PEZ Progress Bar

Effective date: pending legal approval

Privacy policy

This policy explains what PEZ Progress Bar processes when a Shopify merchant installs and uses the app.

Owner input required before publication: legal entity name, registered address, VAT or tax identifier where required, privacy contact email, governing jurisdiction, and effective date.

Data we process

We store the merchant shop domain, Shopify authentication sessions, the Shopify shop identifier, subscription entitlement status, configured threshold, display messages, bar color, shop currency, and operational timestamps. We do not request or store customer profiles, orders, checkout details, payment details, or cart contents on our servers.

How we use data

We process merchant data to authenticate the app, save and publish the storefront configuration, verify the Shopify App Pricing subscription, provide support, secure the service, and meet Shopify platform requirements. We do not sell personal information or use merchant data for advertising.

Shopify and service providers

Shopify processes installation, authentication, billing, and storefront platform data under its own terms. Production hosting and database providers will process encrypted operational data on our behalf once selected. The final policy will identify material provider categories and international-transfer safeguards.

Retention and deletion

Authentication sessions are removed when the app is uninstalled. Merchant configuration is erased after Shopify sends the mandatory shop-redaction request. Security backups, if used by the selected production provider, will expire according to the documented backup-retention schedule.

Your choices and rights

Merchants can change configuration in the app, disable or remove theme blocks, uninstall the app, and request access, correction, or deletion through the published privacy contact. Applicable rights depend on the merchant's jurisdiction.

Security

Production traffic uses HTTPS. Access tokens and database credentials remain server-side and are stored through the selected secret-management service. Access is limited to what is required to operate and support the app.

Contact

The controller and privacy contact will be inserted here before publication. Until then, this page is a technical draft and is not the final legal notice.