Skip to main content

Privacy compliance

If your app collects, stores, or processes personal data of merchants or their customers, you are responsible for handling that data lawfully. This guide describes the practices that keep your app compliant and are checked in the data and user privacy requirements during app review.

note

This page isn't legal advice. Privacy laws such as the EU's General Data Protection Regulation (GDPR) set requirements that depend on where your merchants and their customers are located — consult a legal professional for your specific situation.

Know your responsibilities​

When your app processes personal data — customer names, emails, addresses, order contents — you act as a data processor or controller under laws like the GDPR. That responsibility is yours, not Shoplazza's: if your app serves merchants based in Europe, or merchants with customers in Europe, you must make sure your app is GDPR compliant. Similar laws exist in other regions, so the safest approach is to apply the same privacy standard to all personal data, regardless of where an individual is located.

Collect only the data you need​

The less personal data you hold, the smaller your risk and your obligations:

  • Request only the access scopes your features require. Don't request read_customers because you might need it someday.
  • Store only the fields you use. If you only need an order's total and status, don't persist the full customer object that came with the webhook payload.
  • Don't stockpile data. Delete data that no longer serves the feature it was collected for, and set retention periods instead of keeping records forever.

If your app runs marketing or advertising campaigns that use personal information, it must have a mechanism for users to give consent before their data is used, and to revoke that consent at any time. Record when and how consent was given, and stop processing immediately when it's withdrawn.

Publish a privacy policy​

Your app listing must include a link to a privacy policy that explains, in plain language:

  • what data your app collects and why,
  • where the data is stored and how long it's kept,
  • what third parties (if any) the data is shared with,
  • how a merchant or customer can request access to or deletion of their data, and how to contact you.

A clear privacy policy is also what builds merchant trust before they install your app.

Respond to data deletion requests​

Merchants and their customers have the right to request deletion of their personal data. Shoplazza currently doesn't send apps an automated notification (such as a webhook) when such a request is made, so your app needs its own process:

  • Provide a request channel — a support email or a form inside your app — and state it in your privacy policy.
  • Delete promptly and completely when a request arrives: remove the person's data from your database, caches, and backups within your stated timeframe, unless you're legally required to retain it.
  • Keep a record of each request and when it was fulfilled, so you can demonstrate compliance.

Also handle the end of a merchant relationship: when a store uninstalls your app (you receive the app/uninstalled webhook), clean up that store's data instead of keeping it indefinitely.