Privacy Policy · Omnibus Price History for Shopify

This policy explains what the App reads from your Shopify store, what we keep, where it is held, for how long, and what rights you have. It also serves as the data-processing terms between us for the store data we process on your behalf.

The App does not read, receive or store personal data about your customers. It does not request access to orders, customers, checkouts or carts. It reads products, variants, prices and discounts, and writes a price-history metafield back to your products.

Contents

Who we are
Controller and processor
What we process
What we do not process
Why, and on what legal basis
Where your data is held
Sub-processors
How long we keep it
Uninstalling and deletion
Security
Operator access and impersonation
Cookies and browser storage
Our commitments as your processor
Your rights
Your own obligations
Changes to this policy

1. Who we are

Data controller: Paloheyna
Business ID: 3186697-4
Address: Tuohuskuja 8 A, 00670 Helsinki, Finland
Privacy contact: legal-omnibus@paloheyna.com
Security reports: legal-omnibus@paloheyna.com

We have not appointed a Data Protection Officer, because the scale and nature of our processing does not require one under Article 37 GDPR. Privacy questions go to the address above and are handled by the people who run the service.

2. Controller and processor

Our role depends on the data:

For your Store Data we are a processor and you are the controller. We process it only to provide the App to you, on your instructions — which are given by your configuration of the App and by these documents. Section 13 sets out the Article 28 commitments that go with that.
For our own relationship with you we are a controller: your account and subscription record, support correspondence, security and audit logs, and the technical telemetry described below.

3. What we process

Category	What it contains	Where it comes from
Store and account	Your `myshopify.com` domain, store name and identifier, currency and market configuration, install status, selected plan and subscription state, and any commercial arrangement we have agreed with you.	Shopify, at install and on each sign-in.
Access credentials	An offline Shopify Admin API access token for your store, held encrypted. It lets the App run scheduled work when nobody is signed in.	Exchanged with Shopify at first sign-in.
Catalogue and pricing	Product and variant identifiers and titles, prices, compare-at prices, market- and currency-specific prices, active discounts, and the price-change history and Reference Prices the App derives from them.	Shopify Admin API, on each scheduled run.
Support correspondence	The subject and body of threads you open in the App or send by email, and our replies. Written by you, so please do not put personal data in them that we do not need.	You.
Technical and security logs	Request metadata, trace identifiers, IP addresses, timestamps, error messages and stack traces, and records of failed background runs.	Generated automatically as the App runs.
Browser telemetry	Page-performance measurements (Core Web Vitals) and client-side error reports — error message, stack trace, the App page it happened on, and a trace identifier.	The embedded App in your browser.
Operator audit records	Which of our operators performed which administrative action on which account, and when — including any use of the impersonation feature described in section 11.	Generated automatically.

Most of this is not personal data at all: a product price is not information about a person. Personal data arises mainly at the edges — the natural person behind a store domain, the author of a support message, an IP address in a log — and this policy covers it.

4. What we do not process

No customer or consumer data. The App does not request the Shopify scopes that would let it read orders, customers, checkouts or carts, and it never receives them.
No payment data. Billing runs through Shopify. We never see your card or bank details.
No tracking. We run no advertising, profiling or cross-site analytics, and embed no third-party trackers in the App.
No sale of data. We do not sell, rent or trade any data, and we do not share it for anyone else’s marketing.

Shopify requires every app to handle three compliance webhooks. Because we hold no customer data, a customer data request and a customer redaction request are acknowledged with nothing to return and nothing to erase. A shop redaction request triggers the deletion described in section 9.

