pollux|dev
Book a call

ThermoGuard Privacy Policy

Last updated

Who we are

ThermoGuard is a Shopify app made by Schmezko & Gottselich GbR, trading as pollux|dev, Im Gesenk 22, 31275 Lehrte, Germany ("we", "us"). This policy explains what the app processes about a store that installs it, about that store's orders and about its shoppers, and what happens to it. It covers the app only. Our website has its own privacy policy.

Questions and requests about your data go tosupport@polluxdev.com.

Our two roles

For the data about your store and your use of the app, we are the controller. For the data about your shoppers and their orders, you, the merchant, are the controller, and we process it on your behalf and on your instructions, which you give by how you set the app up. That processing follows the terms Shopify sets for every app on its platform: the Shopify API License and Terms of Use and the Shopify Partner Program Agreement.

What ThermoGuard processes

About your store

  • Your store's myshopify.com address and the access token Shopify issues when you install the app. We do not receive or store your staff's names or email addresses.
  • Your plan and subscription status, as Shopify reports them. Shopify handles billing; we never see payment details.
  • Everything you set up in the app: your rules and their temperature limits, the products, collections, tags and countries they cover, transit times per shipping method, your dispatch days, °F or °C, the texts shoppers see, your spoilage-rate estimate, and your store's time zone and main language.

About your orders

When an order is placed, Shopify sends it to the app. ThermoGuard reads the products, the shipping method, the order value and the delivery address's country, postcode or city, and coordinates, works out the forecast for the days the parcel is in transit, and applies your rules. Of that, it keeps:

  • the order's ID and number, its value and currency, and the amount refunded on it;
  • which rule applied, the forecast temperatures that triggered it and your limit;
  • the forecast for the order's transit days, and, once it ships, for the shipment's transit days;
  • whether the order was held and released, and the fulfillment it was held on.

It does not keep the shopper's name, email address, phone number or delivery address with any of this.

About your shoppers

The destination they enter. The weather notice in your cart can ask a shopper for their postcode (or their city, in a country without postcodes) and country, so it can look up the forecast. That request goes to our server through Shopify. We keep a table of postcodes, each with one reference point no more precise than about a kilometre, so the same postcode does not have to be looked up again; it holds no order, no name and no link to any shopper.

When a shopper accepts the weather risk. If one of your rules asks shoppers to accept the risk before they buy, and they do, ThermoGuard records the order, the time they accepted, their IP address, the exact wording they accepted with its version and language, the forecast they were shown, and where they accepted it (cart, checkout or order status page). This record exists so you can show what a shopper agreed to if they later dispute the charge, and the app deletes it automatically 540 days after the shopper accepted. When the shopper accepts in the cart, the same details, IP address included, are also saved as hidden attributes on the order in your store, where they stay with the order under your and Shopify's control.

In the shopper's browser. If the shopper has allowed preference storage under your store's cookie settings (Shopify's customer privacy setting), the app remembers the postcode and country they entered in their browser's local storage, so they are not asked again. Without that permission it remembers it only until they leave the page. Whether they closed the weather notice is kept in session storage, which the browser clears at the end of the visit. ThermoGuard sets no tracking or advertising cookies.

ThermoGuard never emails your shoppers and never contacts them in any other way. What they see comes from your store: the notices in the cart, checkout and order status page, and any message you send through your own tools.

Server logs

Like any web service, our server records requests in logs, which can include IP addresses. Our hosting provider keeps them for a short time; we use them only to run the app and keep it secure. The app writes no risk-acceptance records, coordinates or shopper data to its logs.

What ThermoGuard writes to your store

Depending on your rules, the app puts a fulfillment hold on an order, adds a tag such as "HELD FOR MONDAY SHIPMENT", writes the forecast high, low and transit window to the order as metafields, hides slow shipping methods at checkout, and triggers Shopify Flow when an order is held or at risk. All of this stays in your Shopify store, under your control.

