Privacy Policy

Who we are

Vitrine is a Shopify app that publishes a native iOS and Android app for a Shopify store and provides a home-screen builder inside the Shopify admin. It is operated by [legal entity name], registered at [registered address].

This policy explains what the Vitrine service collects, why, who else sees it, and how to get it removed. It covers the marketing site at vitrine.swonie.com, the builder embedded in the Shopify admin, our API, and the mobile apps published through Vitrine.

For the merchant data we hold to run your account, we act as a controller. For the data your customers generate inside the app you publish, we act as a processor on your instructions — see Data Processing.

What we collect, in short

Data	Where it comes from	Why
Shop name, myshopify.com domain, shop owner email, currency, country	Shopify Admin API, once, at install	To identify your store and serve the right catalogue and currency
A Shopify Admin API access token and a Storefront API access token	Issued by Shopify when you approve the install	To read your catalogue and to set up the app on your behalf
Your theme drafts and published versions	You, in the builder	To render your app and to let you roll back
Push notification tokens for devices that opted in	The mobile app, with the shopper's permission	To deliver the notifications you send
Notification history: title, body, target, counts	You, in the builder	To show what was sent and what the push service accepted
Server logs	Automatic	Security, debugging, and a record that compliance requests arrived

Store and account data

When you install Vitrine, Shopify asks you to approve a set of permissions. Once you do, we read your shop's name, permanent myshopify.com domain, owner email address, currency and country from the Shopify Admin API, and store them so the app knows which store it belongs to and which currency to show.

We also store, for each store:

A Shopify Admin API access token. Short-lived and refreshed as needed. Used only while you are using the app — to read your shop and to create the Storefront token and webhook subscriptions. Nothing runs against your store in the background.
A Storefront API access token that Vitrine creates in your store under the name "Vitrine". This is what the mobile app's catalogue requests use. It stays on our server and is never included in the app your customers download.
The permissions Shopify actually granted, so a missing one can be detected and re-consented instead of surfacing later as a broken feature.
Install and uninstall timestamps, and a public store key — a random identifier that selects your store and grants no privileges on its own.

An account record is created alongside it, holding your email address. Where Shopify does not return an owner email we synthesise a placeholder from your shop domain rather than asking you for one. If you separately created a Vitrine account with a password, we store a one-way hash of that password — never the password itself.

Content you create

Themes you build are stored as documents: section layouts, headings and body text, image URLs, the product and collection handles you selected, colours, corner radius, type scale, your logo URL, and your menu and tab bar configuration. Every publish is kept as a version so you can roll back, which means earlier drafts and published versions are retained until the store record is deleted.

Push campaigns are stored as the title, body, where the notification opens, when it was sent, how many devices it targeted, and how many the push service accepted or rejected. We do not store which individual device received which message.

Your customers' data

The app you publish is used by your customers, and this is the part of the policy that matters most. We designed the app to keep shopper data with Shopify rather than accumulating it here.

Sign-in. When a shopper signs in, Shopify issues a customer access token. The token is held on the shopper's device and sent with each request so we can pass it to Shopify. We do not store it.
Orders, addresses and profile. Read live from Shopify with that token and returned to the device. Not copied into our database.
Cart. Held entirely in Shopify. The device remembers only the cart's identifier so it can be reopened.
Push tokens. If a shopper allows notifications, the app registers a push token issued by the notification service, together with the platform (iOS or Android) and the time it was last seen. This is a device identifier, not a person: it carries no name, email or purchase history.
IP address. A shopper's IP address is forwarded to Shopify with catalogue requests so that Shopify applies rate limits per shopper rather than per server. We do not retain it in the database.
Recently viewed products. Stored on the device only. It does not follow a shopper to another device, because keeping browsing history against an identity is a decision we would rather not make on your behalf.
Catalogue caching. Product and collection responses are cached briefly (two minutes by default) so the app is fast. The cache holds catalogue data, not personal data.

