Legal

Privacy Policy

How Nayvo collects, uses, and protects information when merchants install and use our Shopify apps. Last updated: 11 October 2026.

1. Who we are

Nayvo (“Nayvo”, “we”, “us”) builds and publishes apps for the Shopify App Store, including EU Withdrawal Button & Form, SEO AI Blog, Europe All-in-One, and Australia Post All-in-One (together, the “Apps”). This Privacy Policy explains how we handle personal information when a merchant (“Merchant”) installs one of our Apps on their Shopify store, and how we handle information about the Merchant’s customers (“Customers”) that we process on the Merchant’s behalf. Unless an App’s listing says otherwise, this policy applies to every Nayvo App.

2. Information we collect

When you install an App, we are automatically able to access certain information from your Shopify account through the Shopify API, limited to the permissions (scopes) you approve during installation:

  • Store and account information — shop domain, store name, store owner name and email, contact phone, store address, currency, locale, time zone and Shopify plan.
  • Store content — products, collections, themes, pages, blog posts and metafields, where the App needs them (for example, to publish SEO blog posts or render a storefront button).
  • Order and fulfillment data — order numbers, line items, totals, and shipping details, only for Apps that require it (for example, withdrawal requests or shipping labels).
  • Customer personal information — such as a Customer’s name, email, phone, shipping/billing address, and the content of forms they submit (for example, an EU withdrawal request), only where an App’s function requires it.
  • Support and communications — information you send us by email or support chat.
  • Technical and usage data — IP address, browser type, device information, and App usage logs, used for security, debugging and improvement.

We do not collect payment card details. Billing for paid plans is handled entirely by Shopify.

3. How we use information

  • To provide, operate and maintain the App and its features for your store.
  • To process requests your Customers submit through the App (for example, sending withdrawal confirmations or generating shipping labels).
  • To provide customer support and respond to inquiries.
  • To send service-related notices, such as updates, security alerts and billing information.
  • To monitor performance, prevent fraud and abuse, and keep the App secure.
  • To improve and develop our Apps using aggregated or de-identified data.
  • To comply with legal obligations and enforce our terms.

4. Legal bases (GDPR / UK GDPR)

For Merchants in the EEA or UK, we process personal information to perform our contract with you, for our legitimate interests (such as securing and improving the Apps), to comply with legal obligations, and, where required, with your consent. For Customer data, the Merchant is the data controller and Nayvo acts as a data processor, processing data only on the Merchant’s documented instructions.

5. Sharing your information

We do not sell or rent personal information. We share it only as follows:

  • Shopify — to operate the App within the Shopify platform.
  • Service providers — trusted sub-processors such as cloud hosting, database, email delivery, AI content generation (for AI features) and carrier APIs (for example, Australia Post), bound by confidentiality and data protection obligations.
  • Legal requirements — when required by law, court order, or to protect our rights, users or the public.
  • Business transfers — in connection with a merger, acquisition or sale of assets, subject to this policy.

6. Shopify mandatory privacy webhooks

All Nayvo Apps implement Shopify’s mandatory compliance webhooks:

  • customers/data_request — when a Customer requests their data from a Merchant, we provide the data we hold about that Customer to the Merchant.
  • customers/redact — we delete or anonymise the Customer’s personal information we store, unless we are legally required to keep it.
  • shop/redact — 48 hours after a Merchant uninstalls an App, Shopify notifies us and we permanently delete that store’s data.

7. Data retention

We keep personal information only for as long as the App is installed and as needed to provide the service. When you uninstall an App, we delete your store’s data after receiving Shopify’s shop/redact request (typically within 48 hours of uninstall), except where we must retain specific records to meet legal, tax or accounting obligations.

8. International transfers

Our team and service providers may process information outside your country, including in India, the European Union and the United States. Where personal data is transferred out of the EEA or UK, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses.

9. Security

We use industry-standard measures to protect information, including encryption in transit (HTTPS/TLS), access controls, least-privilege API scopes, and secure hosting. No method of transmission or storage is 100% secure, but we work continuously to protect your data and will notify affected Merchants of any breach as required by law.

10. Your rights

Depending on where you live (including under the GDPR, UK GDPR, CCPA/CPRA, Australia’s Privacy Act and India’s DPDP Act), you may have the right to:

  • Access the personal information we hold about you.
  • Correct inaccurate or incomplete information.
  • Request deletion of your information.
  • Restrict or object to certain processing, and request data portability.
  • Withdraw consent at any time where processing is based on consent.
  • Lodge a complaint with your local data protection authority.

Customers of a Shopify store should first contact the store owner, as the Merchant controls their data. We will assist Merchants in responding to such requests. California residents: we do not sell or share personal information for cross-context behavioural advertising.

11. Cookies

Our Apps may use essential cookies or session tokens required for authentication inside the Shopify admin. Storefront features (such as the withdrawal button) do not use tracking or advertising cookies.

12. Children's privacy

Our Apps are intended for businesses and are not directed at children under 16. We do not knowingly collect personal information from children.

13. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal reasons. We will post the updated version on this page with a new “Last updated” date and, for material changes, notify Merchants by email or in the App.