Scope
This draft Privacy Policy is intended to explain how [legal entity name], operating as Flow Product Recommendations (“Flow”, “we”, “us”), may collect, use, disclose, and protect information when merchants use the Flow Shopify application, related support services, and this website.
It does not replace the merchant’s own privacy policy or determine the merchant’s obligations to shoppers. Merchants remain responsible for their own store, customer communications, and legal obligations.
Information Flow may process
To provide the application, Flow may process information supplied through Shopify and information a merchant enters in Flow, including:
- Merchant account and store information, such as store domain, shop details, and the identity information Shopify makes available to the application.
- Product catalog information that the merchant authorizes Flow to access for building product recommendations.
- Funnel configuration, product associations, and settings created by the merchant.
- Operational records needed to authenticate the installation, provide support, secure the service, and diagnose errors.
Flow should not be configured to request or collect more information than required for these stated purposes. Any future collection of shopper personal data must be documented here before it is introduced in production.
How information is used
Flow may use information to provide and maintain the app, display merchant-configured product recommendations, provide support, protect the security and integrity of the service, and meet applicable legal obligations. Flow does not sell merchant information.
Information is not used for unrelated advertising or to create third-party marketing audiences unless this policy is first updated and a valid legal basis is established.
Retention and security
Information is retained only for as long as reasonably necessary to operate the service, resolve disputes, meet legal obligations, and enforce agreements. Production retention periods, deletion procedures, hosting locations, and backup practices remain to be documented by [legal entity name] before launch.
Flow uses reasonable technical and organizational safeguards appropriate to the nature of the information it processes. No system can guarantee absolute security.
Your rights and choices
Depending on applicable law and the relationship to the information, an individual may have rights to request access, correction, deletion, restriction, objection, or portability. Requests should be sent using the contact information below. Flow may need to verify a request and may be unable to fulfill it where an exception applies.
Contact
For privacy questions or requests, contact [privacy contact email]. The business address is [legal business address].
Effective date: [insert after legal review].