Last Updated: September 07, 2026

Introduction

At Medusajs, we respect your privacy and are committed to protecting the personal data you provide us. This privacy policy explains how we collect, use, and store your information, specifically when you interact with us through forms and use our website or Medusa Cloud. This policy also describes our processing through the Medusa Cloud MCP connector in the section below. We may update this privacy policy from time to time. Any changes will be posted on this page, and we encourage you to review this policy periodically.

Who We Are

MedusaJS, Inc. ("we", "us", or "our") operates as a company that provides e-commerce solutions for developers and businesses. We value your privacy and comply with all applicable data protection regulations, including the General Data Protection Regulation (GDPR).

An Important Note: This Privacy Policy does not apply to any of the personal information that our customers may process using Medusajs products and services ("Customer Data"). Our customers’ respective privacy policies govern the collection and use of Customer Data. Our processing of Customer Data is governed by the contracts that we have in place with our customers, not this Privacy Policy. Any questions or requests relating to Customer Data should be directed to our customer.

What Data We Collect

We may collect and process the following types of personal data:

1. Personal Identification Information: When you fill out a form on our website, we collect your name, email address, company name, and any other information you provide in the form.
2. Usage Data: We collect information on how you interact with our website through cookies and similar tracking technologies. This includes your IP address, browser type, pages visited, and other anonymous data collected via website analytics tools.

How We Use Your Data

We use your personal data for the following purposes:

1. Marketing and Sales Communications: If you consent, we may use your contact details to send you information about our services, offers, or industry news. You can opt out of marketing communications at any time by clicking the "unsubscribe" link included in any marketing email or by contacting us directly.
2. Website Analytics: We use Google Analytics to analyze website traffic and improve our services. Google Analytics collects anonymized data about your interaction with our site.

Legal Basis for Processing

We process your personal data based on the following legal grounds:

1. Consent: By filling out a form and submitting your information, you consent to our use of your data for marketing purposes.
2. Legitimate Interest: We use anonymized usage data (e.g., through Google Analytics) to understand how our website is being used and to enhance the user experience.

Data Retention and Sharing

We will retain your personal data only as long as necessary to fulfill the purposes for which we collected it. Usage data collected via Google Analytics is retained as specified by Google's data retention policies.

We do not sell, trade, or otherwise transfer your personal data to outside parties except in the following cases:

• Service Providers: We may share data with third-party providers like Google Analytics to assist us in analyzing website usage.
• Medusa Cloud MCP: We may share data with connected AI services and service providers as described in the Medusa Cloud MCP section below.
• Legal Requirements: We may disclose personal data if required by law.

Opting Out of Marketing

If you no longer wish to receive marketing or sales communications from us, you can easily opt out by clicking the "unsubscribe" link in any marketing email we send. Additionally, you have the right to access, rectify, erase, object, and receive your data in a portable fashion.

Security of Your Data

We take appropriate measures to secure your personal data against unauthorized access, alteration, disclosure, or destruction.

Medusa Cloud MCP

The Medusa Cloud MCP connector lets you request information from your Medusa environment through a supported AI client, such as ChatGPT or Claude. We process Customer Data on your organization’s behalf under our customer agreement and Data Processing Addendum (https://medusajs.com/terms-of-service/dpa). The following explains that processing without replacing those agreements.

• Data and purposes: We process your Cloud user ID and email address, organization membership, selected project and environment, and authentication information to check and enable access. We process tool inputs to execute your requests and tool results to return the requested information. Inputs and results may contain personal data, including customer names, contact details, addresses, and order information. We also process tool-usage and diagnostic information to measure use and investigate failures.
• Recipients: Requests pass through Medusa to the selected Medusa environment, and results return to the connected AI client. Results sent to ChatGPT are received by OpenAI; results sent to Claude are received by Anthropic. These providers process information under their applicable terms, privacy policies, and your account settings. Our connector service providers include AWS and Vercel for infrastructure and PostHog for product analytics. We do not sell connector personal data or share it for advertising.
• Storage and retention: We retain connector data only for as long as necessary to authenticate and process requests, operate and secure the connector, investigate failures, and meet applicable legal obligations. Data held in the underlying store remains subject to the customer agreement and DPA. Information received by connected AI services is retained and used under their applicable terms, privacy policies, and account settings. Medusa does not control those providers’ retention or use of information for model training.
• Analytics and location: We use connector usage and diagnostic information, which may be linked to your Cloud user ID, to understand tool usage and investigate failures. Our infrastructure processes IP addresses when handling requests. Store records may contain location information, such as billing and shipping addresses. We do not use connector data for cross-site tracking or advertising profiling.
• Your control: You can disconnect the connector through your AI client’s settings or contact support@medusajs.com for help revoking access. Disconnecting does not delete information already held by your store, Medusa, or the connected AI service. Contact us to request access to or deletion of your connector account and usage information. Use the connected AI service’s privacy controls for information it holds. Requests concerning a merchant’s customer records should be directed to that merchant.
• Sensitive information: The connector is not intended to request sensitive or special-category personal data. Do not include payment-card details, protected health information, government identifiers, or authentication secrets in tool inputs or request their return. Authenticate through the supported connection flow. Store records may contain sensitive information, so only request information you are authorized to disclose to the connected service.
• Account and usage information: We act as controller for connector account and usage information. Where a legal basis is required, we rely on performance of a contract where necessary to provide a service under our agreement with you, our legitimate interests in administering and securing the service, and consent where required for optional analytics. You may withdraw consent or object to processing based on legitimate interests by contacting us. Customer Data remains governed by the DPA and the customer’s instructions.

Contact. For privacy questions, connector support, or security concerns, contact support@medusajs.com.