AppVerix Wishlist: Privacy Policy

Last updated: 29 October 2026

AppVerix Wishlist (“the app”) is a Shopify app published by AppVerix (“we”, “us”). This policy explains what the app collects when a merchant installs it, why, where it is kept and how to have it deleted.

For any customer data that stays in Shopify, the merchant is the controller and we are the processor.

1. What we collect and why

From the merchant’s store, through Shopify’s API:

  • Shop domain and access token.
  • Saved products for signed-in customers: product id, optional variant id, title, handle, and the Shopify customer id. Stored.
  • A monthly count of adds, to enforce the plan limit. Stored.
  • Billing state from Shopify. Stored as a cache.
  • Compliance log of privacy webhooks. No passwords or emails.

2. What we do not collect

Guest lists stay in the shopper’s browser (localStorage) and are not sent to us until the shopper signs in. We do not store passwords or email addresses. customers/redact deletes rows for that customer id.

3. Who processes data for us

Where data leaves the EEA/UK, we rely on the provider’s Standard Contractual Clauses or other approved transfer mechanisms.

  • Cloudflare (cloudflare.com): hosting for the app and its D1 database. Sees everything in section 1. Globally distributed.
  • Shopify: the platform the app runs on, which also handles billing. See Shopify’s privacy policy.

4. How long we keep it

  • Settings and records: while the app is installed.
  • When you uninstall: we delete the login session right away. Shopify sends a shop/redact request about 48 hours later and we then delete the store’s records.
  • A customer deletion request (customers/redact): we delete rows keyed by that customer id, if any, and log that it arrived.
  • Server logs: up to 7 days, without personal data.

5. Your rights and data requests

The app supports Shopify’s three privacy webhooks: customers/data_request, customers/redact and shop/redact. Merchants can write to support@appverix.com for a copy of their data or to have it deleted. We answer within 30 days. If you are in the EEA/UK you may complain to your local data protection authority. In Brazil the LGPD applies.

6. Security

  • All traffic uses HTTPS (TLS).
  • The database runs on Cloudflare D1, which encrypts data at rest.
  • Webhooks from Shopify are verified by their HMAC signature; unsigned requests are rejected.
  • The app checks a Shopify session token on every admin request and uses no third-party cookies.
  • If a breach affects your data we tell you without undue delay, and within 72 hours where the law requires it.

7. Data processing agreement and security

For the personal data of a store’s customers, the merchant is the controller and we are the processor. The AppVerix Data Processing Addendum sets out our commitments, and our security and incident response policy describes how we protect data.

8. Changes and contact

If we change this policy in a way that matters, we update the date at the top and tell merchants in the app or by email. Contact: support@appverix.com