Store Hours, Vacation and Dispatch Times: Privacy Policy

1. Introduction

EvolRed ("we", "our", "us") builds apps for Shopify merchants. This Privacy Policy explains what data our Shopify apps access, where it is kept, why, for how long, and how to reach us.

This policy applies to the app named at the top of this page. The App Data Summary above lists exactly what that app accesses. For our company website, see evolred.com/privacy.

2. Who We Are

For store data an app handles on your behalf, you (the merchant) are the data controller and EvolRed is the data processor. For support requests (section 9), EvolRed is the controller.

For privacy enquiries, contact us at: [email protected]

3. Data We Access

Our apps read and write store data only through Shopify's APIs, and only within the access scopes you approve when you install the app. Each scope is listed on the App Store listing and in the App Data Summary. Depending on the app, this can include:

• Store information such as your store's myshopify address, name, time zone, currency and published languages.
• App settings that you enter in the app, such as opening hours or messages for shoppers.
• Product, inventory or order data, only when the app's job needs it and as stated in the App Data Summary.

We avoid Shopify's protected customer data (names, emails, addresses and phone numbers of your customers). If an app ever needs some of it, the App Data Summary names the exact fields, and the app goes through Shopify's data protection review first.

4. How We Use Your Data

Data is used only to:

• Provide the app's features as described on its page and App Store listing
• Keep your settings and apply them in your store
• Check your plan with Shopify, so paid features unlock for paid plans
• Answer support requests you send us (section 9)

We never use your data for:

• Advertising, marketing, or promotional purposes
• Profiling, behavioural analysis, or tracking of you or your shoppers
• Training machine learning models or AI systems
• Sale, rental, or commercial exchange with any third party
• Any purpose unrelated to the app's stated functionality

5. Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, we process personal data under the following legal bases:

• Contract performance (Article 6(1)(b) GDPR): processing is needed to provide the app you installed, free or paid.
• Legitimate interest (Article 6(1)(f) GDPR): keeping the app secure and working, and answering support requests.
• Consent: we do not rely on consent. If we ever introduce processing that needs it, we will ask for it first.

6. Where Data Is Kept

In your Shopify store. Wherever possible, an app keeps its settings in your store as app-owned data (metafields and metaobjects), hosted by Shopify. You can see them in your Shopify admin.

On our servers. To run, an app keeps a small amount of data on our servers, hosted on Cloudflare (Workers, the D1 database and Queues):

• Your store's myshopify address, whether the app is installed, and your app plan
• The access token Shopify issues to the app, encrypted at rest
• The IDs of webhooks already processed, so none runs twice
• Short error messages for your store, kept 30 days to help with support. They say what failed and where, never order or customer details

Unless the App Data Summary says otherwise, our servers hold no data about your customers.

7. Data Retention

• When you uninstall the app, it stops all work for your store immediately and deletes its access token.
• 48 hours after uninstall, Shopify asks us to erase your store's data. We then delete everything we hold for your store.
• Error messages are deleted after 30 days.
• Settings saved in your store are app-owned data under Shopify's control, and Shopify's rules for app-owned data apply after uninstall.

We keep no backups or archives of store data beyond what is listed here.

8. Data Sharing and Third Parties

We do not sell, rent, trade, or otherwise share your data. Data is processed only by:

• Shopify, which runs the platform the app is installed on and handles app billing. See the Shopify Privacy Policy and the Shopify API License and Terms of Use.
• Cloudflare, which hosts our servers. See the Cloudflare Data Processing Addendum.

Unless the App Data Summary says otherwise, our apps do not include:

• Third-party analytics or telemetry (no Google Analytics, Mixpanel, Amplitude, etc.)
• Advertising networks or tracking pixels
• Social media widgets or share buttons
• Calls to any other external service

9. Support Requests

Support requests go through our support portal at support.evolred.com, which is separate from the app.

