At ShopyHub (hereinafter, "the Platform"), owned by Fractal Apps, we are committed to protecting our users' personal data. This Privacy Policy describes how we collect, use, store and protect your personal information, in compliance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).
1. Data controller
- Controller: Fractal Apps
- Lead developer: Xavier Munné Albuixech
- Address: Passeig Jaume Brutau 24-32, 08392 Sant Andreu de Llavaneres, Barcelona, Spain
- Contact email: info.shopyhub@protonmail.com
2. Data we collect
We may collect the following categories of personal data:
- Registration data: name, email address, encrypted password.
- Billing data: legal name, address, tax ID, payment details (handled by Stripe).
- Connected store data: Shopify URL, OAuth access token, product, customer and order information.
- Usage data: IP address, browser, operating system, pages visited, interactions with the platform.
- Communications: emails and messages exchanged with support.
3. Purposes of processing
Your personal data will be processed for the following purposes:
- Providing the contracted catalogue optimisation and management services.
- Managing registration, authentication and account maintenance.
- Processing payments, billing and subscriptions.
- Syncing and processing information from your Shopify store and other connected services.
- Handling queries, technical support and service communications.
- Complying with legal, accounting and tax obligations.
- Improving the platform through statistical analysis and fraud prevention.
4. Legal basis
- Performance of the contract: to provide the contracted service.
- Consent: for sending commercial communications and using non-essential cookies.
- Legitimate interest: for service improvement and fraud prevention.
- Compliance with legal obligations: in tax, accounting and consumer protection matters.
5. Data retention
Personal data will be retained while the contractual relationship is in force and thereafter for the legally required periods (a minimum of 6 years for tax and accounting obligations). Once those periods have elapsed, data will be securely deleted or anonymised.
6. Recipients and data processors
Your data may be shared with the following recipients in order to provide the service:
- Cloud infrastructure providers (hosting and data storage in the EU/EEA).
- Stripe Payments Europe Ltd. for payment processing.
- Shopify Inc. and Meta Platforms Inc. within the integrations authorised by the user.
- Generative AI providers (OpenAI, Anthropic, Google) for processing catalogue content under data processing agreements.
- Public authorities where there is a legal obligation.
Some of these providers may be located outside the European Economic Area. In such cases, international transfers are carried out under the appropriate safeguards provided for in the GDPR (Standard Contractual Clauses approved by the European Commission).
7. User rights
The User may exercise the following rights at any time:
- Access: to know which of your data we process.
- Rectification: to correct inaccurate or incomplete data.
- Erasure ("right to be forgotten"): to request deletion of your data.
- Objection: to object to the processing of your data.
- Restriction: to request restriction of processing.
- Portability: to receive your data in a structured format and transfer it.
- Withdrawal of consent at any time.
To exercise these rights, you may email us at info.shopyhub@protonmail.com, clearly stating the right you wish to exercise and attaching a document proving your identity.
You also have the right to lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) if you believe the processing of your data does not comply with current regulations.
8. Security
We apply appropriate technical and organisational measures to ensure the security and integrity of personal data, including encryption in transit (HTTPS/TLS) and at rest, access controls, regular backups and security audits.
9. Minors
The platform is intended exclusively for persons over 18 years of age or with legal capacity to contract. We do not knowingly collect data from minors.
10. Specific compliance for Shopify stores
When a merchant connects their Shopify store to ShopyHub, we receive only the data strictly necessary to provide the service (product catalogue, collections, order metadata for aggregated analysis and basic customer data). In compliance with Shopify's platform privacy obligations, we have implemented the three mandatory compliance webhooks:
- customers/data_request: when an end buyer requests access to their data through the store, we log the request and respond to the merchant within a maximum of 30 days from info.shopyhub@protonmail.com.
- customers/redact: 10 days after a buyer requests deletion of their data, we automatically remove all personal information of that customer stored in our systems.
- shop/redact: 48 hours after a merchant uninstalls ShopyHub, we automatically delete all data synced from their store (products, customers, sync logs). We keep only a minimal workspace record for legal and accounting audit purposes.
All webhooks are verified using an HMAC-SHA256 cryptographic signature with the app's shared secret, in accordance with Shopify Inc. specifications.
11. Amendments
This Privacy Policy may be updated to reflect legal or service changes. We will notify registered users of any material modification.