Xupro Apps Privacy Policy · Transilvania Marketing

This policy explains how we handle personal data in the Shopify apps we publish under the Xupro brand. Part A applies to all Xupro apps. Each app then has its own part, which says exactly what that app stores, where, why and for how long. Where an app's part is more specific than Part A, the app's part applies to that app.

App	Its part of this policy
Xupro Wishlist	Part B

The Xupro Terms of Service, which include our data processing agreement, are at https://transylvaniamarketing.com/xupro/terms. Our agency website and our other services have a separate privacy policy: https://transylvaniamarketing.com/confidentialitate.

Part A. Common to all Xupro apps

A1. Who we are

Xupro is a brand of TRANSYLVANIA MARKETING LTD S.R.L., a Romanian company, tax ID (CUI) RO43230933, trade register no. J2020001439320, registered office Str. Crișanei nr. 2, 550012 Sibiu, Romania ("we", "us").

Privacy questions and requests: contact@transilvaniamarketing.ro
Help with using an app: xupro@xtbs.ro

A2. Our two roles

Whose data	Our role	What it means
Personal data of your shoppers and customers, in your store or on another sales channel you connect to an app, that an app handles for you	Processor (Article 28 GDPR). You, the merchant, are the controller.	We process this data only to provide the app to your store and only on your instructions, as set out in our data processing agreement (Annex 1 to the Xupro Terms of Service). We do not use it for our own purposes.
Data about you as our customer: your store's connection to the app and the messages you send us	Controller	See A3.

As the controller of your shoppers' data, you decide the legal basis, you tell your shoppers about the processing in your own privacy policy, and you answer their requests. We help you with each of these (A7).

A3. Data we handle as controller

Data	Why	Legal basis	How long
Store connection data: your store's `*.myshopify.com` domain, install and uninstall dates, the access scopes you granted, and the access token Shopify issues for your store. Each app's part lists the exact fields, including any app settings.	To run the app for your store and keep it secure	Performing our agreement with you, Article 6(1)(b) GDPR; our legitimate interest in security, Article 6(1)(f)	As stated in each app's part
Messages you send us: your email address, your name if you give it, and the content	To answer you and keep a record of what we agreed	Article 6(1)(b) and (f) GDPR	As long as we need them to handle your request and, after that, as long as we may need them to establish or defend legal claims

If an app needs credentials for another service that you connect to it, the app's part describes them.

A4. What we do not do

We do not sell personal data, and we do not share it for cross-context behavioural advertising.
We do not use your shoppers' personal data for our own purposes, such as our own advertising, profiling or analytics.
We do not combine your customers' data between stores. Each store's customer data is kept separate and used only for that store.
We do not make decisions based solely on automated processing that have legal or similarly significant effects on people (Article 22 GDPR). Automatic checks that an app uses are described in its part.
We do not give personal data to anyone other than the recipients named in A5 and in each app's part.

A5. Who receives the data

Our service providers (sub-processors). Each app's part names them, says where they process the data and which safeguards apply to transfers outside the European Economic Area (EEA).
Shopify. The apps run on the Shopify platform, which you chose for your store. Data that an app reads from your store or writes back to it passes through Shopify, under Shopify's terms with you. Shopify is not our sub-processor.
Other platforms you connect to an app, such as a marketplace, receive the data the app sends them on your instructions. They act under their own terms with you, and each app's part names them.
Our email providers store the messages you send us (A3).
Authorities, only when Romanian or EU law obliges us. Unless the law forbids it, we tell you first.

A6. Security

These measures apply to all Xupro apps. Each app's part adds its own.

All traffic to and from our apps uses HTTPS (TLS).
Webhooks and other requests that Shopify sends to our apps are checked by signature before we act on them. Unsigned or wrongly signed requests are rejected.
Access to the systems and data of the apps is limited to the people who need it to run them.

If we become aware of a personal data breach affecting data we process for you, we notify you without undue delay (Article 33(2) GDPR). We tell you what we know at that point (what happened, which data and roughly how many people are affected, the likely consequences and the measures taken) and we complete the information as we learn more, so you can meet your own obligations.