5. Why, and on what legal basis

Purpose	Legal basis (where we are controller)
Providing the App: reading your catalogue, computing Reference Prices, publishing metafields	Performance of our contract with you (Art. 6(1)(b))
Managing your account, plan and subscription	Performance of our contract (Art. 6(1)(b))
Answering support requests	Performance of our contract (Art. 6(1)(b))
Keeping the service secure, preventing abuse, investigating incidents, auditing operator actions	Our legitimate interest in a secure and accountable service (Art. 6(1)(f))
Diagnosing errors and measuring performance, so that faults are found before merchants report them	Legitimate interest in a reliable service (Art. 6(1)(f))
Aggregated, de-identified statistics used to improve the App	Legitimate interest (Art. 6(1)(f)); the result identifies nobody
Keeping accounting records and meeting tax obligations	Legal obligation (Art. 6(1)(c))
Establishing, exercising or defending legal claims	Legitimate interest (Art. 6(1)(f))

Where we act as your processor, the legal basis for the underlying processing is yours, not ours.

6. Where your data is held

All Store Data is stored and processed in the European Union — in Amazon Web Services’ Stockholm region (eu-north-1), in Sweden. Each store’s data is held in its own partition, and access to it is restricted at the infrastructure level per store rather than only in application code.

Support correspondence sent by email, and the accounts our own operators sign in with, run on Google Workspace, which may involve processing outside the EEA. Those transfers rely on the EU–US Data Privacy Framework and on the European Commission’s standard contractual clauses. No catalogue or price data is transferred outside the EEA by us.

7. Sub-processors

Sub-processor	What it does for us	Location
Amazon Web Services EMEA SARL	Hosting, storage, databases, background processing, logging	EU (Stockholm, Sweden)
Google Ireland Limited (Google Workspace)	Support email and operator sign-in	EU, with possible transfers to the US under the Data Privacy Framework

Shopify is not our sub-processor. It is the platform your store runs on, your own controller relationship, and the source of the data the App reads under the access you grant. Shopify’s handling of your data is governed by your agreement with Shopify.

We will give you at least 30 days’ notice before adding or replacing a sub-processor, by updating this page and notifying you in the App or by email. If you object on reasonable data protection grounds, tell us within that period and we will discuss alternatives; if none is workable, you may terminate without penalty for the remainder of the current period.

8. How long we keep it

Data	Retention
Catalogue, price history and Reference Prices	For as long as the App is installed, then deleted as described in section 9.
Shopify access token	Cleared immediately on uninstall.
Account and subscription record	Deleted with your Store Data in section 9.
Support threads and messages	Held with your Store Data and deleted with it. Email correspondence is kept for up to 24 months.
Application and access logs	30 days.
Error records and browser error reports	30 days.
Failed background-run records	90 days.
Operator audit records	Retained beyond account deletion, for accountability and security. They record which operator did what to which store domain, and contain no catalogue or pricing content.
Accounting records	As required by applicable accounting and tax law.

9. Uninstalling and deletion

The sequence is fixed and we do not shorten or extend it by hand:

You uninstall. Shopify notifies us at once. We clear your access token, stop all scheduled processing for your store, and mark the account as awaiting redaction. Nothing further is read from your store, because we no longer hold the means to read it.
Shopify sends a shop-redaction request, normally about 48 hours later.
30 days after that request, we permanently delete your Store Data — account record, catalogue and price history, stored files, support threads and scheduled jobs — unless the App has been reinstalled in the meantime.
If you reinstall before deletion, your history is intact and the App continues where it left off. If you reinstall afterwards, the App starts observing prices again from zero.

The 30-day delay exists so that an accidental uninstall does not destroy months of price history you may be legally required to be able to explain. If you want your data deleted sooner, write to legal-omnibus@paloheyna.com from an address we can verify and we will action it.

The metafields the App wrote to your products stay on your Shopify store after deletion, because they are your data on your platform. Remove them in Shopify if you no longer want them.

10. Security

Encryption. All traffic is over TLS. Data at rest is encrypted, and the Shopify access token is held in encrypted parameter storage rather than in the application database.
Tenant isolation. Every stored record is keyed by store, and a request is served with credentials that are restricted to that store’s records at the infrastructure level — so a fault in application code cannot reach another merchant’s data.
Least privilege. Each component runs with its own narrowly scoped permissions.
Operator access. Our operators sign in through our company identity provider with multi-factor authentication enforced, and hold one of three permission levels. Access is granted and revoked centrally.
Auditing. Administrative actions are written to an append-only audit log that is not purged with account data.
Monitoring. Errors, failures and anomalies raise alerts to the operations team automatically.
Breach notification. If a personal data breach affects your data we will notify you without undue delay after becoming aware of it, with what we know, what we are doing, and what we suggest you do. Where we are your processor, this lets you meet your own 72-hour obligation.

