Privacy Policy

This Privacy Policy describes how Alan Labs ("we," "us," or "our") collects, uses, and protects information when you use our Shopify app, Google Merchant Store Widget (the "App").

1. Information We Collect

1.1 Store Information

When you install the App, we collect the following information from your Shopify store:

• Store domain: Your Shopify store URL (e.g., yourstore.myshopify.com)
• Shop owner email: For app authentication and critical communications
• Access token: Encrypted token to authenticate your store with our app

1.2 Session Data

We temporarily store session data required for app authentication. This includes:

• Session tokens
• Authentication timestamps
• App installation status

1.3 What We DO NOT Collect

We do NOT collect, store, or process any of the following:

• Customer personal information (names, addresses, emails)
• Order data or transaction history
• Product information
• Payment information
• Customer browsing behavior
• Analytics or tracking data from your storefront

2. How We Use Your Information

We use the information we collect solely to:

• Provide the App service: Authenticate your store and enable the Google Merchant Center widget on your storefront
• Maintain functionality: Ensure the App works correctly within your Shopify store
• Communicate with you: Send critical updates about the App, security notices, or respond to support requests
• Comply with legal obligations: Respond to valid legal requests and enforce our Terms of Service

We do NOT use your information for:

• Marketing or advertising purposes
• Selling or sharing your data with third parties
• Analytics or behavioral tracking

3. Data Storage and Security

3.1 Where We Store Data

Your data is stored securely on our servers hosted by Fly.io, a reputable cloud infrastructure provider. Session data is stored in an encrypted SQLite database.

3.2 How We Protect Your Data

• Encryption: All data transmission uses industry-standard HTTPS/TLS encryption
• Access controls: Only authorized personnel can access our systems
• Limited retention: Session data is automatically purged when you uninstall the App
• Secure authentication: We use Shopify's OAuth 2.0 for secure app authentication

3.3 Data Retention

• Active stores: Session data is retained while the App is installed
• After uninstallation: All session data is automatically deleted within 48 hours
• GDPR requests: We comply with data deletion requests immediately upon receipt

4. Third-Party Services

4.1 Shopify

Our App operates on the Shopify platform. Your use of Shopify is governed by Shopify's Privacy Policy: https://www.shopify.com/legal/privacy

4.2 Google Merchant Center

The App installs Google's official Merchant Center widget on your storefront. Google's collection and use of data through this widget is governed by Google's Privacy Policy: https://policies.google.com/privacy

Note: We do NOT send any data to Google. The widget loads directly from Google's servers to your customers' browsers.

4.3 Hosting Provider (Fly.io)

Our infrastructure is hosted on Fly.io. They may process technical data (server logs, IP addresses) as part of their hosting services. Review Fly.io's Privacy Policy: https://fly.io/legal/privacy-policy/

5. Your Rights (GDPR & Privacy Laws)

Under the General Data Protection Regulation (GDPR) and other privacy laws, you have the following rights:

5.1 Right to Access

You can request a copy of the information we hold about your store.

5.2 Right to Deletion

You can request that we delete all data associated with your store. We will comply within 30 days.

5.3 Right to Rectification

You can request corrections to any inaccurate information we hold.

5.4 Right to Data Portability

You can request your data in a machine-readable format.

5.5 How to Exercise Your Rights

To exercise any of these rights, contact us at the email address provided below. We will respond within 30 days.

6. Compliance with Shopify's Requirements

6.1 GDPR Webhooks

We have implemented the following mandatory webhooks to comply with GDPR and Shopify's requirements:

• customers/data_request: Handles customer data access requests
• customers/redact: Handles customer data deletion requests
• shop/redact: Handles shop data deletion after app uninstallation

6.2 Automatic Data Deletion

When you uninstall the App, Shopify triggers our shop/redact webhook. We automatically delete all session data within 48 hours of receiving this webhook.

7. International Data Transfers

Our servers are located in the United States. If you are accessing the App from outside the United States, your information may be transferred to, stored, and processed in the United States. By using the App, you consent to this transfer.

We ensure adequate protection of your data through:

• Standard contractual clauses
• Encryption of data in transit and at rest
• Compliance with applicable data protection laws

8. Children's Privacy

The App is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a child, please contact us immediately.

9. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. When we make changes:

• We will update the "Last Updated" date at the top of this policy
• For material changes, we will notify you via email or through the App
• Your continued use of the App after changes constitutes acceptance of the updated policy

We encourage you to review this Privacy Policy periodically.

10. California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

• Right to Know: You can request details about the personal information we collect
• Right to Delete: You can request deletion of your personal information
• Right to Opt-Out: We do not sell personal information, so there is nothing to opt out of
• Non-Discrimination: We will not discriminate against you for exercising your rights

11. Contact Us

12. Governing Law

This Privacy Policy is governed by and construed in accordance with the laws of the United States and the State of New York, without regard to its conflict of law provisions.