How we handle your data

1. Scope of this policy

This Privacy Policy describes how ZS Sections ("we", "us", "our") handles personal information when you:

• Visit our website at zssections.com;
• Install or use the ZS Sections app on your Shopify store;
• Contact us by email or through any form on our website.

Throughout this policy, "you" refers to the Shopify merchant who installs or uses our app, or the visitor browsing our website.

2. What we collect

We collect only the minimum information required to operate the app and provide support. This includes:

2.1 Information from Shopify

When you install ZS Sections through the Shopify App Store, Shopify shares the following information with us:

• Shop domain (e.g., your-store.myshopify.com);
• Shop owner name and email address;
• Country and locale of the store;
• Shopify plan (Basic, Shopify, Advanced, etc.);
• OAuth access token — encrypted and used only to install or update theme sections you choose.

2.2 Information you give us directly

• Support messages: Anything you write when emailing us or filling out a contact form;
• Newsletter sign-ups: Your email address, only if you choose to subscribe.

2.3 Information collected automatically

When you use the app or visit our website, we automatically log:

• App activity: Which sections you install, uninstall, or preview — used to debug issues and improve the library;
• Technical data: Browser type, operating system, IP address, page URLs, and timestamps;
• Error logs: If something fails, the error and basic context so we can fix it.

3. What we don't collect

To be explicit about what stays out of our system:

• We do not collect customer data from your store. We never read or store names, emails, addresses, or order history of your customers.
• We do not access your products or inventory. The app does not request or use the products API.
• We do not track your storefront visitors. The sections we install do not contain analytics scripts, fingerprinting, or third-party trackers.
• We do not collect payment card details. All app charges are processed by Shopify Billing.

4. How we use information

We use the information described above for these purposes only:

• Run the app: Authenticate your store, install or update the theme sections you select;
• Provide support: Respond to your questions and troubleshoot issues;
• Improve the product: Understand which sections are popular or where users get stuck, in aggregate form;
• Communicate: Send transactional emails about the app (e.g., install confirmations, security notices) and — only if you opt in — occasional product updates and newsletters;
• Comply with the law: Meet legal, tax, and regulatory obligations.

5. Legal basis for processing (GDPR)

For users in the European Economic Area, United Kingdom, or other regions with similar laws, we rely on the following legal bases:

• Contract: Processing required to deliver the app you installed;
• Legitimate interest: Maintaining service security, preventing fraud, and improving the product;
• Consent: Newsletter sign-ups and any other marketing communications — you can withdraw consent at any time;
• Legal obligation: Where we must process data to comply with applicable laws.

6. When we share information

We do not sell your data. We share information only with the service providers we need to run the app, and only the minimum required:

We may also disclose information if required by law, to protect our rights, or in connection with a merger, acquisition, or sale of business assets — in which case we would notify you in advance.

7. How long we keep data

• While the app is installed: We retain your store information for as long as the app remains installed.
• After uninstall: We delete most operational data within 90 days of uninstall, unless we are required to keep it longer for legal or tax reasons.
• Support emails: Kept for up to 2 years to maintain a service history.
• Billing records: Retained for up to 7 years to meet accounting and tax law requirements.
• Server logs: Routinely deleted within 90 days.

You can request earlier deletion at any time — see section 9.

8. How we protect data

We follow industry-standard security practices to keep your information safe:

• All data is transmitted over HTTPS with TLS encryption;
• Sensitive data such as OAuth access tokens is encrypted at rest;
• Access to production systems is restricted to authorized personnel only;
• We follow Shopify's security best practices, including HMAC verification on all webhooks;
• We monitor for unauthorized access and unusual activity.

No method of transmission or storage is perfectly secure. While we work hard to protect your data, we cannot guarantee absolute security.

9. Your privacy rights

Depending on where you live, you may have the following rights over the personal information we hold about you:

• Access: Request a copy of the information we hold;
• Correction: Ask us to fix anything that is inaccurate;
• Deletion: Request that we delete your data ("right to be forgotten");
• Restriction: Ask us to limit how we use your data;
• Portability: Request your data in a machine-readable format;
• Objection: Object to processing based on legitimate interest;
• Withdraw consent: If we rely on your consent (e.g., newsletter sign-ups), you can withdraw it at any time;
• Lodge a complaint: Contact your local data protection authority.

To exercise any of these rights, email us at contact@zssections.com. We respond within 30 days as required by law.

9.1 GDPR compliance webhooks

As required by the Shopify App Store, we implement the three mandatory compliance webhooks:

• customers/data_request: If a customer of your store submits a data request through Shopify, we receive the notification and confirm whether we hold any data on that customer (we don't, since we do not collect customer data);
• customers/redact: If a customer of your store requests deletion, we confirm the request — again, we have nothing to delete because we do not store customer data;
• shop/redact: 48 hours after you uninstall the app, Shopify sends us this webhook and we delete all data associated with your shop.

10. International data transfers

Our service providers may process data in countries other than yours, including the United States. When we transfer personal data across borders, we use appropriate safeguards such as Standard Contractual Clauses or rely on adequacy decisions where they apply.

11. Cookies on our website

Our website at zssections.com uses essential cookies to keep the site working (e.g., maintaining your session). We do not use advertising cookies or cross-site tracking.

For more details, see our Cookie Policy.

12. Children's privacy

ZS Sections is built for Shopify merchants and is intended for adult business users. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us with information, please email contact@zssections.com and we will delete it promptly.

13. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will:

• Update the "Last updated" date at the top of this page;
• Notify active merchants through the app and by email if the changes are material;
• Post the new version on this page.

Continuing to use the app after a change takes effect means you accept the updated policy.

14. Contact us

If you have any questions, requests, or concerns about this Privacy Policy or how we handle your information, please get in touch.