Privacy Policy

1. Information We Collect

When a merchant installs WineFollow, we process:

• Shopify store information (store domain and app settings)
• Customer first name, last name and email address, as provided by Shopify when a logged-in customer follows a wine, producer, appellation or vintage
• The Shopify customer ID and the list of items each customer follows, with the date of each follow
• Customer tags created by the application
• Product and catalog information required for follow functionality
• Usage and diagnostic data necessary to operate the app

We do not collect customer phone numbers, postal addresses, payment information or order history.

2. How We Use Information

We use this information only to:

• Provide follow and interest tracking features
• Show merchants which customers follow which items
• Create and manage Shopify customer tags
• Enable automations and integrations configured by the merchant
• Improve app reliability and functionality
• Provide merchant support

We do not use this information for our own marketing, advertising or profiling, and we do not make automated decisions with legal or similarly significant effects.

3. Roles and Data Processing Agreement

The merchant is the data controller for their customers’ personal data. WineFollow acts as a data processor and processes this data only on the merchant’s behalf, to provide the app.

Our Data Processing Agreement describes our obligations as a processor and forms part of our Terms of Service.

Merchants remain responsible for:

• informing their customers about data processing
• obtaining any legally required consent
• complying with applicable privacy laws and regulations

4. Data Sharing and Service Providers

We do not sell or rent customer data.

We use the following sub-processors to operate the application:

• Fly.io, Inc. — application hosting (European Union, Paris)
• Supabase, Inc. — database hosting (European Union, Ireland)

Where a provider may access data from outside the European Economic Area, transfers are covered by the European Commission’s Standard Contractual Clauses or the EU–US Data Privacy Framework.

We may also disclose information when required to comply with legal obligations.

5. Data Retention

We retain data only for as long as necessary to provide the service and comply with legal obligations.

• When a customer unfollows an item, the related follow is deleted.
• When a customer asks for their data to be erased, Shopify sends a customers/redact request and all of that customer’s data is deleted automatically.
• When a merchant uninstalls WineFollow, all data related to their store (customer follows, settings and sessions) is permanently deleted when Shopify sends the shop/redact request, about 48 hours after uninstall.

6. Security

We protect merchant and customer information with measures including encryption in transit (HTTPS/TLS) and at rest, encrypted backups, two-factor authentication on administrative accounts, restricted access to production data, and no personal data in application logs.

However, no method of electronic storage or transmission is completely secure. If a personal data breach occurs, we notify affected merchants without undue delay and within 72 hours of becoming aware of it.

7. Customer Rights

Customers can see and remove the items they follow at any time, from a product page or from the “My follows” section of their customer account.

For any other request (access, correction or erasure), customers can contact the merchant, or us at the address below, and we will help the merchant respond.

8. Shopify Compliance Webhooks

WineFollow supports Shopify’s required privacy webhooks:

• customers/data_request
• customers/redact
• shop/redact

Requests related to customer privacy and data deletion are handled in accordance with Shopify requirements, as described in section 5.

9. Contact

For privacy-related questions:

support@winefollow.app