What we do not collect

We do not request access to your orders or your customer lists.
We have no write access to your products, prices or inventory.
We do not handle payment details. Checkout is Shopify's, end to end.
We run no advertising, no third-party analytics and no tracking pixels.
This website sets no cookies and loads nothing from a third party — see the Cookie Policy.
We do not sell or rent personal data, and we never will.

Logs and diagnostics

Our servers keep operational logs. They record request paths, shop domains, error messages returned by Shopify, and events such as an install completing or a webhook being rejected for a bad signature. Access tokens are never written to logs.

When Shopify sends one of the mandatory compliance webhooks — a customer data request, a customer redaction or a shop redaction — we log the identifiers the webhook contains so there is a record that the request arrived and was answered. Logs are retained for [retention period, e.g. 30 days].

Why we process it

Where the GDPR or a similar law applies, our grounds are:

Performing our contract with you — provisioning your store, storing your themes, serving your app, sending the notifications you compose.
Our legitimate interests — keeping the service secure, debugging failures, and preventing abuse. We use the minimum data that achieves this.
Your instructions as a controller — for shopper data flowing through the app you publish, we act only on what you configure.
Consent — a shopper's device-level permission is what allows push notifications, and it can be withdrawn in the phone's settings at any time.
Legal obligations — responding to Shopify's compliance webhooks and to lawful requests.

We share data only with the providers needed to run the service, and only what each one needs. Every current subprocessor is named, with its purpose and location, on the Data Processing page. In summary: Shopify (the source of your catalogue and the destination of checkout), the push notification service that delivers messages to devices, and our hosting provider.

We may also disclose data if we are legally required to, or to protect the service and its users from abuse. If ownership of the service changes, we will say so on this page before your data moves.

International transfers

Our servers are located in [hosting region]. Shopify and the push notification service operate globally, so data may be processed outside your country, including outside the European Economic Area. Where a transfer leaves the EEA or the UK, it relies on the safeguards described on the Data Processing page.

How long we keep it

On uninstall — both access tokens are cleared as soon as Shopify's uninstall webhook reaches us, and the store is marked inactive so it stops being served.
After uninstall — your store record, themes and store key are deliberately kept, because reinstalling should restore the app your customers already have rather than hand you a blank one. They are removed [retention period, e.g. 12 months] after uninstall, or sooner if you ask.
Push tokens — deleted with the store record. A token also stops working once a shopper deletes the app, and rejected tokens are dropped.
Shop redaction — when Shopify sends a shop redaction request, we delete the store and everything attached to it.
Logs — [retention period, e.g. 30 days].

Security

All traffic is served over HTTPS. Requests from Shopify are verified by signature, install attempts use single-use nonces, and the app authenticates every embedded request with a Shopify-issued session token rather than a password. Our database is not reachable from the internet. The Security page sets out what we do in more detail — including the parts we have not finished yet.

Your rights and requests

Depending on where you live, you may have the right to access the personal data we hold about you, correct it, delete it, restrict or object to its processing, receive it in a portable form, or withdraw consent. You can also complain to your data protection authority.

To exercise any of these, email [email protected] from the address associated with your store, or write to us at the address in Contact us. We reply within [response window, e.g. 30 days].

If you are a shopper using an app published with Vitrine: the merchant whose store you shopped from is the controller of your data, so please contact them first. Your account, orders and addresses live in Shopify, not with us. If you ask us directly, we will forward the request to the merchant and delete any push token registered for your device.

If you publish an app with Vitrine

The app carries your brand, so your customers' relationship is with you. You remain the controller of their personal data, and you are responsible for your own privacy policy and for the disclosures Apple and Google require of an app listing — including the fact that the app can send push notifications and reads your Shopify catalogue. Our Data Processing page exists so you can describe accurately what we do on your behalf.

Children

Vitrine is a business tool and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child's data has reached us, tell us and we will delete it.

Changes to this policy

When this policy changes we update the date at the top of the page. If a change materially affects what we collect or who we share it with, we will notify installed merchants by email before it takes effect.

Contact us

[legal entity name]
[registered address]
Privacy: [email protected]
Support: [email protected]

[If you have an EU or UK representative or a DPO, name them here.]