• What we store: your name, your email address, the text of your request and our replies, plus anything you choose to add, such as attachments.
• From inside the app: when you send a request from the app's Support page, it also includes your store's myshopify address and the app version, plus store details that help us find the problem: your Shopify plan, time zone, country, currency and store language, your app plan and install date, your theme's name and whether the app's theme block is on, the app page you came from, your browser, up to 20 of the app's settings and up to 5 recent app errors. None of these details are about your customers. Nothing is sent until you press Send.
• Why we store it: to answer your request and keep track of it until it is resolved. The legal basis is our legitimate interest in supporting our apps (Article 6(1)(f) GDPR) and, for paid plans, performing our agreement with you (Article 6(1)(b) GDPR).
• How long we keep it: until 24 months after the request is closed. It is then deleted automatically, attachments included. To have it deleted sooner, email [email protected].
• Sub-processors: Cloudflare (Workers hosting, the D1 database and R2 file storage in Cloudflare's EU jurisdiction, Email Routing and email sending, Access for staff sign-in, and the Turnstile bot check) and Plunk (sending support emails).

10. Shopify Privacy Requests

Every app answers Shopify's three mandatory privacy webhooks, even when it stores no customer data:

• Customer data request: when one of your customers asks for their data, we tell you what the app holds about them (normally nothing).
• Customer erasure: when a customer asks to be erased, we delete anything the app holds about them.
• Store erasure: 48 hours after you uninstall, we delete everything held for your store (section 7).

11. Data Security

• Encrypted tokens: access tokens are encrypted at rest.
• Verified requests: every webhook is checked against Shopify's signature, and every request from the app's admin pages is checked against a Shopify session token.
• Minimum access: each app asks only for the access scopes it needs, and we document why.
• No theme edits: our apps add to your storefront only through Shopify theme app extensions, which you can turn off, and never edit your theme files.
• No secrets in code, no personal data in logs, and dependencies audited before each release.

12. Your Rights Under GDPR

If you are located in the EEA, UK, or Switzerland, you have the following rights:

Right	What It Means	How to Exercise
Access	Request a copy of personal data we process about you	Email [email protected]
Rectification	Request correction of inaccurate data	Update it in the app or contact us
Erasure	Request deletion of your personal data	Uninstall the app (we delete store data 48 hours later) or email us
Restriction	Request that we limit processing of your data	Email [email protected]
Portability	Receive your data in a machine-readable format	Email [email protected]
Objection	Object to processing based on legitimate interest	Email [email protected]

Your customers exercise their rights through you, as the store owner. Shopify passes their requests to us through the webhooks in section 10.

We respond to all privacy requests within 30 days. If we need more time, we will tell you within 30 days and explain why.

13. Your Rights Under CCPA/CPRA (California)

If you are a California resident, you have the right to know what personal information we hold about you, to have it deleted, and not to be discriminated against for exercising your rights. We do not sell personal information, so no opt-out is needed.

To exercise any of these rights, email [email protected] with the subject line "CCPA Request".

14. International Data Transfers

Cloudflare runs a global network, so data on our app servers may be processed outside the EEA. Those transfers are covered by Cloudflare's Data Processing Addendum and the EU Standard Contractual Clauses. Support requests are stored in Cloudflare's EU jurisdiction (section 9). Data in your store is handled by Shopify under its own terms.

15. Cookies and Tracking

The app's admin pages run inside your Shopify admin and sign in with Shopify's session tokens, not tracking cookies of ours. Unless the App Data Summary says otherwise, our storefront blocks set no cookies and don't track your shoppers.

16. Children's Privacy

Our apps are made for businesses. We do not knowingly collect data from anyone under 16. If you believe we have, contact [email protected] and we will delete it.

17. Data Breach Notification

If a breach affects personal data we process, we will:

1. Tell affected merchants without undue delay, so you can meet your own obligations to your customers
2. Notify the relevant supervisory authority within 72 hours of becoming aware of it, where GDPR requires us to
3. Document the breach, its effects, and what we did about it

18. Changes to This Policy

When we change this policy, we update the Effective Date in the App Data Summary and note material changes in the app's changelog. We will not reduce your rights under this policy without your explicit consent.

19. Contact

For privacy questions, data requests, or complaints:

Email: [email protected]

We aim to reply to privacy enquiries within 5 business days and to resolve data requests within 30 days. If you are not satisfied with our response, you can complain to your local data protection authority.