No system is perfectly secure. If you find a vulnerability, please report it to legal-omnibus@paloheyna.com. We will acknowledge it, keep you informed, and will not pursue good-faith researchers who report responsibly and do not access other merchants’ data.

11. Operator access and impersonation

To diagnose a problem you report, one of our operators may open your view of the App using a short-lived impersonation token. We think you should know exactly how that works:

the token lasts 30 minutes and cannot be used to obtain credentials to your Shopify store;
an audit record naming the operator is written before the token is issued — if the record cannot be written, no token is issued;
the session is visibly marked as impersonated in the interface, and every request made during it is tagged with the real operator’s identity in our logs.

You can ask us for the audit records relating to your store at any time.

12. Cookies and browser storage

The App sets no cookies and runs no analytics or advertising scripts.

It uses your browser’s local and session storage for strictly functional purposes only: remembering that you signed out, and holding a short-lived session token during development or an impersonated session. This data stays in your browser, is not readable by anyone else, and is not used to track you. No consent banner is required for it, and we do not show one.

Shopify’s own admin, in which the App is embedded, sets its own cookies under Shopify’s privacy policy. That is outside our control.

13. Our commitments as your processor

Where we process Store Data on your behalf, this section forms the data-processing agreement required by Article 28 GDPR. Subject matter: providing the App. Duration: for as long as the App is installed, plus the deletion period in section 9. Nature and purpose: recording price changes, computing Reference Prices and publishing them to your store. Types of data: as listed in section 3. Data subjects: your personnel who use the App, and any individual identifiable from a store domain or a support message. We commit to:

process Store Data only on your documented instructions, which are given by your use and configuration of the App and by these documents, unless required otherwise by EU or member state law — in which case we will tell you first unless the law forbids it;
ensure that everyone authorised to process it is bound by confidentiality;
implement the technical and organisational measures in section 10;
engage sub-processors only under section 7, and on terms no less protective than these;
assist you, so far as is reasonable, in responding to data subject requests and in meeting your obligations under Articles 32 to 36;
notify you of a personal data breach without undue delay;
delete Store Data on the timetable in section 9, or sooner on your written request;
make available the information reasonably necessary to demonstrate compliance, and allow an audit on reasonable notice, no more than once a year unless a breach or a supervisory authority requires otherwise, at your cost and subject to confidentiality.

If you need these terms in a separate signed document, or need them attached to your own template, write to legal-omnibus@paloheyna.com.

14. Your rights

Where we are the controller, you have the right to access your personal data, to have it corrected, to have it erased, to restrict or object to processing, to receive it in a portable form, and to withdraw consent where processing rests on consent. Where we act as your processor, requests from your own data subjects should come to you, and we will help you answer them.

Write to legal-omnibus@paloheyna.com. We answer within one month and will tell you if we need longer. We may need to verify who you are before acting, which for a store usually means confirming control of the store domain.

You may also complain to a supervisory authority. Ours is the Finnish Data Protection Ombudsman (Tietosuojavaltuutetun toimisto, tietosuoja.fi). You may instead complain to the authority where you live or work.

15. Your own obligations

You are the controller of your store’s data and of your customers’ data. You are responsible for having your own privacy notice, for having a lawful basis for what you do, and for not putting personal data into the App that the App has no need for — support messages and store metadata are the only places where that is even possible, and neither needs it.

16. Changes to this policy

We will update this page when what we do changes. For a material change — a new purpose, a new category of data, a new sub-processor — we will give at least 30 days’ notice in the App or by email before it takes effect. The date at the top of this page is always the date of the current version.

17. Contact

Privacy: legal-omnibus@paloheyna.com · Security: legal-omnibus@paloheyna.com · Support: support-omnibus@paloheyna.com