Privacy Policy

1. Data We Collect

We collect only the data necessary to provide the Service:

• Account data: Name, email address, and hashed password when you create an account.
• Store data: Your Shopify store URL and storefront password (encrypted at rest) when you create a share link.
• Visit data: IP address (hashed), approximate location (country/city), browser, and device type for each visit to a share link — used to power your analytics dashboard.
• Usage data: Pages visited, actions taken, and timestamps — used to improve the Service.
• Analytics: We use Google Analytics (GA4) to collect anonymised usage statistics. See Google's Privacy Policy.

2. How We Use Your Data

We use your data to:

• Authenticate share links and grant visitors access to your store.
• Provide your visitor analytics dashboard.
• Send transactional emails (email verification, password reset).
• Detect and prevent abuse and fraud.
• Improve and operate the Service.

We do not sell, rent, or share your personal data with third parties for marketing purposes.

3. Data Storage & Security

Your data is stored in a MongoDB database. Storefront passwords are encrypted at rest using AES-256 encryption and are never stored in plaintext. Account passwords are hashed using bcrypt and are never recoverable.

We implement industry-standard security practices including HTTPS, encrypted connections, and access controls. However, no system is entirely immune to attack. We will notify you promptly in the event of a data breach affecting your account.

4. Data Retention

We retain your account data for as long as your account is active. If you delete your account, your personal data is permanently deleted within 30 days, with the exception of data we are legally required to retain.

Visit log data (anonymised analytics) may be retained in aggregate form after account deletion.

5. Cookies

We use a single session cookie to keep you logged in. This cookie is HTTP-only, secure, and does not track you across other websites.

Google Analytics uses cookies to distinguish users. You can opt out via the Google Analytics Opt-out Browser Add-on or by enabling Do Not Track in your browser.

6. Third-Party Services

We use the following third-party services:

• Resend — transactional email delivery. Your email address is shared with Resend solely for email delivery.
• Google Analytics — anonymised usage analytics.

These providers are bound by their own privacy policies and data processing agreements.

7. Your Rights

Depending on your jurisdiction, you may have the following rights:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate data.
• Deletion: Request deletion of your account and associated data.
• Portability: Request your data in a machine-readable format.
• Objection: Object to processing of your data in certain circumstances.

To exercise any of these rights, contact us at legal@shopipreview.dev. We will respond within 30 days.

8. GDPR & International Users

If you are located in the European Economic Area (EEA), we process your data under the legal bases of contract performance (to provide the Service) and legitimate interest (to prevent fraud and improve the Service). You have the right to lodge a complaint with your local data protection authority.

9. Children's Privacy

The Service is not directed at children under the age of 18. We do not knowingly collect data from minors. If you believe we have inadvertently collected such data, contact us immediately.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or a notice on the site. Continued use of the Service after changes take effect constitutes acceptance of the updated policy.

11. Contact

For privacy-related questions or requests, contact us at legal@shopipreview.dev.