Privacy policy
Draft. This text isn't in effect yet: the parts in [brackets] are still being decided.
Effective [effective date].
Dalbie Dates (“the app”) is a Shopify app made by Harry Knowles, trading as Dalbie (“we”, “us”). It lets a Shopify store’s customers choose a delivery date, and helps the store manage how many orders it takes for each day. This policy explains what data the app processes when a store (“merchant”) installs it, why, and what happens to it.
Who is responsible for the data
For the store’s own data and settings, we decide how it’s used, so we are the controller. For the store’s customers’ data, the merchant is the controller and we process it on the merchant’s behalf, only to provide the app.
What we process and why
About the store, to run the app for it:
- the store’s Shopify domain, time zone and which of our plans it’s on;
- the delivery settings the merchant enters: delivery days, cut-off times, daily limits, product limits, blocked dates and the countries that get delivery dates;
- an access token from Shopify that lets the app work with the store’s orders and products, stored encrypted;
- billing usage: which orders counted towards the plan’s monthly allowance, sent to Shopify for billing;
- a record of delivery-date changes made in the app: the order, the old and new dates, and the numeric ID Shopify gives the staff account that made the change.
About the store’s customers, to give each order a delivery date:
- when a customer places an order, Shopify sends the app the order. The app reads which products were ordered and how many, the delivery date the customer chose, and the country of the shipping address (to check the store delivers dates there);
- the app keeps the order’s ID and its delivery date, and counts the order against that date’s limit. It does not keep the customer’s name, email, phone number, address or payment details, and it doesn’t keep the order itself;
- in the store, the delivery calendar asks the app which dates are available. That request contains product IDs only, no personal data.
We don’t use any of this for marketing or advertising, we don’t build profiles, and we don’t sell or share it.
Legal basis (UK GDPR and EU GDPR)
- Store data: to perform our contract with the merchant (providing the app).
- Customers’ data: processed for the merchant, on their instructions, so they can fulfil their orders; the merchant’s legal basis applies.
- Operational records (billing usage, date-change records): our legitimate interest in running and billing the service correctly.
Cookies and tracking
The app sets no cookies and stores nothing in the customer’s browser. The delivery calendar in the store loads from Shopify’s servers and asks the app for available dates through the store’s own domain.
Who else processes the data
- Shopify: the platform the app runs in; it sends us orders and handles billing.
- Railway (Railway Corporation): hosts the app and its database, in the EU (Netherlands). Access is over HTTPS only, and the database isn’t reachable from the internet.
We’ll update this list before adding any other provider.
How long we keep it
- While the app is installed, as long as it’s needed to run it.
- When a merchant uninstalls the app, its access token is revoked straight away. Shopify then asks us to delete the store’s data (48 hours after uninstall), and we delete all of it: settings, counts, order IDs and dates, and records.
- When a customer asks the merchant to delete their data, Shopify tells us, and we delete our records for that customer’s orders.
- Our hosting provider keeps server logs, which include store domains and request details, for [hosting log retention].
Your rights
Customers: please contact the store you ordered from. When a merchant receives a request, Shopify passes it to us: on a data request we send the merchant what we hold about that customer’s orders, and on a deletion request we delete it.
Merchants: you can ask us for a copy of your store’s data, to correct it, or to delete it, at dates@dalbie.com. Uninstalling the app deletes it as described above. In the UK you can also complain to the Information Commissioner’s Office (ico.org.uk).
Security
Data travels over HTTPS only. Shopify access tokens are encrypted in the database. Only the people who run the service can reach the hosting and the database.
Changes
We’ll post changes here with a new effective date, and tell merchants in the app before a change that affects how their data is used.
Contact
Harry Knowles, trading as Dalbie. dates@dalbie.com