Privacy Policy

Last updated: October 3, 2026

This Privacy Policy explains how EmbedEasy ("we", "us") handles information in connection with EE-Persistent Cart (the "App"). The App keeps a logged-in customer's cart the same across the browsers and devices they use on a merchant's store, and shows the merchant how many carts it saved and restored. This policy applies to the App only.

For the store's customers, the merchant is the data controller and we process their data on the merchant's behalf. Shoppers who want to access or delete their data should contact the store; the store can pass the request to us through Shopify, and we act on every such request.

1. The data we access

The App requests the minimum Shopify access scopes it needs: read_customers, read_orders, read_products, write_app_proxy.

• read_customers lets Shopify tell the App which customer is logged in, as a numeric customer ID. The App does not read customer names, email addresses, phone numbers or postal addresses.
• read_orders and read_products let the App see when an order contains items it restored, and what those items cost.
• write_app_proxy lets the store's pages talk to the App securely through Shopify.

2. Information we process

• Store & authentication data: store domain, store ID, timezone and currency, and the store's Shopify access token (stored in our database on AWS). Restore alert settings and plan status are stored on the store itself in Shopify.
• Customer cart data: for logged-in customers only, the Shopify customer ID and the cart contents: product variant IDs, quantities, subscription plan IDs, and any line item properties the store attaches to cart items (for example, personalisation text), along with the cart token and the times items were changed. Guest shoppers' carts are never saved.
• Order data: for each new order, a limited set of fields from Shopify: order ID, order total, currency, creation time and cart attributes. For orders containing items the App restored, we also read the variant, quantity and price of those items. We ask Shopify not to send customer names, emails, addresses or full line item details.
• Browser storage: the App's storefront script uses the shopper's localStorage and sessionStorage to coordinate open tabs and avoid sending the same cart twice. It sets no cookies.
• Technical & usage data: standard server log data (IP address, request path, timestamps) used to keep the App reliable and secure, and daily totals (carts saved and restored, orders and revenue after a restore) that contain no customer identity.

3. How we use it

We use the data only to operate the App: to authenticate you with Shopify, save and restore your customers' carts across their devices, show the optional restore alert, build your dashboard, check your plan, and maintain reliability and security (including rate limiting). We do not sell your data, we do not use it for advertising, and we do not track shoppers across stores.

4. What we do not collect

• We do not process or store payment card information; billing is handled entirely by Shopify.
• We do not collect customer names, email addresses, phone numbers or postal addresses.
• We do not collect anything from shoppers who are not logged in.

5. Service providers (subprocessors)

• Shopify — the platform the App runs on, including billing.
• Amazon Web Services — hosting, database (DynamoDB) and encrypted backups (S3), in the United States (us-east-1).

We do not sell, rent, or trade your information, and we do not share it with advertisers.

6. Retention & deletion

• A saved cart is deleted automatically 90 days after its last change, and 7 days after the customer checks out.
• Rate-limit counters expire after 60 seconds.
• When Shopify sends a customers/data_request, we return everything we hold for that customer. On a customers/redact request, we delete that customer's saved carts and related records.
• When you uninstall the App (or on a shop/redact request), we delete your access token and purge your store's data, including saved carts and dashboard totals.
• Database backups are kept for up to 35 days, then overwritten.

7. Your rights

Depending on where you live, you may have rights under laws such as the EU/UK GDPR and the CCPA/CPRA (California), including the right to access, correct, delete, or port your personal data. Merchants can satisfy most such requests by uninstalling the App or by emailing us. Shoppers should contact the store they bought from, as described above. You can also email us at embedeasymod@gmail.com.

8. Data security

All data is transmitted over HTTPS/TLS. Our database and backups on AWS are encrypted at rest, and access to production systems is limited to the people who run the App. Every request from a storefront or from Shopify must carry a valid Shopify signature before we process it. Data is stored in the United States; for transfers from the EEA, UK or Switzerland we rely on safeguards such as the European Commission's Standard Contractual Clauses.

9. Changes to this policy

We may update this policy from time to time. Material changes will be reflected by updating the "Last updated" date above.

10. Contact

Questions or requests: embedeasymod@gmail.com.