Privacy Policy
This policy explains how [COMPANY LEGAL NAME] ("ThemeLook", "we") processes personal data in the Shopify app ThemeLook COD, Upsell & Bank (the "App").
1. Who we are
- Company: [COMPANY LEGAL NAME], [ADDRESS], [COUNTRY]
- Contact for privacy questions: [PRIVACY EMAIL]
For the data of the merchant's customers, the merchant is the data controller and ThemeLook is the data processor acting on the merchant's instructions. For the data of merchants using the App, ThemeLook is the controller.
2. What data we process
Merchants (store owners and staff)
- Store domain, store name, store email, country, currency, time zone and language, from Shopify when the App is installed.
- Subscription and usage data (plan, number of orders per billing period).
- Support tickets and their messages, and the contact email given in a ticket.
Customers of the merchant (people who order through the order form)
- Name, phone number, delivery address (country, province, district, street address, postal code), and optionally email address and an order note.
- The products ordered, prices, payment method (cash on delivery or bank transfer) and order status.
- Technical data needed to prevent abuse (for example the request IP address forwarded by Shopify, when available).
- When the merchant enables tracking pixels and the customer has given consent in the store's cookie banner: the advertising cookies of Meta, TikTok or Google (for example
_fbp,_ttp,_ga), the browser's user agent and the page address.
We do not collect payment card data. We do not ask for or process special categories of personal data.
3. Why we process it
| Purpose | Data | Legal basis |
|---|---|---|
| Creating the order in the merchant's Shopify store | Customer order data | Performance of the merchant's contract with the customer (the merchant is controller) |
| Showing bank transfer details and sending them by Shopify email | Order data, email | As above |
| Order list, reports and statistics for the merchant | Order data (reports use totals only) | Merchant's legitimate interest / instructions |
| Preventing spam and fraudulent orders | Phone number, IP address | Legitimate interest |
| Sending purchase events to the merchant's ad platforms | Hashed email and phone, name, city, cookies | Customer's consent, collected by the merchant's store |
| Billing and support for merchants | Merchant data | Contract with the merchant |
We do not sell personal data and do not use it for our own advertising.
4. Who receives the data
- Shopify: the App runs inside Shopify and creates orders in the merchant's store. Customer emails (order confirmation, bank details, cancellations) are sent by Shopify, not by us.
- Hosting provider: [HOSTING PROVIDER, COUNTRY], where the App's servers and databases run.
- Meta, TikTok, Google: only if the merchant enables pixels and the customer consents. Email address and phone number are sent only as SHA-256 hashes.
We do not share data with anyone else, unless required by law.
5. International transfers
Our servers are located in [COUNTRY / REGION]. Where data leaves the European Economic Area or Türkiye, we rely on appropriate safeguards such as the EU Standard Contractual Clauses or the transfer mechanisms of the Turkish Personal Data Protection Law (KVKK).
6. How long we keep data
- Customer personal data on orders is kept for 12 months and then removed from the App (amounts and statistics are kept without personal data). Orders stay in the merchant's Shopify store under the merchant's control.
- When a customer asks Shopify to delete their data (
customers/redact), we delete the related orders from the App. - When a merchant uninstalls the App, Shopify asks us to delete the store's data 48 hours later (
shop/redact); we then delete all data of the store. - Support tickets are kept while the merchant uses the App and deleted with the store's data.
7. Security
- All connections use TLS (HTTPS).
- Customer personal data is encrypted in the database (AES-256). Search uses one-way keyed hashes.
- Access tokens to Shopify and ad platforms are stored encrypted.
- Staff access is limited by role, requires two-factor authentication, and every view of personal data in our admin panel is logged. Staff without a need see personal data masked.
- Backups are encrypted.
8. Your rights
Customers of a store should contact the store first, since the store is the controller of their order data; we help the store answer such requests. Merchants can contact us at [PRIVACY EMAIL].
Depending on your location (for example GDPR in the EU or KVKK in Türkiye) you may have the right to access, correct, delete or restrict the processing of your data, to object to processing, to data portability, and to complain to a data protection authority.
9. Changes
We will publish changes to this policy on this page and update the date above. Merchants are informed in the App about important changes.
10. Contact
[COMPANY LEGAL NAME] – [ADDRESS] – [PRIVACY EMAIL]