Privacy Policy

This policy explains what the BopiSafe Shopify app reads, what it stores, where that lives and how long it is kept. The short version: your pickup settings are stored on your own Shopify store as metafields, and what we hold outside Shopify is an access token, a short cache, and a counter.

1. Who we are

BopiSafe is a Shopify app for in-store pickup. It shows shoppers the available quantity at each of a merchant's pickup locations, lets them choose a store and a pickup time, and keeps that choice consistent through Shopify's own checkout.

Contact: miles.bopisafe@outlook.com

2. What the app reads

From the merchant's store, through the Shopify Admin API

• Store identifier — the *.myshopify.com domain, plus the shop's time zone and name
• Locations — ID, name and local-pickup configuration, to know which stores can be collected from
• Products, variants and inventory levels — the available quantity per location, which is the number shown to shoppers
• Orders — read when Shopify notifies us of a new order, to determine whether it is a pickup order that used this app
• Themes — read only, and only to detect whether the app embed has been switched on. The app never writes theme files
• Delivery customizations — to install and keep in sync the single checkout customization described in §3

About shoppers

The new-order notification Shopify sends us contains the full order payload, which includes customer details such as name and address. We read only the delivery method, the assigned pickup location, the order's own identifiers and the pickup attributes this app wrote. Customer personal data in that payload is not stored, not logged and not sent anywhere else. The app is registered for Shopify's protected customer data requirements on that basis.

From the storefront

• The stock lookup a product page makes carries only the shop domain and a product ID — no shopper identifier of any kind. It is rate-limited using a short-lived counter keyed by IP address, which exists to stop abuse of the endpoint and is not attached to any request record.
• The shopper's chosen store and pickup time are written to their own Shopify cart as cart attributes, so they travel to the order. They are the shopper's data, held in their own cart.
• One key in the browser's local storage remembers the store and time that shopper last chose, so they don't have to pick again on the next product. It is not an identifier and is never sent anywhere except as the cart attributes above.

What we never collect

• Shopper names, emails, phone numbers, addresses or accounts
• Payment or card data of any kind
• Advertising or cross-site tracking data. The app sets no tracking cookies and loads no third-party analytics on your storefront

3. What we do with it

• Show the available quantity per pickup location on the product page and in the cart
• Offer pickup times and mark full or unavailable ones as unpickable
• Keep checkout consistent with what the storefront showed: one Shopify Function hides pickup locations other than the one chosen, and pickup options whose slots are full. It can only hide options — it cannot block a checkout or raise an error
• Write the chosen pickup time onto the resulting order so it is visible in your admin
• Count pickup orders per calendar month, which is the basis for billing
• Tell the merchant, in the app and by a single email, when a month's included allowance has been used up

We do not sell, rent or share merchant or shopper data with anyone, for marketing or any other purpose.

4. No data crosses between merchants

Every record is keyed to a single shop. Nothing one merchant configures or generates is visible to another.

5. Where data is stored

Most of it isn't stored by us at all — your pickup hours, slot lengths, capacity caps and blackout dates are written as metafields on your own Shopify shop and locations, where you own them and can read them through the Shopify API.

What we hold outside Shopify is short and shop-keyed:

• Your Shopify access token, and a short-lived cache of the configuration above
• Counters — this month's pickup-order count, the per-slot counts behind capacity, and your current plan. Alongside them we keep the IDs of the orders already counted this month, so a notification Shopify delivers twice isn't counted twice
• A temporary cache of stock lookups, about 30 seconds per shop and product. Cached responses hold quantities only

It runs on managed cloud infrastructure in a serverless setup — no data warehouse, and no database of shopper records anywhere. Everything is encrypted in transit with TLS and at rest by the provider.

6. How long we keep it

• While installed — the token, the configuration cache and the monthly counters are kept for as long as the app is installed
• On uninstall — the access token is deleted when Shopify sends the app-uninstalled webhook, which also ends all access to your store
• On shop/redact — Shopify issues this 48 hours after a final uninstall. On receipt, every remaining record keyed to your shop is deleted
• Counters — per-slot counts for dates in the past are pruned as each month rolls over; counted-order IDs are dropped when the month resets
• Cached stock — expires by itself within roughly 90 seconds; it is never written to lasting storage

7. Sub-processors

Two, and no others:

• Shopify Inc. — the platform itself: hosting of the embedded admin, identity, the APIs, and the metafields your settings live in
• Cloudflare, Inc. — hosting and content delivery for the app's backend

This website is served separately from the app and carries no analytics, tag managers or third-party scripts.

8. Privacy compliance webhooks

BopiSafe implements Shopify's three mandatory privacy webhooks. Each is verified by HMAC signature before it is acted on:

• customers/data_request — acknowledged. We hold no shopper personal data to export
• customers/redact — acknowledged. We hold no shopper-keyed records to delete
• shop/redact — on receipt we delete every record keyed to that shop

9. Merchant rights

At any time you can:

• Uninstall the app, which immediately ends its access to your store
• Email miles.bopisafe@outlook.com to have your shop's data deleted straight away rather than waiting for the redact webhook — we action these within 5 business days
• Ask for a copy of everything we hold about your store
• Read and edit your own settings directly in Shopify, since they are metafields on your shop

10. Children

BopiSafe is a business-to-business Shopify app. It is not directed at children under 13 and does not knowingly collect data from them.

11. Changes to this policy

We may update this policy. The date at the top reflects the most recent change, and material changes are emailed to merchants with the app installed.

12. Contact

For privacy questions, or to exercise any of the rights above: miles.bopisafe@outlook.com