Privacy · Shopify apps

Who we are and our role

JABL Works is a trade name of JABL Trading, based in Dordrecht, the Netherlands (Chamber of Commerce 84235713). Privacy questions can be sent to info@jablworks.com.

For the data of the store itself (the store that installs an app), JABL Trading is the controller.

For the data of the store’s customers, such as the email address in Restock Alerts, the store is the controller and JABL Trading is the processor. We only process that data on the store’s instructions, as set out in our terms for the Shopify apps.

Data all apps process

Store data Shopify provides at installation: the Shopify domain, store name, time zone and currency, and an access token that lets the app work on the store’s behalf. When a staff member uses the app, Shopify may include their name and email address; we only use these for that session.

The settings the store chooses in the app, such as texts, colours and which parts are switched on.

Product data an app needs to work, such as products, variants, prices, inventory and locations. We fetch it from Shopify using only the permissions the app requests.

Aggregated usage figures, such as how often a block was shown per day. These contain no visitor data.

Per app

In-Stock Price reads products and variants to show, on product cards, the price of a variant that can actually be bought. The app counts per page how many cards it recognises and keeps a few examples of corrected prices (product and price). No visitor data is stored.

Stock by Store reads products, variants, inventory per location and the names and addresses of store locations, so visitors can see per size which store has it. The app counts per day how often the block was shown, without visitor data.

Badges & Staff Picks reads product data and writes tags and fields on products, such as a badge, a campaign or a tip from a colleague. For a tip the store can enter the colleague’s first name and store; these are stored in the store’s own product data.

Restock Alerts processes data of customers who sign up for a sold-out variant: the email address, the product and variant, optionally a store, the language, the moment of sign-up and consent, the status of the alert and tokens to unsubscribe or confirm. The email address is stored encrypted (AES-256-GCM); to recognise duplicate sign-ups we use a keyed one-way hash. The device’s IP address is only used in server memory, for up to ten minutes, to stop abuse; it is not stored.

The email address is only used for the message the customer asked for: one email as soon as the variant is back, plus the confirmation email when double opt-in is on. Never for newsletters or marketing. The email is sent through the mail server or email service the store sets up in the app.

Why we process it

To provide the app the store installed. The legal basis is the contract with the store (Article 6(1)(b) GDPR).

To keep the apps secure, stop abuse and fix errors. The legal basis is our legitimate interest (Article 6(1)(f) GDPR).

For Restock Alerts, the store asks the customer’s consent for that one email. The store is responsible for this; we process the sign-up on its behalf.

How long we keep data

We keep store data for as long as an app is installed.

A Restock Alerts sign-up is deleted once the email has been sent, after unsubscribing or when it expires, and at the latest after the retention period the store chooses (30 to 365 days, 90 by default). A sign-up that is not confirmed under double opt-in is deleted after seven days.

When a store uninstalls an app, Shopify sends us a request shortly afterwards to delete all of that store’s data, and we then delete it completely. Until then we only keep the settings, so reinstalling works.

Backups are kept for fourteen days and then overwritten.

Where data is stored and who we share it with

The apps and their databases run on OVHcloud servers in France, within the EU.

Data only goes to Shopify (the platform the apps run on) and, for Restock Alerts, to the mail server or email service the store chooses.

We never sell data and never use it for advertising or for anything other than the app.

Security

All connections are encrypted. Customers’ email addresses are stored encrypted in the database. Keys and passwords are kept out of the code, and only people who need it have access to the servers.

If we discover a data breach affecting a store’s data or its customers’ data, we inform the store without undue delay.

Your rights

If you are a customer of a store and want access or deletion, contact that store. Shopify forwards such requests to us and we handle them automatically.

If you are a store, send your request to info@jablworks.com; we respond within four weeks.

If you disagree with how we handle data, you can lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

Changes

If apps or features are added that process other data, we update this statement. The date at the top shows when it last changed. Important changes are also announced in the app.