Privacy Policy

FlowWarranty ("we", "our", or "us") operates the FlowWarranty Shopify app (the "App"). This Privacy Policy explains how we collect, use, store, and delete personal data when you install and use the App.

1. Data We Collect

When you install the App

We collect the following information about your Shopify store:

• Shop ID — a numeric identifier for your store
• Shop domain — your store's .myshopify.com domain (and any custom domain)
• Shop name — the name of your store
• Access token — an OAuth token that allows the App to interact with your store's data via the Shopify Admin API

When customers purchase a warranty

For each warranty sold, we collect the following information about the customer who purchased it:

• Customer ID — a numeric identifier from Shopify
• Customer name — first and last name as recorded in the order
• Customer email — used to send claim notifications and show warranty information
• Order information — order ID, order name, line item details, product IDs, prices, and currency

When a customer files a warranty claim

• Claim details — description of the issue, warranty ID, and any resolution notes

2. How We Collect Data

Data is collected through the following channels:

• Shopify Admin API — during app installation (store info, token) and via registered webhooks (orders, refunds, customer data)
• Shopify Webhooks — we subscribe to orders/paid, refunds/create, orders/cancelled, app/uninstalled, app_subscriptions/update, and products/delete webhooks
• Customer-facing forms — claim submission forms submitted directly by customers through the App's public pages
• Storefront interactions — warranty selections made during checkout (captured via line item properties)

3. How We Use Data

We use the collected data solely for the purpose of operating the App:

• Tracking warranty coverage and expiration dates for your customers
• Processing warranty claims submitted by customers
• Sending notification emails when claims are filed, approved, or rejected
• Displaying warranty information in your Shopify admin and your customers' account pages
• Supporting the product page warranty picker and cart functionality
• Managing billing and subscriptions via Shopify's billing system
• Improving the App's functionality and user experience

We do not sell, rent, or share your data with third parties for their own purposes. We do not use customer data for advertising, profiling, or training AI models.

4. Data Retention

Customer data (name, email, order information) is retained for the duration of the applicable warranty period plus 30 days. After that period, identifying information is purged from our systems.

Shop data (shop ID, domain, access token) is retained for as long as the App is installed on your store. When the App is uninstalled, all associated data is deleted promptly.

5. Data Deletion

Data is deleted in the following circumstances:

• App uninstallation — when a merchant uninstalls FlowWarranty, the app/uninstalled webhook triggers deletion of all shop data, customer records, and warranty information
• Customer data erasure request — when a customer requests erasure via Shopify's privacy mechanisms, all associated customer data is deleted
• Shop data erasure — when a shop requests full erasure, all customer records associated with that shop are deleted

6. GDPR Compliance

FlowWarranty fully supports Shopify's GDPR webhooks:

• customers/data_request — when a customer requests access to their data, we log the request (the data is available through the merchant's Shopify admin or by contacting us directly)
• customers/redact — when a customer requests erasure, their personally identifiable information is permanently deleted from our systems
• shop/redact — when a store owner requests erasure, all customer data associated with that shop is permanently deleted

Merchants and customers can also contact us directly to exercise their data access, rectification, erasure, or portability rights (see Section 10).

7. Data Storage & Security

Data is stored in encrypted SQLite databases within the FlowWarranty service infrastructure. We implement industry-standard security measures including:

• Encryption of sensitive customer identifiers
• HMAC-signed webhook verification to prevent forgery
• OAuth-based authentication for all API access
• Idempotent key-based request deduplication

8. Third-Party Services

FlowWarranty uses the following third-party services:

• Shopify — via the Shopify Admin API for order, product, and customer data; via Shopify Functions for cart transformations; and via Shopify Webhooks for real-time event notifications
• Email delivery — for sending claim notification emails (customer name and email are transmitted to our email service provider)

9. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted at this URL, and the "Last updated" date at the top will be revised. For material changes, we will notify merchants through the App's dashboard or via email.

10. Contact

If you have a privacy concern or complaint, you can also contact Shopify's privacy team or your local data protection authority.