Privacy Policy

1.Who we are

Vizua s. r. o., Lazovná 38, Banská Bystrica, Slovakia. For any privacy question, contact us at support@vizua.sk.

2.Information we process

Store and account data. When you install the App, Shopify provides, and we store: your store’s myshopify.com domain, store ID, timezone, install and uninstall timestamps, and an access token used to call Shopify APIs on your behalf. We also store your App settings (such as the withdrawal button label, order-identifier preference, sending domain, custom form templates, translation overrides, and webhook subscriptions) and your subscription status (plan, trial and renewal dates, and a Shopify charge identifier). We do not receive or store payment card details — billing is handled entirely by Shopify.

Customer withdrawal data (processed on your behalf). When one of your customers submits a withdrawal, we store the name and email address they enter, the order reference they provide and its match status, the items withdrawn, the statutory declaration, and timestamps. This data appears in your admin dashboard and in the PDF audit record that documents the request.

Email delivery data. To send the customer’s confirmation email (on a durable medium, as EU law requires) and your merchant notification, the recipient’s email address and the message content are passed to our email provider. To protect deliverability we store bounced or unsubscribed addresses only in a hashed form so we do not email them again.

Technical and diagnostic data. Our servers generate standard logs and error information (such as timestamps, error messages, and your store domain) to operate, secure, and debug the App.

This website. This marketing site sets no cookies and runs no analytics or visitor tracking.

3.How we use information

• To operate the App — showing the storefront button, running the withdrawal form, generating the statutory declaration and PDF, and sending the confirmation email.
• To notify you of new withdrawal requests and let you review and manage them in the admin dashboard.
• To handle data-subject and compliance requests (access, export, and deletion).
• To process your subscription and apply plan features.
• To maintain security, prevent abuse, debug, and improve reliability.

We do not sell your data, and we do not use it for advertising or profiling.

4.Legal bases (GDPR)

Where the EU or UK GDPR applies, we process store and account data to perform our contract with you (providing the App), and we process technical data on the basis of our legitimate interest in operating and securing the service. For your customers’ withdrawal data, you determine the purposes and legal basis as the controller, and we process it only on your documented instructions as your processor. Providing a working right of withdrawal and a durable-medium confirmation also supports your own compliance with EU consumer law (Directive 2023/2673).

5.Sharing and sub-processors

We do not sell personal information. We share data only with the sub-processors that help us run the App:

• Shopify — app platform, authentication, and billing.
• Resend — delivery of transactional emails (the customer confirmation and your merchant notification).
• DigitalOcean (via Laravel Forge) — server and database hosting in the European Union.

We may also disclose information where required by law.

6.Data location and transfers

Our servers and database are hosted in the European Union (Frankfurt). Email sending is routed within the EU, but some email delivery metadata (such as logs and event data) is processed by our email provider in the United States under the EU–US Data Privacy Framework and the EU Standard Contractual Clauses. Where data is otherwise processed outside your region, we rely on appropriate safeguards such as the Standard Contractual Clauses.

7.Data retention

• Withdrawal records and their PDF audit documents are retained while the App is installed, so you can evidence compliance. You can delete individual records or export them at any time from your admin.
• Store, settings, and subscription data are retained while the App is installed.
• We honor Shopify’s customers/data_request, customers/redact, and shop/redact requests: on a redaction request — including after you uninstall (approximately 48 hours later) — we redact or delete the associated personal data. Hashed suppressed-email entries are kept to protect deliverability.

8.Security

We use industry-standard measures, including encrypted connections (HTTPS), access controls, and scoped Shopify access tokens, and we store suppressed email addresses only as hashes. No method of transmission or storage is completely secure, but we work to protect your information.

9.Your rights

Depending on your location, you may have rights to access, correct, delete, or export personal data, or to object to or restrict its processing. For your own (merchant) data, contact us at support@vizua.sk. A customer’s request is usually made to you as the controller — the App gives you tools to look up, export, and delete a customer’s withdrawal data, and it processes Shopify’s data-request and redaction webhooks automatically. Uninstalling the App triggers deletion of your store’s data. If you are in the EEA or UK, you may lodge a complaint with your local data protection authority.

10.Children

The App is a business tool. It is not directed to children and is not intended for use by anyone under 16.

11.Changes to this policy

We may update this policy from time to time. We will revise the “Last updated” date above and, for material changes, provide notice within the App.

12.Contact