Privacy Policy

This Privacy Policy describes how Lion Global LLC ("we", "us") collects, uses, and shares personal information when you install our Shopify app ("Rateify Review", the "App") on your Shopify store, and when shoppers interact with reviews collected through the App.

1. Information we collect

From the merchant

• Shop domain, shop name, plan, email, and OAuth access tokens necessary to operate the App.
• App configuration and preferences you set in our dashboard.

From shoppers (data subjects)

• Reviewer name, email address, review content (rating, title, body), optional photos or video, IP address (hashed for spam prevention), consent flag, and the related Shopify order and product identifiers.
• Email address and order metadata exposed to us by Shopify webhooks (e.g. orders/fulfilled) so we can send a review-request email.

2. How we use information

• To send transactional review-request emails on the merchant's behalf.
• To moderate, publish, and display reviews on the storefront.
• To prevent fraud, abuse, and spam (rate limiting, fingerprinting).
• To honour data subject requests (access, deletion).
• To improve the App's reliability and security.

3. Encryption and storage

Email addresses are encrypted at rest using AES-256-GCM. A keyed HMAC of the email is stored alongside the cipher text to allow deduplication and lookup without decryption. Media uploads are stored on Cloudflare R2 in a non-public namespace served via signed URLs.

4. Service providers (sub-processors)

• Shopify: host platform and OAuth provider.
• Render: application and worker hosting (EU/US).
• Cloudflare R2: media storage.
• Resend: transactional email delivery.

5. Data retention

• Reviews are retained while the App is installed on the merchant's store, or until the shopper or merchant requests deletion.
• On shop/redact (48 hours after app uninstall), all shop data and related reviews, review requests, media, and statistics are permanently deleted.
• On customers/redact, all reviews authored by that customer (including attached media), pending review requests, and related aggregates are permanently erased from our database and object storage.

6. Your rights (GDPR, CCPA)

You may request access, correction, or deletion of your personal data by emailing info@rateifyreview.it. We respond within 30 days. EU residents have the right to lodge a complaint with their supervisory authority.

7. International transfers

Data may be processed in the United States and the European Union by our service providers. Where required, we rely on Standard Contractual Clauses or equivalent safeguards.

8. Cookies and tracking

The App does not set first-party tracking cookies on the storefront. The admin dashboard relies on Shopify session tokens (App Bridge).

9. Changes to this policy

We will publish updates to this page and revise the effective date. Material changes will be communicated via the App admin.

10. Contact

Privacy enquiries: info@rateifyreview.it
General support: info@rateifyreview.it