Privacy policy

In one sentence

Delivery Countdown & Drop reads your store's inventory and products to display messages on your product pages. The only shopper data collected is the contact address your customers give us themselves to be notified when an item is back in stock, and only if they fill out that form. No orders, no browsing behavior, no audience measurement.

Our role

You remain the controller of your store's data. Delivery Countdown & Drop acts as a processor: we process this data only to run the displays you configure, and for no other purpose. We don't sell it and don't share it with any third party for commercial purposes.

What the app reads

Three permissions are requested at installation, and no others:

• read_inventory: your products' inventory, to know when to show a badge or a banner.
• write_products: the title, SKU and image of the products you track, and writing the metafields described below.
• write_app_proxy: the route the alert form on your product pages uses to reach the app. It doesn't grant access to any data: it declares an address, nothing more.

The app also reads your store's ID, time zone and domain, which it needs to work.

What the app writes

Metafields in a namespace reserved for the app, on your products and on your store. They hold only your settings (restock status, messages you wrote, countdown length, badge rules) and are exposed to your storefront so your theme can read them. Nothing is written outside this namespace.

What the app keeps

On our servers, only:

• Your Shopify session: access token, domain, and the name and email address of the admin account that installed the app, provided by Shopify.
• Your settings: messages, teasers, countdown length.
• The list of products you track: their ID, title, status and the date of their last inventory change.
• A cache of inventory item IDs: to discard, without a network call, inventory changes that don't concern a tracked product.
• Your badge rules: stock ranges, messages, colors, priorities.
• Your delivery time settings: order cutoff time, lead time, step labels, widget colors and the lines you wrote.
• The modules you turned on: their name, the date they were turned on and their current tier (covered by the subscription or not).
• Your Shopify subscription reference: its ID, status, amount and the list of modules it covers. No payment details: payment is handled end to end by Shopify, which never shares any with us.

This data is hosted by OVHcloud, in France (European Union). Traffic to the app goes through Cloudflare, which routes it without keeping its content. No analytics tools, no advertising trackers and no third-party cookies are used.

Back-in-stock alerts

When an item is sold out, your product pages can offer your customers the option to be notified when it's back. This form is the only place where the app collects a shopper's personal data, and only if that person fills it out.

What is then kept:

• The email address, or the phone number in international format if the WhatsApp channel is offered and chosen. Nothing else: no first or last name, no customer account.
• The product and variant they're waiting for, so we know what to announce and to whom.
• Proof of consent: its date, and the channel it applies to. The two channels are consented to separately: giving an email address never signs anyone up for WhatsApp.
• A fingerprint of the IP address, salted and truncated, to limit abusive sign-ups. The address itself is never stored.
• A record of the messages sent: their date, delivery status and, if delivery failed, the reason returned by the provider.

These contact details are used only for that send. They are not sold, not used for marketing, and not added to the merchant's mailing list. Every message includes a single-use unsubscribe link, and the request is closed as soon as it's clicked.

Messages are sent through Brevo, our delivery processor, whose servers we use are located in the European Union. It receives the recipient's address and the message content, solely for the purpose of delivering it.

Retention. A request is erased when the merchant uninstalls the app, when Shopify sends us an erasure request, or when the person unsubscribes. Past sends are kept anonymized: without an address or number, they can no longer identify anyone, but they still let the merchant explain a message that was received.

What the app doesn't do

• None of your customers' data is read from your store: no customer records, no orders, no carts. The only shopper data held is what shoppers give us themselves when they request an alert; see the previous section.
• No audience measurement: we don't know who saw a badge, or how many times.
• No network calls added when your product pages load on the normal path; the data is already in the page's code.

Data retention

Data is kept for as long as the app is installed. When you uninstall, everything is deleted: all the categories above, immediately and with no action needed on your part. The purge runs again when Shopify sends us its erasure request, 48 hours later.

Metafields already written to your products remain your property and are not deleted by us: uninstalling revokes our access to your store. You can delete them from your Shopify settings.

Your rights

You can request access to, correction or deletion of the data above, or its portability, at any time by emailing thomas@flowz.fr. Uninstalling the app results in the same deletion, immediately.

Changes

Any change to this policy will be published on this page, with its update date. A change that would expand what we collect will be announced to you in the app.