Privacy Policy

1. Introduction

Your privacy matters to us. Winsletapps (“we,” “us,” or “our”) develops and operates the Shopify app Winslet Wholesale Registration (the “App”). This Privacy Policy explains how we collect, use, store, share, and protect information when a merchant installs and uses the App, and when a merchant’s customers submit a wholesale application through it.

By installing the App, the merchant agrees to the practices described here.

Scope: This Privacy Policy applies only to information collected through the App.

Roles: When a Shopify merchant installs the App, that merchant is the data controller of its store and customer data. We act as a data processor, handling this data on the merchant’s behalf to provide the App’s features.

2. Information We Collect

2.1 Store data accessed through Shopify

The App requests the following access scopes: read_customers, write_customers, read_themes, write_files. This allows the App to read and create or update Shopify customer records, read theme data so the wholesale registration form can be embedded as a theme app block, and upload files submitted through the form, such as resale certificates. We request only the scopes required to deliver the App’s features.

2.2 Wholesale application data

When a merchant’s storefront visitor submits the wholesale registration form, the App collects the fields the merchant has configured for that form. Depending on configuration, this may include name, email address, phone number, company name, business address, uploaded files, and email marketing consent. This information is collected on the merchant’s behalf, stored in our database, and shown to the merchant for review.

2.3 Data synced to Shopify on approval

When a merchant approves an application, the App may create or update a Shopify customer record with the applicant’s name, email, and phone number; apply customer tags configured by the merchant; write custom metafields containing submitted field values; and update email marketing consent status, but only if and as the applicant actually provided it — consent is never assumed.

Business address, if collected by the form, is stored in our database for the merchant’s review only and is not written to the Shopify customer record.

2.4 Information you provide to us directly

If you contact us for support, we collect the details you provide, such as your name, email address, and message.

3. How We Use Information

• Operate the wholesale registration form, application review, and approval workflow
• Sync approved applicant data to Shopify customer records as configured by the merchant
• Respond to support requests
• Monitor, troubleshoot, and improve the App
• Meet legal and regulatory obligations, including Shopify’s compliance webhook requirements

We do not sell personal information.

4. Legal Bases for Processing (EEA and UK)

Where the GDPR or UK GDPR applies, we rely on: performance of a contract, to provide the App; legitimate interests, to operate and secure the App; consent, for email marketing status, which is only ever recorded as given by the applicant; and legal obligation. For store and customer data processed on a merchant’s behalf, the merchant determines the legal basis as data controller.

5. How We Share Information

• Shopify — the App runs on the Shopify platform and exchanges data with Shopify’s APIs to function.
• Service providers (subprocessors) — we use [hosting provider] and [database provider] to host the App and its data. These providers process data only under our instructions.
• Legal and safety — we may disclose information where required by law.
• Business transfers — if we are involved in a merger, acquisition, or asset sale, information may be transferred as part of that transaction.

We do not disclose personal information to third parties for their own marketing.

6. Data Retention and Deletion

We retain wholesale application data for as long as the App is installed and as needed to provide its features, or until deletion is requested.

When a merchant uninstalls the App, we delete the shop’s data within [retention period], unless a longer period is required by law.

We comply with Shopify’s mandatory compliance webhooks:

• customers/data_request — we return the stored wholesale application data linked to the specified customer.
• customers/redact — we permanently delete the specified customer’s submitted field values and identifiers.
• shop/redact — we delete the shop’s data after uninstall.

7. Data Security

We take reasonable technical and organizational measures to protect information, including [encryption in transit / at rest, access controls]. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

8. International Data Transfers

We may process and store information in [country/region of hosting]. Where required, we put appropriate safeguards in place for international transfers.

9. Your Rights

Depending on your location, you may have the right to access, correct, delete, or restrict the use of your personal information, object to certain processing, request data portability, and withdraw consent. To exercise these rights for data we control directly, contact us using Section 12.

If your request concerns data submitted to a specific merchant’s store, please contact that merchant directly, as they control that data. We will assist the merchant as their processor.

10. Children’s Privacy

The App is intended for business use and is not directed to children under 16. We do not knowingly collect personal information from children.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated version here and revise the “Last updated” date. Significant changes may be communicated through the App or by email.

12. Contact Us

Winsletapps
ajmal.developer@gmail.com