Privacy Policy

Who we are

This app is operated by SL Studio (Orange County, California, USA). Contact: support@sl-studio.dev.

What we store

We keep the minimum needed to run the app:

• Shop domain and the Shopify access token issued when you install the app (so the app can read orders and write tags).
• The settings you enter: display language, tag names, whether tags and customer emails are on, the email language, your reply-to address and an optional note for the email.
• A monthly counter of orders checked per shop and your plan status.
• An access log (time, action, order IDs) kept for security for 90 days.
• Per order that received a request email: the number of emails sent and the time of the last one, for 30 days, so the customer is not emailed twice.
• If you join the email list on this site: your email address.

What we do not store

Order and customer data — including the customs clearance code — are read from Shopify only at the moment of a check and are used solely to produce the check result, the tag and, if you turned it on, the request email. We do not copy orders, customers or codes into our own database.

CSV exports are streamed to you and are not saved on our servers.

Where data lives

Hosting: Vercel (US). Key-value storage: Upstash Redis (US); the app encrypts stored shop data (AES-256-GCM) before it is written, and all connections use TLS. Email delivery: Resend (US) — a request email carries the order number, the recipient's name and the sending store's name, nothing else. Payments: Shopify Billing — we never see card details.

This public website counts page views with Vercel Web Analytics, which sets no cookies. It is not loaded inside the app in Shopify admin.

Retention and deletion

When you uninstall the app we delete the session and access token immediately and the remaining shop data (settings, counters, plan, access log) within 48 hours when Shopify sends the shop/redact webhook.

Customer data requests and customer redaction webhooks from Shopify are honored; since we store no customer records there is nothing further to return or erase.

Email-list addresses are deleted on request (email support@sl-studio.dev) or when the list is retired.

Protected customer data

We request Shopify's protected customer data access only for the fields the check needs (recipient name, phone, postal code, email for the request message) and use them only for that check and that message.

Security and terms

How we protect data and respond to incidents: https://pccc.sl-studio.dev/security. Terms of Service and data processing terms: https://pccc.sl-studio.dev/terms.

Changes

We will update this page when the policy changes and show the date at the top.