Last updated: 14 July 2026
PassGMC is operated by Toval Holdings (ABN 16 155 716 770). PassGMC helps Shopify merchants check their stores for Google Merchant Center readiness and prepare reinstatement appeals. This policy explains what information we collect, how we use it, who we share it with, and the choices you have. The short version: we collect the minimum needed to run your scans and account, we never sell your data, and you can delete everything yourself at any time.
Information we collect
Account information. You sign in with Google, and we receive your name and email address. We never see or store a password, because sign-in is handled entirely by Google.
Information you provide. The store URLs you add, the Merchant Center settings you choose to enter for comparison, your answers to back-office checklist questions, and any messages you send through our contact form.
Screenshots are read once, then deleted. If you attach a screenshot during attestation, it is analysed once to verify its content, and only the verdict is kept. The image itself is discarded immediately and is never stored on our servers.
Purchase records. When you buy a scan pack, payment is processed by Stripe on their secure checkout. We receive confirmation of the purchase and keep a record of your scan balance and invoices. We never see or store your full card number.
Collected automatically. Essential cookies that keep you signed in, a short-lived referral cookie if you arrive through an affiliate link, and standard technical logs used for security and error monitoring. Our error monitoring is configured to strip personal details before anything is recorded.
What our scanner reads
Scans analyse the publicly available pages of the store URL you provide, the same pages any visitor or search engine can see. We never ask for your store's admin login, the Google account that manages your Merchant Center, or any other administrative access to your systems.
How we use your information
We use your information to run scans and generate your reports and appeal packages, to process payments and maintain your scan balance, to send transactional email such as receipts and report-ready notices, to respond to your messages, and to keep the service secure. Scan content is processed by our AI provider solely to produce your report's findings; it is not used to train their models. If you opt in to marketing email, every message includes an unsubscribe link, and unsubscribing is instant.
Who we share information with
We share information only with the service providers needed to operate PassGMC: Stripe (payments), Supabase (database and file storage), Vercel (hosting), Resend (email delivery), Anthropic (AI analysis of scan content), Cloudflare (bot protection on our contact form), and Sentry (error monitoring, with personal details scrubbed). Each provider receives only what it needs to do its job. We do not sell your personal information, and we do not share it for advertising.
We may disclose information if required by law, or as part of a business transfer, in which case this policy would continue to apply to your data.
Affiliate programme data
If you join our affiliate programme, we additionally store your referral code, visit and conversion statistics, and the payment details you provide for payouts. Referral attribution uses a cookie that lasts 15 days. The affiliate programme has its own privacy page with full details.
Data retention and deletion
We keep your account data while your account is active. You can permanently delete your account yourself from Account settings, behind a typed confirmation. Deletion erases your profile, stores, scan history, reports, and attestations, and revokes our connection to your Google sign-in. Anonymised invoice records are retained where tax and accounting rules require. Screenshots, as above, are never stored at all.
Security
All traffic is encrypted in transit. Access to production systems is restricted, sign-in is delegated to Google rather than passwords, and payments never touch our servers.
Your rights
You can access and correct your details in Account settings, delete your account entirely, and unsubscribe from marketing at any time. Depending on where you live, you may have additional rights, such as requesting a copy of your data or objecting to certain processing. Contact us through our contact page and we will honour these requests.
Children
PassGMC is a business tool and is not directed at anyone under 18. We do not knowingly collect information from children.
Changes to this policy
If we make material changes, we will update this page and revise the date at the top. Continued use of the service after changes take effect means you accept the updated policy.
Contact
PassGMC is operated by Toval Holdings (ABN 16 155 716 770). Questions about privacy? Reach us through our contact page and we will get back to you promptly.