Privacy policy

01.Introduction

This Privacy Policy describes how Ezzeefy ("we," "our," or "us") collects, uses, and protects information when you install and use our Shopify application (the "App"). Ezzeefy provides analytics, content personalization, and marketing automation, which means we process both merchant store data and end-customer data on your behalf. You remain the data controller for your customers' personal information; we act as your data processor.

By using Ezzeefy, you agree to the collection and use of information in accordance with this policy. If you do not agree with our policies and practices, please do not use our App.

02.Information We Collect

2.1 Information You Provide

When you install and use Ezzeefy, we may collect:

• Store information (store name, myshopify domain, contact email, timezone, currency, plan)
• Marketing content you create (campaigns, email and SMS templates, segments, journeys, personalization rules)
• Sending identity details you register (sending domain, DKIM records, SMS sender or 10DLC registration information)
• Form and popup submissions collected from your storefront, including any custom fields you configure
• App settings, preferences, and feature configuration

2.2 Automatically Collected Information

We automatically collect certain information when you use the App:

• Customer, order, product, discount, and inventory records synced from the Shopify Admin API and kept as a local mirror
• Storefront behavioral events collected by our Shopify Web Pixel (page views, product views, collection views, searches, add-to-cart, checkout, and purchase events), subject to the visitor's consent state
• A first-party visitor identifier used to personalize content and attribute conversions across a visitor's session
• Email and SMS engagement events (delivery, open, click, bounce, complaint, unsubscribe) returned by our messaging provider
• Derived analytics attributes such as RFM tier, lifecycle stage, churn risk, predicted lifetime value, and product affinity
• Error logs and diagnostic information
• OAuth access tokens and session information required to call the Shopify Admin API on your behalf

03.How We Use Your Information

We use the collected information for the following purposes:

• To provide and maintain the App: power analytics dashboards, personalization decisions, recommendations, and the marketing send pipeline
• To personalize your storefront: match visitors to the audiences and content rules you configure, and measure whether those experiences performed
• To send messages you initiate: deliver the email and SMS campaigns, journeys, and transactional confirmations you create, to recipients who have the appropriate consent
• To compute insights: segment customers, score propensity and churn risk, attribute revenue, and report on campaign and experiment performance
• To operate billing: meter usage against your Shopify subscription so you are charged accurately
• To improve our services: analyze aggregate usage patterns to enhance performance, reliability, and user experience
• To ensure security: detect and prevent fraud, abuse, and security issues, and enforce rate limits
• To comply with legal obligations: honor Shopify's mandatory data-request, customer-redact, and shop-redact webhooks and respond to lawful requests

04.Data Storage and Security

We implement industry-standard security measures to protect your information:

• All data is encrypted in transit using TLS, and encrypted at rest by our hosting and database providers
• Every request is authenticated with a Shopify-issued session token and scoped to a single store — queries are tenant-isolated so one merchant can never read another merchant's data
• Inbound webhooks and storefront App Proxy requests are verified by HMAC signature before any data is read or written
• Access tokens are stored server-side only and are never exposed to the browser or to storefront code
• Access to production data is restricted to authorized personnel and audited; sensitive administrative actions are written to an immutable audit log
• Regular dependency, security, and access reviews are performed

Your data is stored securely and is only retained for as long as necessary to provide our services or as required by law.

05.Data Sharing and Disclosure

We do not sell, trade, or rent your personal information to third parties. We may share your information only in the following circumstances:

• With Shopify: As required to provide App functionality through the Shopify platform, including the Admin API, App Proxy, Web Pixel, Functions, and billing APIs
• Hosting & Infrastructure: Vercel (application hosting) and Neon (managed Postgres database) process and store App data under contractual data-protection terms
• Messaging Provider: Sendoka processes recipient email addresses and phone numbers solely to deliver the email and SMS messages you send, and to return delivery and engagement events
• Operational Services: Upstash (rate limiting and delivery de-duplication) and Sentry (error monitoring, identifiers only — never message bodies or personal data)
• Feedback Form: Formspree receives feedback you submit from the App's settings (your store domain, staff ID, message, rating and any images you attach) and forwards it to our team's inbox
• Legal Requirements: When required by law, court order, or government regulation
• Business Transfers: In connection with a merger, acquisition, or sale of assets (with notice to users)

06.Your Rights and Choices

You have the following rights regarding your personal information:

• Access: Request access to the personal information we hold about you or your customers
• Correction: Request correction of inaccurate or incomplete information
• Deletion: Request deletion of personal information. We honor Shopify's customers/redact and shop/redact webhooks automatically. Shopify sends the shop/redact request about 48 hours after uninstall, and we purge store data when it arrives unless retention is legally required
• Data Portability: Export analytics, segments, submissions, and delivery events as CSV at any time from within the App
• Marketing Preferences: End customers can unsubscribe from any marketing message via the one-click unsubscribe link or reply STOP to SMS, and can manage per-channel and per-topic preferences through the hosted preference center
• Uninstall: You can uninstall the App at any time from your Shopify admin, which revokes our access and starts data deletion

To exercise these rights, please contact us using the contact information provided below.

