Privacy Policy

Last updated: 2026-07-31

This Privacy Policy describes how Joycraft ("we", "us", or "our") collects, uses, and discloses your personal information when you install and use the VatPO Pro Shopify application ("the App").

1. Information We Collect

When you install and use the App, we may collect the following types of information:

• Store Information: Your Shopify store domain (myshopify.com URL), store name, and store owner email address. This is provided by Shopify during the OAuth installation process.
• App Configuration Data: Settings and preferences you configure within the App's admin dashboard (e.g., VAT number field toggle, PO number field toggle, and custom placeholder text for checkout fields).
• Usage Data: Anonymous aggregated statistics about App installations and feature activations. We do NOT track individual customer behavior or browsing patterns.
• Checkout Form Data: When a customer enters a VAT number or purchase order number in the App's checkout fields, those values are attached to the merchant's order as Shopify order attributes (via the Checkout UI extension). VatPO Pro transmits these values to Shopify for the sole purpose of storing them on the order; we do not use them for any other purpose, and we do not process or store a separate copy of them.

We do NOT collect:

• Customer personal data (names, addresses, payment details)
• Bulk export or analytics over your store's order and transaction data (we only attach the customer-entered VAT/PO values to the relevant order; we do not read, copy, or analyze your order history)
• Browser fingerprints or cross-site tracking data

2. Lawful Basis (GDPR)

Where the GDPR applies, we process store and configuration information on the basis of contract performance (operating the App you installed) and our legitimate interest in securing and improving the service. Checkout VAT/PO values are processed solely to fulfill the App's core function of attaching them to the merchant's order, which is necessary for the contract between us and the merchant.

2. How We Use Your Information

We use the collected information solely for the following purposes:

• To provide and maintain the App's core functionality on your store
• To authenticate your store and manage your App subscription
• To communicate with you about App updates, billing, or support inquiries
• To improve the App based on aggregated, anonymized usage patterns

We do NOT sell, rent, or share your data with third parties for marketing purposes.

3. Data Storage and Retention

Your App configuration data is stored on our secure servers. We retain this data for as long as you have the App installed on your store. Upon uninstallation, all store-specific data is automatically deleted within 48 hours in accordance with Shopify's API license and data protection requirements.

4. Data Sharing and Disclosure

We may share your information only in the following limited circumstances:

• Service Providers: We use cloud hosting and infrastructure providers. These providers are contractually obligated to protect your data.
• Legal Compliance: If required by law, court order, or governmental regulation, we may disclose information to comply with legal obligations.

5. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your data:

• Access: Request a copy of the data we hold about your store.
• Rectification: Correct any inaccurate or incomplete data.
• Erasure: Request deletion of your store's data. You can also achieve this by uninstalling the App.
• Portability: Receive your data in a structured, machine-readable format.

To exercise any of these rights, contact us at support@joycraft.dev. We will respond within 30 days.

6. Shopify API Compliance

The App uses Shopify's APIs to operate. By using the App, you agree to comply with Shopify's API License and Terms of Use. The App's access to your store data is governed by the permissions (scopes) you grant during installation. We handle all data received from Shopify in accordance with Shopify's API License requirements, including the mandatory GDPR webhook endpoints (customers/data_request, customers/redact, shop/redact).

7. Security

We implement industry-standard security measures to protect your data: all data transmission is encrypted via HTTPS/TLS, access tokens are stored with restricted file permissions, and webhook endpoints are protected by HMAC signature verification.

8. Cookies

The App operates within the Shopify Admin iframe and does not set any third-party cookies in merchant or customer browsers. The App relies on Shopify's session management for authentication.

9. Children's Privacy

Our App is not directed to children under 16. We do not knowingly collect personal information from children.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Continued use of the App after changes constitutes acceptance of the updated policy.

11. Contact Us

For questions about this Privacy Policy, contact us at support@joycraft.dev.

This policy is effective as of 2026-07-31.