Privacy Policy

Overview

Wishlist Zero (“we,” “us,” and “our”) provides wishlist functionality for Shopify stores. This policy explains how we handle information when a merchant installs the Wishlist Zero app or when a shopper uses Wishlist Zero on a merchant's storefront. The merchant's own privacy policy also applies to that shopper's relationship with the merchant.

Information we handle

We handle only the information needed to provide Wishlist Zero:

• Merchant and store information, such as the store domain, app settings, and Shopify access tokens needed to operate the app.
• Wishlist data, including product, variant, and (where relevant) selling-plan identifiers. For signed-in shoppers, wishlist items are stored in that customer's Shopify metafield.
• Browser storage used to remember a guest's wishlist and a random visitor identifier. Wishlist Zero uses local storage for this purpose.
• Wishlist activity, such as adding or removing an item and moving an item to the cart. We use this to give merchants aggregated wishlist insights.

How we use information

We use this information to provide wishlist features, preserve a guest's wishlist between visits, sync a signed-in customer's wishlist, provide merchants with wishlist insights, and maintain the security and reliability of the app. We do not sell personal information or use it for interest-based advertising.

Where information is stored and shared

We use the following service providers to operate Wishlist Zero: Shopify (store, customer-metafield, and app-platform data), Netlify (application hosting and scheduled maintenance jobs), and Turso (application database hosting). Cloudflare Web Analytics may also process limited marketing-site usage information when it is enabled; it is not loaded in the embedded merchant app, App Proxy routes, or webhook routes. These providers process information only as needed to operate the app. We do not rent or sell personal information.

Retention and security

Guest wishlist storage remains in the shopper's browser until the shopper clears that browser's site data. Detailed wishlist activity is deleted after 30 days; delivery receipts and inactive wishlist presence records are deleted after 45 days. Customer-data exports are encrypted at rest, available to the relevant authenticated merchant for 30 days, then deleted. Expired Shopify sessions are removed daily; app data and sessions are deleted when the app is uninstalled or when Shopify sends a shop-redaction request.

We use signed Shopify requests, access controls, encryption for stored customer-data exports, scoped database records, and request rate limits to protect information. No method of transmission or storage is completely secure.

Your choices and privacy rights

Depending on where you live, you may have rights to access, correct, delete, or restrict the processing of your personal information. To remove a guest wishlist from a browser, clear that browser's site data. You can also contact us using the details below. Wishlist Zero processes Shopify's required data-request and redaction webhooks. We provide customer-data exports to the relevant merchant through the app's authenticated Privacy page, and process redaction requests within the applicable Shopify timeframe, subject to any lawful retention requirement.

Changes to this policy

We may update this policy as the app evolves. When we do, we will revise the “Last updated” date above. Material changes will be communicated where required by law.

Contact

For privacy questions or to exercise your rights, email us at support@mikewalker.io.