Who receives data

We do not sell, rent or trade data, and we do not use it for advertising or profiling. We use these services to run the app:

  • Fly.io, Inc. (United States) hosts the app's server in its US East region (Virginia). Everything described above passes through it.
  • Neon, Inc. (United States) runs the app's database on Amazon Web Services in the US East region. Everything ThermoGuard keeps is stored there.
  • The US National Weather Service (part of NOAA) receives the coordinates of a US destination to return its forecast, andthe Norwegian Meteorological Institute (MET Norway) receives the coordinates of any other destination. For a placed order these are the coordinates Shopify supplies for the delivery address, rounded to about a kilometre, so they describe the neighbourhood rather than the house; for a postcode a shopper entered, they are the postcode's. They receive coordinates only — no name, no address, no order.
  • Zippopotam.us and OpenStreetMap's Nominatim service receive a postcode and country, or a city and country, when our own postcode table does not know them yet, and return coordinates.

The weather and postcode services are called from our server, so they never see a shopper's IP address or browser. Shopify itself, of course, receives and holds the data in your store under its own privacy policy.

Transfers outside the EU

The app's server and database are in the United States. Where data about people in the EU or the UK is transferred there, the transfer is covered by the data processing terms of Fly.io and Neon, which include the European Commission's Standard Contractual Clauses.

How long we keep it

  • While the app is installed, your settings, rules and order records are kept, so the app can work.
  • Risk acceptances are deleted automatically 540 days after the shopper accepted. That outlasts the longest window in which a card payment can be disputed, so the record is there for any dispute that can still arrive, and no longer.
  • Forecast records for individual orders are deleted after 365 days.
  • Cached forecasts expire after three hours.
  • When a shopper asks to be erased, Shopify tells us which of their orders that covers, and we delete the risk acceptances for those orders. Order records with no personal details in them (an order number, a value and temperatures) stay, as your own order history in Shopify does.
  • When a shopper asks for their data, Shopify passes the request on to us. It appears in the app with the records we hold for those orders, ready for you to download and send to the shopper. We keep the request itself, never a copy of the records, until 90 days after you mark it answered, or 180 days after it arrived if you do not.
  • When you uninstall, your access token is deleted at once. Shopify then sends us an erasure request for your store 48 hours later, and we delete everything we hold about it, risk acceptances included.
  • The postcode table is kept, because it describes places rather than people: one reference point per postcode, never a delivery address.

If you have exported records out of the app, such as a CSV of at-risk orders, those copies are yours to keep or delete.

We process your store's data to provide the app you installed (Art. 6(1)(b) GDPR) and, for logs and security, on the basis of our legitimate interest in running a reliable and secure service (Art. 6(1)(f) GDPR). For your shoppers' data, you as the controller decide the legal basis; for a risk acceptance, that is typically your legitimate interest in being able to show what a shopper agreed to (Art. 6(1)(f) GDPR). Storing a shopper's postcode in their browser depends on the permission they gave in your store's cookie settings.

Security

All traffic to and from the app is encrypted, and the database is encrypted at rest. Every request from Shopify is verified as coming from Shopify before the app acts on it. Access to the app's systems is limited to the two of us who build it.

Your rights

Under the GDPR you have the right to access your data, to have it corrected or deleted, to restrict or object to its processing, and to receive it in a portable format. Write tosupport@polluxdev.com.

If you are a shopper, the store you bought from is responsible for your data. Ask the store first: Shopify passes data and erasure requests on to us, and the app handles them as described above. You can also write to us directly, and we will help.

You can complain to a data protection authority. Ours is the Landesbeauftragte für den Datenschutz Niedersachsen, Prinzenstraße 5, 30159 Hannover, Germany.

Data sources

Postal-code locations © GeoNames, used underCC BY 4.0. Geocoding data ©OpenStreetMap contributors, available under the Open Database License. Forecasts from the US National Weather Service and MET Norway.

Changes to this policy

When the app starts processing something new, or stops, this policy changes with it, and the date at the top changes too. If a change affects how data you have already given us is used, we tell you before it takes effect.