Privacy Policy

This Privacy Policy describes how OptionWise ("we", "us", or "our") collects, uses, and shares information when you install or use the OptionWise application (the "App") on your Shopify store. We are committed to handling merchant and customer data responsibly and in accordance with applicable data-protection laws, including the GDPR and the CCPA.

1. Information we collect

From the merchant (you). When you install the App, Shopify provides us with information necessary to operate the App, including:

• Your shop's myshopify domain and store ID
• Your shop's contact email, name, and country
• An OAuth access token authorising the App to call Shopify APIs on your behalf
• Information about your products, variants, and metafields, used to power option configuration

From your store's customers. The App renders configurable product options on your product pages. When a customer selects options and adds an item to cart, their selections are stored by Shopify as line-item properties on the order. We do not store customer names, email addresses, payment information, or any other personal information separately from Shopify.

Automatically. Like most web services, we record basic technical information for security and reliability purposes. We keep a server-side log of requests to this website: the page address, the time, the referring site, the approximate country and city (derived from the IP address at our hosting provider's edge), and the browser and device type. The IP address itself is not stored. Instead, it is combined with the browser identifier and a secret that rotates daily into a one-way hash that cannot be reversed and changes every day, so visitors are counted per day but never tracked over time. Requests that identify themselves as automated (crawlers and AI assistants rather than a browser) are the one exception: their IP address is checked against the operator's published address ranges to confirm the claim, then discarded. No cookies are used for this. We also use a first-party cookie to understand whether an install originated from our website. This does not identify you and is not shared with third parties.

2. How we use information

• To operate, maintain, and improve the App's features
• To communicate with you about the App, including support requests and service updates
• To detect, prevent, and respond to security incidents, fraud, or abuse
• To comply with our legal obligations

3. How we share information

We do not sell your information or your customers' information. We share information only with:

• Shopify — to read from and write to your store via the Shopify Admin API.
• Subprocessors we use to run the App: cloud hosting providers and database providers. We provide these subprocessors only with the minimum information required to perform their function.
• Authorities — when required by law, subpoena, or other valid legal process.
• Successors — in connection with a merger, acquisition, or sale of assets, subject to equivalent privacy protections.

4. Data retention

We retain your shop's configuration data — option sets, pricing rules, and similar settings — for as long as the App remains installed on your store, and through the brief window between uninstall and Shopify's shop/redact webhook (typically 48 hours after uninstall). When we receive a shop/redact webhook from Shopify for your store, we delete the shop's data from our systems within 30 days, except where retention is required by law or to resolve disputes. Because we do not store customer personal information separately from Shopify (see Section 1), there is no customer-level data for us to retain.

5. Your rights

Depending on your location, you may have rights to access, correct, export, or delete personal information we hold about you, and to object to or restrict certain processing. To exercise these rights, contact us using the details below. Customers of Shopify stores using the App should direct such requests to the merchant in the first instance.

6. Compliance webhooks

The App responds to Shopify's mandatory compliance webhooks:

• customers/data_request — we do not store customer personal information separately from Shopify, so we have no data to provide.
• customers/redact — no separate customer data is held; the webhook is acknowledged and no deletion is required.
• shop/redact — delivered approximately 48 hours after a shop uninstalls the App. On receipt, we delete the shop's configuration data within 30 days.

7. Security

We use industry-standard administrative, technical, and physical safeguards to protect information. Data is transmitted over TLS, access tokens are stored encrypted at rest, and access to production systems is limited to authorised personnel.

8. International transfers

The App is operated from servers that may be located outside your country of residence. By using the App, you consent to the transfer of information to those countries, which may have different data-protection rules than your own.

9. Children's privacy

The App is not directed to children under 16, and we do not knowingly collect personal information from them.

10. Changes to this policy

We may update this Privacy Policy from time to time.

11. Contact

Questions or requests about this policy can be sent to privacy@optionwise.ai.