Privacy Policy — eShoopy Apps for Shopify

Last updated: August 21, 2026

This policy applies to apps published by eShoopy S.r.l.s. on the Shopify App Store, including eShoopy - Home Scheduler and eShoopy SecureCOD. It is separate from our WordPress products. Our general company privacy policy is available at /privacy.

1. Provider and roles

ESHOOPY S.r.l.s.
Piazza Cavour 9
80137 Naples (NA), Italy
VAT: IT09504091217
Email: [email protected]

ESHOOPY acts as a processor/service provider for buyer data submitted by a Shopify merchant. The merchant remains the controller/business. ESHOOPY is the controller for merchant account, support, security and billing-administration data where applicable.

2. Data processed

  • All apps: store domain, name, locale, country, plan, settings, operational logs and an encrypted Shopify access token.
  • Home Scheduler: merchant-created schedules and theme/homepage content. It does not require buyer names, contact details, addresses or orders.
  • SecureCOD: Shopify order identifiers, totals, currency, COD fee, status, timestamps and, when enabled, buyer email/phone for OTP or communications, delivery area for COD rules, and IP/browser/device signals for risk controls.
  • Consented recovery: checkout contact and cart details are stored only when recovery is enabled and Shopify reports explicit marketing consent.
  • Messaging: selected channel, delivery status and message counts for operation and Shopify billing.

Our Shopify apps do not collect payment-card data and do not sell personal information. SecureCOD risk signals support merchant review and do not independently cancel orders or make legal decisions about buyers.

3. Purposes and merchant responsibility

We process data to provide merchant-requested scheduling, COD eligibility and fees, OTP verification, order operations, risk signals, consented recovery, reporting, support, abuse prevention and Shopify billing. We do not reuse buyer data for unrelated ESHOOPY marketing. The merchant must select an appropriate legal basis and give required notices. Recovery reminders fail closed unless explicit marketing consent is present in Shopify data.

4. Payments

Billing is handled by Shopify via the Shopify Billing API. We do not see or store payment card data. (Freemius is not used for Shopify apps.)

5. Providers and transfers

Shopify provides the platform, authentication, billing and webhooks. When a merchant selects and configures them, SecureCOD can send the minimum required data to Twilio or Plivo for SMS/voice, Meta for WhatsApp, SendGrid for email, Google for Sheets, and configured infrastructure/storage providers. Each provider operates under its applicable terms, privacy notice and transfer mechanism.

6. Retention and deletion

  • Failed, expired or blocked OTP logs: up to 30 days; verified OTP records: up to 365 days.
  • Abandoned-cart recovery records: up to 30 days; activity logs: up to 365 days.
  • Order and store configuration data: while the app is installed, subject to Shopify privacy requests and legal requirements.
  • Authenticated encrypted backups: up to 30 days.

We honour Shopify's mandatory customer data request, customer redact and shop redact webhooks. Customer redact removes matching OTP data and anonymizes order PII and risk signals. Shop redact deletes the store and related app data; backup copies expire through the retention cycle.

7. Security

Controls include HTTPS, verified webhook signatures, Shopify session authentication, restricted production access, rate limits and input validation. Merchant tokens, integration secrets and persistent backups use authenticated AES-256-GCM encryption. No internet service can be guaranteed completely secure.

8. Rights

Buyers should contact the Shopify merchant from whom they purchased, because that merchant controls their data and can initiate a Shopify privacy request. Merchants and individuals may contact us regarding access, correction, deletion, restriction, portability, objection or other applicable rights. We may verify identity and authority before acting.

9. US state privacy rights (CCPA/CPRA and similar laws)

For merchants and buyers located in California and other US states with consumer privacy laws (including the CCPA/CPRA, Virginia CDPA and Colorado CPA): we do not sell personal information and do not share it for cross-context behavioral advertising, and we have not done so in the preceding 12 months. We use no personal information for profiling with legal or similarly significant effects.

For buyer data we act as a service provider / processor on the merchant's documented instructions: we process personal information only to provide the services described above, never for our own marketing, and we do not combine it across merchants. US residents can exercise access, deletion, correction and portability rights through the Shopify merchant they purchased from, who submits the request via Shopify's privacy infrastructure — we honour the resulting webhooks as described in section 6. We do not discriminate against anyone for exercising privacy rights.

10. Changes

We may update this policy; the "last updated" date will change accordingly.

Contact

For privacy questions, write to [email protected].