This policy explains how InterLinks Development(“we”, “us”) handles information through Zoned, a Shopify app that restricts products by location (“the app”), and through this website, zoned-app.com. It covers merchants who install the app, their staff, and the shoppers who visit a store that uses it. Questions: hello@zoned-app.com.
In short
- We hold the information we need to run your rules: your store’s settings, rules and zones, and a log of changes.
- We don’t store shoppers’ or customers’ personal information.
- A shopper’s IP address is used for a moment to estimate their location, and isn’t stored.
- We don’t sell information, and we don’t use it for advertising.
- When a store uninstalls the app, we delete everything we hold about it 48 hours later.
Information about merchants and their staff
When you install the app, Shopify gives it access to your store, and we keep:
- Store details:your store’s myshopify domain, Shopify plan, install and uninstall dates, and the app’s settings.
- Access credentials: the access token Shopify issues so the app can work with your store, and the Shopify staff ID, name, email address and language of the staff member it was issued for.
- Staff who use the app: the Shopify staff ID, name, email address and account-owner status of staff members who open it, so the activity log can say who changed what.
- Your rules and zones: the places, products, collections and tags you choose, your shopper messages, and the restrictions worked out from them.
- The activity log:a sealed record of each change: who made it, when, and what changed. It’s chained so entries can’t be altered after the fact.
- Compliance reports you generate.
- Support emails you send us.
Billing goes through Shopify. We see your plan and its status, never your payment details.
Information about shoppers
To decide whether a product is restricted for a shopper, the app needs to know roughly where they are. On the storefront it uses, in this order:
- The shopper’s own choiceof where they’re shipping to, if they make one. It’s kept in a cookie named
zoned_locin their browser for up to 30 days (country, state or province, and ZIP code), and on their cart so checkout can use it. - A logged-in customer’s default address, read from the store page when it loads. The app doesn’t store it.
- An approximate location from the IP address.The request goes through Shopify to our server, which looks up the country, state and ZIP code in a database stored on that server (MaxMind GeoLite2). The IP address isn’t sent to anyone else, isn’t stored and isn’t logged. The result is kept only in the shopper’s browser for the session.
At checkout, Shopify checks the order’s shipping address against the store’s rules inside Shopify’s own systems. The app doesn’t receive or store order or customer details.
Our server keeps technical request logs for security and troubleshooting. For storefront requests these can include the store, the approximate location being checked (country, state or province, ZIP code) and, when a shopper is logged in, the numeric customer ID Shopify adds to the request. They don’t include IP addresses, names or contact details, and they’re kept only for as long as we need them for those purposes.
Merchants are responsible for telling their shoppers about the apps their store uses, in their own privacy policy.
This website
zoned-app.com doesn’t use analytics, advertising or tracking cookies. Our web server records standard request logs (such as IP address, page and browser type) for security. The private admin area at /hq uses a sign-in cookie for our own staff only.
Why we use it
We use this information only to provide and support the app: to apply your rules, keep the activity log, bill through Shopify, answer your questions and keep the service secure. Our legal basis, where one is required, is performing our agreement with you and our legitimate interest in running a secure service.
Who processes it
- Shopify, which hosts your store and checkout, runs the app’s checkout rule and handles billing.
- Supabase, which hosts our database (in the United States).
- DigitalOcean, which hosts our servers (in the United States), managed through Laravel Forge.
- Our email provider, for messages you send to hello@zoned-app.com.
MaxMind provides the location database, which runs on our server; we don’t send it any information. We don’t sell or share information with anyone else, except where the law requires it.
How long we keep it, and deletion
- On uninstall, the app’s access to your store is removed straight away.
- 48 hours later, Shopify asks us to erase your store’s data, and we delete everything we hold about it: settings, rules, zones, the activity log, staff records and reports.
- Shopper and customer requests:Shopify forwards customers’ data and deletion requests to the app. Because the app doesn’t store customer data, there’s nothing to return or delete.
- Database backupsroll over and are gone within the provider’s backup window.
Your rights
Depending on where you live, you may have the right to access, correct, delete or export your information, or to object to how we use it. Email hello@zoned-app.comand we’ll respond within 30 days. Shoppers should contact the store they bought from first, since the store controls its own customer data. You can also complain to your local data protection authority.
Security
Data travels over encrypted connections, access to our systems is limited to the people who run Zoned, and the activity log is sealed so changes can’t be hidden. No system is perfectly secure; if a breach affects your information, we’ll tell you as the law requires.
Children
The app and this website are for businesses and aren’t directed at children.
Changes
If we change this policy, we’ll update the date at the top. For significant changes we’ll let merchants know by email or in the app.
Contact
InterLinks Development · hello@zoned-app.com
This product includes GeoLite2 Data created by MaxMind, available from https://www.maxmind.com.