07.Shopify API Access

Ezzeefy requires access to your Shopify store data through the Shopify Admin API. The App requests the following permissions:

• read_customers, write_customers: To sync customer profiles for analytics and segmentation, and to write marketing consent, tags, and customer records you create
• read_customer_data_erasure, write_customer_data_erasure, read_customer_merge, write_customer_merge: To act on customer data erasure requests and to merge duplicate customer records when you ask us to
• read_orders, write_orders, read_order_edits, write_order_edits, read_draft_orders, write_draft_orders, read_returns, write_returns, read_payment_terms: To analyze order history and attribute campaign revenue, and to manage orders, order edits, draft orders, returns, and B2B payment terms from the App
• read_fulfillments, write_fulfillments, read_assigned_fulfillment_orders, write_assigned_fulfillment_orders, read_merchant_managed_fulfillment_orders, write_merchant_managed_fulfillment_orders, read_third_party_fulfillment_orders, write_third_party_fulfillment_orders: To view and fulfill orders and handle customer self-service requests such as cancellations and address changes
• read_products, write_products, read_product_listings, read_publications, write_publications, read_files, write_files: To power product analytics and recommendations, manage products and their sales channel publishing, and upload product images
• read_inventory, write_inventory, read_locations, write_locations: To surface stock levels and multi-location inventory, and to apply inventory and location changes you request
• read_customer_events, read_pixels, write_pixels: To install and operate the Web Pixel that collects consent-aware storefront behavior used for personalization and analytics
• read_marketing_events, write_marketing_events: To report campaign activity back to Shopify Marketing so your spend and results appear in Shopify's own reporting
• read_discounts, write_discounts: To create and manage discounts, generate unique discount codes, and run automatic discount Functions
• read_gift_cards, write_gift_cards, read_gift_card_transactions, write_gift_card_transactions: To view, issue, and manage gift cards and their transactions from the App
• read_store_credit_accounts, read_store_credit_account_transactions, write_store_credit_account_transactions: To read customer store-credit balances and issue credit as part of retention and cashback programs
• read_cart_transforms, write_cart_transforms, read_delivery_customizations, write_delivery_customizations, read_payment_customizations, write_payment_customizations, read_validations, write_validations, read_fulfillment_constraint_rules, write_fulfillment_constraint_rules, read_order_submission_rules, write_order_submission_rules: To set up the Shopify Functions you configure: bundles, delivery and payment customizations, cart validation, fulfillment constraints, and order routing
• read_companies, write_companies: To manage B2B companies, locations, contacts, and wholesale price lists (Shopify Plus only)
• read_themes, read_app_proxy, write_app_proxy, read_content, write_content, read_locales: To detect the sections and editable fields in your theme so you can choose where personalized content is placed, to serve storefront features such as forms and popups through the app proxy, and to read your store's content and primary language
• read_analytics, read_reports: To run ShopifyQL queries that power dashboard KPIs and trend reporting
• customer_read_customers, customer_read_orders: To show order summaries and loyalty details to signed-in customers in their customer account

These permissions are necessary for the App to function. We only access data required for the features you use, and we do not access data beyond what is necessary for App functionality.

08.Cookies and Tracking

We use cookies and similar tracking technologies to:

• Maintain your admin session and authentication state inside the Shopify admin
• Store a first-party visitor identifier on your storefront so personalized content stays consistent and conversions can be attributed
• Enforce frequency caps so a visitor is not shown the same popup or overlay repeatedly

Storefront identifiers are set only where the visitor's consent state permits, and honor Shopify's Customer Privacy API. Visitors can clear or block them through their browser settings, though personalization and attribution will be limited as a result.

09.Children's Privacy

Ezzeefy is a business tool and is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately and we will delete it.

10.International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence, including the United States. We ensure that appropriate safeguards, including Standard Contractual Clauses where applicable, are in place with our sub-processors to protect your data in accordance with this Privacy Policy and applicable data protection laws.

11.Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by:

• Posting the new Privacy Policy on this page
• Updating the "Last updated" date at the top of this policy
• Sending you an email notification for material changes, and requesting re-consent where a change expands the scope of data we process

You are advised to review this Privacy Policy periodically for any changes. Changes are effective when posted on this page.

12.Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

13.Compliance

This Privacy Policy is designed to comply with:

• General Data Protection Regulation (GDPR)
• California Consumer Privacy Act (CCPA/CPRA)
• Personal Information Protection and Electronic Documents Act (PIPEDA)
• CAN-SPAM Act and RFC 8058 one-click unsubscribe for email
• TCPA and CTIA guidelines for SMS, including 10DLC registration and STOP/HELP keyword handling
• Shopify's Partner Program Agreement, API License Agreement, and mandatory GDPR webhooks