A7. Rights and requests

Shoppers have the rights set out in GDPR: access, rectification, erasure, restriction, objection and portability, and the right to lodge a complaint with a data protection authority.

Shoppers: please send your request to the store or seller you bought from. The store or seller is the controller. If you write to us, we forward your request to the store, if we can identify it, and tell you that we did.
Merchants: Shopify forwards your shoppers' requests to us automatically (customers/data_request, customers/redact) and tells us when your store's data must be erased (shop/redact). We handle them as described in each app's part, within 30 days of receipt. Requests that do not reach us through Shopify, for example from buyers on a marketplace, are handled as described in the app's part. If you need our help with any other request, write to contact@transilvaniamarketing.ro; we answer within 30 days.
Merchants as data subjects: for the data we hold as controller (A3), you have the same rights. Write to contact@transilvaniamarketing.ro; we answer within the time limits set by GDPR.

Our supervisory authority is ANSPDCP (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal), B-dul G-ral. Gheorghe Magheru 28-30, sector 1, 010336 București, Romania, www.dataprotection.ro. You can also complain to the data protection authority of the EU country where you live or work.

A8. Changes to this policy

When we change how an app processes personal data, or add an app, we update this page and its date. If a change adds new categories of personal data, a new purpose or a new sub-processor to an app you use, we tell you in the app's admin screen before the change takes effect.

Part B. Xupro Wishlist

B1. What the app does

Xupro Wishlist adds a heart button, a saved-items counter and a wishlist page to your online store. Shoppers save products and come back to them later. They do not need an account to save.

B2. Shoppers without an account

A shopper who is not signed in saves products only in their own browser (local storage). Nothing is sent to us. The app does not set cookies.

When the shopper signs in to a customer account, the products saved in the browser are sent to us once and added to the account's wishlist ("merge"). The browser's copy for guests is then removed, and from then on the wishlist belongs to the account.

B3. Shoppers with an account: what we store

Data	Where	Why	How long
The Shopify customer ID (a number). It does not contain the customer's name or contact details, but it is still personal data, because your store can link it to the customer.	Our database (Cloudflare D1) and the wishlist metafield on the customer in your Shopify store	To tie the wishlist to the signed-in customer on every device	While the customer has at least one saved product. It is deleted with the last product, on `customers/redact` or on `shop/redact` (B8).
The product ID, the variant ID (if one was chosen), the product handle and the date saved	Same	To show the wishlist	Until the shopper removes the product, or on `customers/redact` or `shop/redact`
The price of the variant at the moment it was saved	Our database only	Kept for a planned price-drop feature. The app does not use it yet.	Same as the product
A record of a customer data request: your store's domain, the request ID, the customer ID and the time it was received	Our database only	So that each request reaches a person and is answered within 30 days	90 days after our privacy contact is notified, or earlier on `customers/redact` or `shop/redact`
A copy of the list, with the customer ID, in the shopper's browser (local storage)	The shopper's browser	To show the list without a request to our server on each page	Until the shopper signs out (it is removed at the next page view), clears the browser data, or a newer copy replaces it

The wishlist is stored in our database and copied into a metafield on the customer in your store, with the product IDs, variant IDs, handles and dates (no prices). Your staff can read it in the Shopify admin but cannot edit it. The metafield is part of your store's customer data and stays under your and Shopify's control; the app does not remove it when you uninstall.

We do not collect or store names, email addresses, phone numbers, postal addresses, payment data, order data or browsing history. We do not store IP addresses or device identifiers. The app asks Shopify for protected customer data without any of the name, email, phone or address fields.

B4. Events for your store's pixels

When a shopper saves or removes a product, the app publishes an event in the shopper's browser to your store's customer events system (Shopify customer events). The app puts only product data in the event: product ID, variant ID, handle, title, price and currency. Like every customer event, Shopify adds its own technical fields, such as a browser identifier and the page context. The app does not receive these events and does not send them anywhere. Pixels that you set up in your store can use them, according to the customer privacy permissions you give those pixels. Choosing and configuring those pixels, and the related consent, are your decisions as controller.

