Legal
Data Processing
This page sets out the terms on which Vitrine processes personal data on your behalf, and names every third party involved. It forms part of the Terms of Service and should be read with the Privacy Policy.
Who is controller, who is processor
Vitrine is operated by [legal entity name].
- For your customers' personal data — anything that reaches us because a shopper used the app you published — you are the controller and we are your processor. You decide what the app does; we carry it out.
- For the data we need to run your account and the service itself — your shop domain, owner email, and our logs — we are a controller, and the Privacy Policy governs it.
- Shopify is an independent controller of the store data it holds. Your agreement with Shopify governs that.
Scope of the processing
| Categories of data | Data subjects | Purpose | Duration |
|---|---|---|---|
| Shop identifiers, shop owner email, access tokens | You and your staff | Provisioning and operating your store's app | While installed, then as described in the Privacy Policy |
| Push notification tokens and platform | Your customers who opted into notifications | Delivering the notifications you send | Until the store record is deleted, or the token is rejected |
| Customer access tokens (in transit only) | Your signed-in customers | Passing a shopper's request to Shopify on their behalf | Not stored — held only for the duration of the request |
| Order, address and profile data (in transit only) | Your signed-in customers | Showing a shopper their own orders and addresses | Not stored — read from Shopify and returned to the device |
| Shopper IP address (in transit only) | Your customers | Forwarded to Shopify so rate limits apply per shopper | Not retained in our database |
| Notification history and counts | Aggregate — no individual recipients | Showing you what you sent and what was accepted | Until the store record is deleted |
We do not request or receive your order records or your customer list. Vitrine's Shopify permissions cover reading products and the unauthenticated Storefront operations the app needs for cart, checkout and customer sign-in.
Acting on your instructions
We process your customers' personal data only to provide the service, only as described here and in the Privacy Policy, and only as configured by you in the builder. We do not use it for our own purposes, do not sell it, and do not use it to train models. If we believe an instruction from you would breach data protection law, we will tell you rather than carry it out silently.
Subprocessors
These are the third parties that may process store or shopper data. The list is complete as of the date at the top of this page.
| Subprocessor | What it does | Data involved | Location |
|---|---|---|---|
| Shopify Inc. | Source of the catalogue, holder of carts, customer accounts and orders, and the processor of checkout | Everything about your store and your customers' purchases | Canada, United States and global |
| Expo (Expo push service, 650 Industries, Inc.) | Delivers push notifications to devices, through Apple's and Google's notification services | Device push tokens, and the title and body of each notification | United States |
| Apple Inc. and Google LLC | The operating-system notification services that reach the device | Device push tokens and notification payloads | United States and global |
| [hosting provider] | Runs our application server, database and cache | All data described in the scope table above | [region] |
| [email provider, if any] | Sends service email — support replies and policy notices | Your email address and the content of the message | [region] |
We run no third-party analytics, no advertising services and no session-recording tools, so none appear on this list.
Changing a subprocessor
Before adding or replacing a subprocessor that would process your customers' personal data, we will update this page and notify installed merchants by email at least [notice period, e.g. 30 days] in advance. If you object on reasonable data protection grounds, tell us within that window; if we cannot resolve it, you may uninstall and ask us to delete your data, and we will.
Security measures
The technical and organisational measures we take are set out on the Security page, which is written to be specific rather than reassuring — it also lists what we have not finished. In summary: TLS in transit, signature verification on every request from Shopify, session-token authentication for the embedded app, a database that is not reachable from the internet, least Shopify permissions, and no shopper account credentials stored at all.
People with access
Access to production data is limited to the people who operate the service, and only where needed to run or repair it. Everyone with access is bound by confidentiality obligations. Vitrine is currently operated by a small team, which we state plainly because it is relevant to how you assess this page.
Data subject requests
If one of your customers exercises a right against you, we will help you answer it. Because their account, orders and addresses live in Shopify rather than with us, usually there is nothing on our side to export; what we may hold is a push token for their device, which we can delete on request. Email [email protected] and we will respond within [response window, e.g. 10 business days]. If a shopper contacts us directly, we will refer them to you and tell you.
Shopify's compliance webhooks
Shopify requires apps to answer three mandatory requests, and Vitrine answers all three:
- Customer data request — we record that the request arrived. We hold no shopper profile to export; their data is in Shopify, which answers for it.
- Customer redaction — there is no shopper record on our side to erase. Any push token belonging to that shopper's device stops working once the app is removed, and can be deleted on request.
- Shop redaction — we delete the store and everything attached to it: themes, versions, devices and notification history.
Each of these is verified by signature before it is acted on.
If something goes wrong
If we become aware of a personal data breach affecting data we process for you, we will notify you without undue delay and in any case within [e.g. 48 hours] of becoming aware, with what we know: what happened, which categories of data and roughly how many people are affected, what we are doing about it, and what we recommend you do. We will keep you updated as the picture becomes clearer rather than waiting to have a complete one.
International transfers
Our servers are in [hosting region]. Shopify, Expo, Apple and Google operate internationally, so data may be transferred outside the European Economic Area and the United Kingdom. Where that happens we rely on the transfer mechanisms those providers offer — the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, or an adequacy decision where one applies — together with the measures on the Security page.
Return and deletion
When you uninstall, our access tokens are revoked immediately and your store stops being served. Themes and version history are retained for a period so that reinstalling restores your published app, and deleted after it — the timings are on the Privacy Policy. You can ask for immediate deletion, or for an export of your theme documents, at any time.
Audits and information
We will provide the information reasonably needed to demonstrate compliance with this page, and answer security questionnaires within reason. We do not currently hold an ISO 27001 or SOC 2 certification, and we would rather say so than imply one.
Contact
[legal entity name]
[registered address]
[email protected]