Privacy Policy

Last updated: 2026-07-31

This Privacy Policy describes how Joycraft ("we", "us", or "our") collects, uses, and discloses your personal information when you install and use the CartNote Pro Shopify application ("the App").

1. Information We Collect

When you install and use the App, we may collect the following types of information:

• Store Information: Your Shopify store domain (myshopify.com URL), store name, and store owner email address. This is provided by Shopify during the OAuth installation process.
• App Configuration Data: Settings and preferences you configure within the App's admin dashboard (e.g., field labels, placeholders, field types, conditional display rules, and branding settings).

Data we do NOT store on our servers:

• Buyer-submitted note content — notes are written directly to your Shopify order data via Shopify's native checkout mechanisms (order note and order attributes) and are not retained on our servers.
• Customer personal data (names, addresses, payment details)
• Browser fingerprints or cross-site tracking data

2. How We Use Your Information

We use the collected information solely for the following purposes:

• To provide and maintain the App's core functionality on your store
• To authenticate your store and manage your App subscription
• To communicate with you about App updates, billing, or support inquiries

We do NOT sell, rent, or share your data with third parties for marketing purposes.

3. Data Storage and Retention

Your App configuration data is stored on our secure servers. We retain this data for as long as you have the App installed on your store.

Upon uninstallation: Access tokens, field configuration, and all note-related data are deleted immediately. A minimal subscription status record (plan type and billing period end date) is retained for the sole purpose of crediting any remaining paid days if you reinstall the App. This record contains no customer or order data. Shopify's mandatory shop/redact webhook permanently deletes this residual record within 48 days of uninstallation.

4. Data Sharing and Disclosure

We may share your information only in the following limited circumstances:

• Service Providers: We use cloud hosting and infrastructure providers. These providers are contractually obligated to protect your data.
• Legal Compliance: If required by law, court order, or governmental regulation, we may disclose information to comply with legal obligations.

5. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your data:

• Access: Request a copy of the data we hold about your store.
• Rectification: Correct any inaccurate or incomplete data.
• Erasure: Request deletion of your store's data. You can also achieve this by uninstalling the App.
• Portability: Receive your data in a structured, machine-readable format.

To exercise any of these rights, contact us at support@joycraft.dev. We will respond within 30 days.

6. Shopify API Compliance

The App uses Shopify's APIs to operate. By using the App, you agree to comply with Shopify's API License and Terms of Use. The App's access to your store data is governed by the permissions (scopes) you grant during installation. We handle all data received from Shopify in accordance with Shopify's API License requirements, including the mandatory GDPR webhook endpoints (customers/data_request, customers/redact, shop/redact).

7. Security

We implement industry-standard security measures to protect your data: all data transmission is encrypted via HTTPS/TLS, access tokens are stored with restricted file permissions, and webhook endpoints are protected by HMAC signature verification.

8. Cookies

The App operates within the Shopify Admin iframe and does not set any third-party cookies in merchant or customer browsers. The App relies on Shopify's session management for authentication.

9. Children's Privacy

Our App is not directed to children under 16. We do not knowingly collect personal information from children.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Continued use of the App after changes constitutes acceptance of the updated policy.

11. Contact Us

For questions about this Privacy Policy, contact us at support@joycraft.dev.

This policy is effective as of 2026-07-31.