01 / Who we are
Store Watch is a Shopify app operated by Codefuente at Centro de Empresas La Curtidora, Calle Gutiérrez Herrero 52, 33402 Avilés, Asturias, Spain ("we", "us" or "our"). This policy covers the Store Watch app and the website at store-watch.com.
For privacy questions or requests, contact info@codefuente.com.
For store information processed to provide the app, the merchant determines the purposes of processing and we act on their instructions. We are responsible for the processing of our own business contact, support and service administration information.
02 / Information we collect
Information from Shopify
When you install Store Watch, Shopify grants the read-only permissions shown during installation. We receive:
- Store information: store ID, domain, name, merchant contact email, currency and time zone.
- Products and inventory: products, variants, SKUs, barcodes, prices, publication status, inventory quantities and inventory locations.
- Orders and operations: order IDs and references, dates, totals, line items, refunds and fulfilment status. These records support sales, returns and fulfilment analysis.
- Installation and billing: granted permissions, installation status, encrypted access and refresh tokens, subscription identifiers and plan status. Shopify handles payment; we do not collect payment card details.
Information you provide
We store your app settings, notification recipients, report preferences, quiet hours, detection thresholds and actions on findings. If you connect Slack, we store the workspace and channel identifiers and the credentials needed to send summaries. If you contact us, we receive the contact details and information you include in your request.
Customer information and webhook deliveries
Store Watch does not request customer names, email addresses, telephone numbers or postal addresses for its analytical order records, and does not build customer profiles. Routine order and refund webhook subscriptions are limited to resource identifiers.
Shopify's mandatory privacy-request webhooks can contain customer identifiers and contact details. We receive and store webhook deliveries and processing records to verify requests, prevent duplicate processing and operate the service. These records are separate from the store analytics described above.
Website and technical information
Requests to our website and app may generate hosting and application logs, including an IP address, requested URL, timestamp, browser information, errors and store identifiers. We use these for service operation, troubleshooting and security. The website does not include advertising trackers, and the app does not install tracking scripts on your storefront. Shopify manages authentication in the Shopify admin under its own privacy policy.
03 / How we use information
We use the information to synchronise your store, calculate metrics and baselines, detect changes across sales, inventory, returns, fulfilment and catalogue, estimate financial impact, generate health scores and prioritise findings.
We also use it to provide reports and requested alerts, manage your plan and integrations, respond to support and privacy requests, troubleshoot failures and protect the service. Store Watch's read-only Shopify permissions do not allow it to edit your products, prices, orders, inventory or theme.
For personal information we process as a controller, we rely on performance of our agreement with you, our legitimate interests in operating and securing the service and responding to enquiries, or compliance with legal obligations, as applicable. Where a feature requires consent, you can withdraw that consent.
Automated analysis and AI
Store Watch combines its own metrics with the Gemma AI model to provide analysis tailored to each store. Gemma runs on our Hetzner infrastructure in Finland. Only non-personal store information is supplied for this analysis; customer and merchant personal information is excluded. We do not retain the inputs submitted to Gemma or the analysis it generates. The store records and metrics used by the app have the separate retention periods described below.
Scores and findings help you review your store; you decide which actions to take. The app does not automatically change your Shopify store.
05 / Retention and deletion
- Analytics history: metrics, reports and resolved findings follow your plan's retention window: 60 days on Free, 90 days on Starter and 365 days on Growth. If Pro is available for your store, its window is 730 days. A downgrade has a 30-day grace period before the shorter window applies.
- Current store records: current catalogue, inventory, settings, credentials and active findings are kept while needed to provide the installed app. The plan's history window is not a deletion deadline for every current record.
- Webhook receipts: the current receipt retention setting is seven days, with automatic expiry. Separate asynchronous processing records may retain webhook content beyond that window; the receipt expiry is not a guarantee that every copy has been deleted.
When Shopify notifies us that you have uninstalled the app, we revoke operational access and remove the stored Shopify credentials. Store analytics and related app records are deleted through Shopify's shop/redact process. Uninstalling is not an immediate deletion of every record. Contact us if you need a deletion request reviewed or want to know which records remain.
Server and application logs are retained for 30 days. We make daily database backups in Hetzner, Finland, and retain each backup for seven days. After information is removed from the live database, an existing backup may contain it until that backup expires.
Support correspondence is retained as needed to deal with your enquiry and any related legal obligations. Contact us for information about a specific support or privacy request. Processing records that contain personal information are also subject to applicable access and erasure requests; automatic expiry of webhook receipts does not replace those rights.
06 / Security
Our public service uses HTTPS. Shopify access tokens and integration credentials are encrypted at rest using AES-256-GCM. We verify Shopify webhook signatures and check authenticated requests before returning store information. No internet service can guarantee absolute security.
07 / Your choices and rights
You can change report recipients and notification preferences in the app, disconnect Slack or uninstall Store Watch from Shopify to end its access.
Depending on applicable law, you may request access to, correction of, deletion of or a portable copy of your personal information; restriction of processing; or object to processing based on legitimate interests. You may withdraw consent where processing relies on consent and complain to your local data protection authority. We will verify requests where needed and respond within the time required by applicable law.
Merchants can contact us at info@codefuente.com with their store domain and the nature of their request. Please do not send passwords or access tokens. If you are a customer of a Shopify store, contact that merchant first; they control your store-related information and can request assistance through Shopify's privacy-request process.
Website analytics
When enabled, this website offers optional Google Analytics 4 to measure visits and page usage. Google Analytics only loads after you accept analytics. Rejecting leaves analytics disabled. You can change your choice or withdraw consent using “Analytics preferences” in the footer. Your choice is saved in this browser's local storage.
After acceptance, Google may process technical information about your browser, device and visits and store analytics cookies. We exclude page query strings and fragments from the page address sent to Analytics and disable Google signals and advertising personalization. We do not send contact form contents to Analytics. See Google's privacy policy for information about Google's processing.
08 / Changes and contact
We may update this policy to reflect changes to the service or data practices. The date at the top identifies the latest version. Where required, we will notify you of material changes or obtain consent before a new use of personal information.
Codefuente
Centro de Empresas La Curtidora, Calle Gutiérrez Herrero 52, 33402 Avilés, Asturias, Spain
Privacy contact: info@codefuente.com