Effective date: [[EFFECTIVE DATE]]
1.1. TinyIcons (referenced below as "the App") is an app for Shopify stores that adds icon and badge blocks to a store's theme. The App is provided by [[COMPANY LEGAL NAME]], [[COMPANY ADDRESS]] (referenced below as "we" or "us").
1.2. This Privacy Policy explains what information the App collects when a Shopify merchant (referenced below as "you") installs and uses it, how we use that information, who we share it with and how long we keep it.
1.3. For the information about your store described in section 2 we are the data controller. If you have any questions or requests about your data, contact us at [[CONTACT EMAIL]].
2.1. When you install the App, Shopify gives us access to your store and we store the following information about it:
2.2. When you use the App, we store the content you create in it: your icon blocks (titles, texts, links, styles and placement settings), the icon images you upload, the products and collections you select to limit where a block is shown, and your App settings.
2.3. The App asks Shopify only for permission to read products. It has no access to your themes, your customers or your orders.
3.1. The App does not collect or store personal data about your store's customers or visitors.
3.2. To show your icon blocks, the App's script on your storefront requests the block content from our server. The request contains your store's domain, the IDs of the blocks on the page and, when a block is limited to certain collections, the ID of the product being viewed. It contains nothing that identifies the visitor, and the App sets no cookies on your storefront.
3.3. As with any website, the visitor's browser sends its IP address and browser details with that request. The App does not store them; they may appear in our web server's access logs, which are kept for [[ACCESS LOG RETENTION PERIOD]] and used only for security and troubleshooting.
3.4. Shopify may forward us a customer's request to see or erase their data. Because the App holds no customer data, there is nothing to return or erase; we keep a record of the request, including the identifiers Shopify includes in it, as proof that it was handled.
4.1. We use the information described in section 2 to:
4.2. We process this information because it is necessary to provide the App you installed (performance of a contract) and, for support, error tracking and security, on the basis of our legitimate interest in running a reliable and secure service.
4.3. We do not sell your information, use it for advertising, or send you marketing newsletters.
5.1. We share information only with the service providers we need to run the App:
| Provider | Purpose | Data |
|---|---|---|
| Shopify | The platform the App runs on. Your store information comes from Shopify, and the App writes your icon blocks to your store through the Shopify API. | Store information and App content |
| Crisp | The support chat inside the App. | Store domain, store email address and the messages you send |
| Sentry | Error tracking, so we can find and fix bugs. | Technical details of errors, which may include your store's domain |
| [[HOSTING PROVIDER]] | Hosting of the App's servers and database. | All information described in section 2 |
5.2. Some of these providers may process data outside your country, including in the United States. Where data is transferred outside the EEA or the UK, the transfer relies on an adequacy decision or on the provider's Standard Contractual Clauses.
5.3. We may also disclose information when the law requires us to.
6.1. We keep your store's information while the App is installed.
6.2. When you uninstall the App, Shopify revokes its access to your store. 48 hours after the uninstall, Shopify sends us a request to erase your store's data (the shop/redact webhook), and we then delete your store's information, tokens, icon blocks and uploaded icons.
6.3. Deleted data may remain in our database backups for up to [[BACKUP RETENTION PERIOD]], after which the backups are overwritten.
6.4. Support conversations are kept in Crisp, and error reports in Sentry for [[SENTRY RETENTION PERIOD]]. You can ask us to delete your support conversations at any time.
7.1. Under the GDPR and similar laws you have the right to access the information we hold about you, to have it corrected or erased, to restrict or object to its processing, and to receive it in a portable format.
7.2. To use any of these rights, contact us at [[CONTACT EMAIL]]. We reply within one month.
7.3. You also have the right to lodge a complaint with your local data protection authority.
8.1. All traffic to and from the App is encrypted (HTTPS), and access to the App's servers and database is restricted to the people who maintain the App.
9.1. The App does not set cookies of its own: it runs inside your Shopify admin and authenticates you with Shopify session tokens. The Crisp support chat stores cookies and local storage in your browser to keep your conversation. The App sets no cookies on your storefront.
10.1. We may update this Privacy Policy. When we do, we change the effective date above, and we tell you about significant changes by email or in the App.
11.1. [[COMPANY LEGAL NAME]], [[COMPANY ADDRESS]], [[CONTACT EMAIL]].