Privacy Policy

Last updated: 2026-05-06

This Privacy Policy explains how Collabs ("we", "our", "the App") collects, uses, stores, and shares information when a Shopify merchant installs and uses the App, and when influencers participate in collaborations created by those merchants.

1. Information we collect

From merchants (Shopify stores)

• Shop domain, store name, and store contact email returned by Shopify on install.
• Shopify access token (stored encrypted at rest), used to call the Shopify Admin API.
• Product catalog data (titles, descriptions, images, variants, prices, inventory).
• Order data limited to orders we create on behalf of the merchant for influencer gifting and to track fulfillment status.
• Merchant-provided account info (name, email, password hash) used for App login.

From influencers

• Name, email, phone (optional), shipping address, and social media handles submitted to apply for or accept a collaboration.
• Content URLs and uploaded media submitted as part of a collaboration.

2. How we use information

• To operate the App and provide the collaboration management features (creating draft orders, tracking shipments, collecting submitted content).
• To send transactional emails to merchants and influencers (e.g., invites, shipment notifications, content requests).
• To respond to merchant support requests.

3. Data sharing

We do not sell personal data. We share data only with the following processors:

• Shopify — to fulfill draft orders and read products on behalf of the merchant.
• Supabase — for database and file storage hosting.
• Resend — for transactional email delivery.
• Cloudinary — for influencer media uploads.

4. Data retention

We retain merchant data for as long as the App is installed. When a merchant uninstalls the App, we receive an app/uninstalled webhook and immediately deactivate the shop and revoke the access token. Shopify subsequently sends shop/redact 48 hours later, at which point we permanently delete all data associated with that shop.

We honor customers/redact requests by deleting influencer data tied to the requested customer email within 30 days.

5. Customer data requests (GDPR / CCPA)

We support Shopify's mandatory privacy webhooks. To request a copy of your data, or to request deletion, contact your merchant or email us at the address below. Shopify will forward formal requests to us via customers/data_request and customers/redact webhooks.

6. Security

• All data is transmitted over HTTPS.
• Shopify access tokens are encrypted with AES-256-GCM at rest.
• Webhooks are HMAC-verified before processing.
• Database access is scoped per shop and protected by row-level security.

7. Contact

For privacy questions, contact: privacy@REPLACE_WITH_DOMAIN

Data controller: REPLACE_WITH_LEGAL_ENTITY_NAME, REPLACE_WITH_LEGAL_ADDRESS