights
If you are a European resident, you have the right to access the personal information we hold about you and to request that it be corrected, updated, or deleted. If you would like to exercise this right, please contact us at contact@clickroad.fr.
Additionally, if you are a European resident, we note that we process your information in order to fulfill contracts we might have with you (for example, if you use our Service) or otherwise to pursue our legitimate business interests outlined above. Please also note that your information may be transferred outside of Europe, including to Canada and the United States.
Changes to This Policy
We may update this Privacy Policy from time to time in order to reflect, for example, changes to our practices or for other operational, legal, or regulatory reasons.
Google user data (Search Console and Google Analytics)
SEO Alpin connects to Google services only with your explicit consent, through Google’s official consent screen. We request the following scopes:
- Google Search Console (webmasters, siteverification): to read the search performance of your own store (queries, clicks, impressions, positions), to add the site ownership verification tag you ask us to add, and to register your site as a property, so the app can display your SEO performance and detect issues.
- Google Analytics (analytics.readonly): to read aggregated traffic and e-commerce metrics of your own GA4 property (sessions, purchases, purchase revenue per landing page), so the app can display the revenue generated by your organic search traffic. This scope is read-only: we never modify your Analytics data.
How we handle this data:
- We only access data from the Google properties you select, belonging to your own store.
- Data is aggregated per day and per page, and protected by the measures described in the “Data protection and security” section below.
- We never sell Google user data, never share it with third parties, and never use it for advertising. Access is limited to what is strictly necessary to provide the app’s features to you.
- OAuth tokens are stored encrypted server-side and are never exposed to your browser or to other merchants.
- You can disconnect Google Search Console or Google Analytics at any time from the app’s Settings page, or revoke access at https://myaccount.google.com/permissions. Upon disconnection or uninstall, the related data and tokens are deleted from our systems within 30 days at the latest, as described in the GDPR section above.
- SEO Alpin’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Data protection and security
We apply the following measures to protect all the data we process, including the Google user data obtained through the Search Console and Google Analytics scopes described above.
- Encryption in transit. All traffic between your browser, our servers, Shopify and the Google APIs is encrypted with TLS (HTTPS). Google user data is never transmitted over an unencrypted connection.
- Encryption of credentials at rest. Google OAuth access tokens and refresh tokens are encrypted with AES-256 before being written to our database, using an application key held outside the database. They are never exposed to your browser, to other merchants, or to any third party.
- Restricted access. Our production servers accept SSH key authentication only, password login is disabled, and the database is not reachable from the public internet. Access is limited to the authorised staff of M4 SAS who need it to operate and support the Service. Every application query is scoped to the authenticated store, so one merchant can never read another merchant’s Google data.
- Least privilege. We only request the Google scopes our features actually use. Google Analytics is requested read-only. Search Console access is used to read your search performance, to add the ownership verification tag you explicitly ask us to add, and to register your site as a property. We do not request any scope that no feature of the app uses.
- Retention and deletion. Google user data is kept only while the corresponding connection is active on your store. When you disconnect Google Search Console or Google Analytics from the app’s Settings page, revoke our access at https://myaccount.google.com/permissions, or uninstall SEO Alpin, the related data and OAuth tokens are deleted from our systems within 30 days at the latest.
- Monitoring and incident response. Production systems are monitored continuously and application errors raise automatic alerts. In the event of a personal data breach affecting your data, we notify the affected merchants and the French supervisory authority (CNIL) in accordance with Articles 33 and 34 of the GDPR, within 72 hours of becoming aware of it.
- No sale, no advertising, no model training. We never sell Google user data, never transfer it to third parties, never use it for advertising, and never use it to develop, improve or train generalised artificial intelligence or machine learning models. Human access to Google user data is limited to what you explicitly authorise for support purposes, to what is necessary for security investigations, and to what the law requires.
Contact Us
For more information about our privacy practices, or if you have any questions, please contact us by email at contact@clickroad.fr.
M4 SAS
131 Boulevard Pereire, 75017 Paris, France