B5. Merchant data (we are the controller)

When you install the app we store: your store's *.myshopify.com domain, the install and uninstall dates, the date of the last update, the scopes you granted, and the access and refresh tokens issued by Shopify (encrypted) with their expiry. We do not store the names or emails of your staff. When someone from your staff opens the app, we verify the session with a token signed by Shopify and keep only the store domain from it.

Scopes the app requests:

read_products: to check that a saved product exists and is active, and to read its handle and price;
write_customers: to write the wishlist into the customer's metafield (Shopify requires this scope for that);
write_app_proxy: required for the app to answer requests from your storefront.

B6. Where the data is and who receives it

Cloudflare, Inc., 101 Townsend St., San Francisco, California 94107, USA, hosts the app's server (Cloudflare Workers) and its database (Cloudflare D1), as our sub-processor, under Cloudflare's data processing addendum. Cloudflare's own sub-processors are listed at https://www.cloudflare.com/gdpr/subprocessors/.
Location and transfers. We created the database with Cloudflare's location hint for Eastern Europe, and it runs there today. Cloudflare states that a location hint does not guarantee where the database runs, and the app's server runs on Cloudflare's global network, so a request can be handled in a data center outside the EEA. We therefore do not promise that the data stays in the EEA. Transfers outside the EEA rely on the EU Standard Contractual Clauses incorporated in Cloudflare's data processing addendum and on Cloudflare's certification under the EU–U.S. Data Privacy Framework.
Cloudflare also processes technical data about each request, such as the IP address, to deliver and protect the service.
Shopify receives the copy of the wishlist in your store's customer metafield (B3).
There are no other recipients.

B7. Security (in addition to A6)

Store access tokens are encrypted with AES-256-GCM before we store them. The tokens expire and are refreshed, as Shopify requires for public apps.
Cloudflare encrypts the database at rest (AES-256) and in transit (TLS).
Requests from your storefront are accepted only with Shopify's app proxy signature and a recent timestamp. The customer ID is taken only from the parameters signed by Shopify, never from the content of the request, and every product is checked against your store before it is saved.
Changes to a wishlist are rate-limited per customer, to stop abuse.

B8. Retention and deletion

The shopper removes a product: the product is deleted from our database at once. When the last product is removed, the list record with the customer ID is deleted too. The metafield is updated in the same request; if that update fails, it is corrected at the next change to the list.
Customer erasure (customers/redact): when Shopify sends it, we delete that customer's products and list from our database. The metafield is in your store, under your and Shopify's control.
The app is uninstalled: the access token is deleted from our database at once. Saved lists and the store record stay until Shopify sends shop/redact, 48 hours after uninstall, so that a quick reinstall keeps them. Then we delete all of your store's data from our database, including the store record.
Customer data request (customers/data_request): we confirm receipt to Shopify and record the request in our database (your store's domain, the request ID, the customer ID and the time it was received). Our privacy contact is notified by email once a day, and within 30 days we send you, the merchant, the customer's saved list from our database. We delete the record 90 days after that notification, or earlier on customers/redact or shop/redact, and we delete the notification email once we have answered.
The provider's restore history: Cloudflare automatically keeps a history of the database for up to 30 days, so that it can be restored to an earlier point in time (Time Travel). This feature is always on. Data deleted from our database stays in this history until it expires, so it is fully gone at the latest 30 days after deletion. We use this history only to restore the database after a technical incident.
No other copies: we do not export or back up the database outside Cloudflare.
Logs: we do not store the logs of the app's server; log storage and log export are not turned on. When we troubleshoot a problem, we may watch requests in real time. This view can show request details, including the customer ID, and we keep any extract only as long as needed to fix the problem.

B9. Purpose and legal basis

Purpose: to provide the wishlist to your store and its shoppers. For shopper data we act on your instructions, as your processor; you choose the legal basis. For the data we hold as controller (B5), the legal bases are in A3.

B10. Automated decisions and messages

Xupro Wishlist makes no automated decisions about people and sends no emails or other messages to shoppers.