Privacy Policy

1. Overview

Options Lab ("the App", "we", "us", "our") is a Shopify application developed by Storose that helps merchants add custom product options, personalization, and dynamic pricing to their Shopify stores. This Privacy Policy explains what information the App collects, how it's used, and the choices available to merchants who install the App and to their customers who interact with it on a merchant's storefront.

This policy applies to two groups of people: merchants who install the App into their Shopify admin, and customers who shop on a merchant's storefront and use the custom option fields the App renders.

2. Information we collect

2.1 Information from merchants

When a merchant installs the App via Shopify's OAuth flow, we receive and store:

• The store's myshopify.com domain and basic shop details Shopify provides at installation.
• An access token that authorizes the App to read and write the specific store data needed for the App's features (for example, products, orders, and cart pricing), scoped to the permissions the merchant approves during installation.
• Configuration data the merchant creates while using the App, such as option sets, custom fields, pricing rules, preview templates, and app settings.

2.2 Information from customers, via the storefront

When a customer selects custom options on a merchant's product page, we receive the values they enter or select, so the App can calculate pricing and pass the selections through to the order. Depending on which option fields a merchant has configured, this may include:

• Text the customer types (for example, a name, message, or engraving text).
• Selections made from dropdowns, swatches, checkboxes, or radio buttons.
• Files the customer uploads (for example, artwork, a logo, or a photo), stored securely so the merchant can retrieve them for order fulfillment.
• Numeric inputs used for measurement- or quantity-based pricing (for example, width or height).

We do not require customers to create an account with us, and the App does not itself collect customer payment details - payment is always processed by Shopify's checkout.

2.3 Order information

When an order containing customized options is placed, Shopify sends the App order-related webhooks. We store a record of the customer's selections and a price breakdown against that order so the merchant can see exactly what was ordered, along with order-level details Shopify provides (such as order name, financial and fulfillment status, total price, and the purchasing customer's name and email address) so the merchant's dashboard reflects accurate order status.

3. How we use information

We use the information described above to:

• Operate the App's core features: rendering custom option fields, calculating dynamic pricing, applying charges at checkout, and rendering live product previews.
• Let merchants view and manage the option sets, pricing rules, and orders associated with their store.
• Keep order status and analytics shown in the merchant's dashboard up to date.
• Maintain the security, integrity, and reliability of the App, including diagnosing technical issues.
• Communicate with merchants about their account, such as order notification emails they've opted into.
• Comply with Shopify's platform requirements and applicable law.

We do not sell personal information, and we do not use customer- or merchant-provided data for advertising or for purposes unrelated to operating the App.

4. Data storage and security

Data is stored on secured servers operated by us or our hosting infrastructure providers, with access restricted to what's necessary to operate the App. Access tokens and other sensitive configuration values are stored using industry-standard encryption practices. While no method of transmission or storage is 100% secure, we take reasonable technical and organizational measures designed to protect the information we handle.

5. Sharing your information

We share information only in the following circumstances:

• With Shopify, as required for the App to function as a Shopify application (for example, applying option pricing at checkout through Shopify's Cart Transform functionality).
• With service providers who host our infrastructure or provide services on our behalf, under obligations to protect the data and use it only to provide those services.
• When required by law, such as in response to a valid legal request from a regulator or law enforcement authority.
• With the merchant's consent or instruction, for example if a merchant enables an optional integration with another platform.

We do not sell or rent personal information to third parties.

6. Data retention

We retain merchant configuration data and order records for as long as the App remains installed on a store, so the merchant can continue to use its features and access their order history. If a merchant uninstalls the App, Shopify notifies us via a shop redaction webhook, and we delete or anonymize the corresponding store data in accordance with Shopify's data protection requirements, except where we're required to retain certain records for legal or accounting purposes.

7. Your rights and choices

The App implements Shopify's mandatory GDPR compliance webhooks, which means:

• A customer can request a copy of the personal data we hold about them related to a store's orders (via the store's data request webhook).
• A customer can request deletion of their personal data (via the customer redaction webhook).
• When a merchant uninstalls the App, their store's data is deleted in accordance with the shop redaction webhook.

Customers should direct privacy requests to the merchant whose store they purchased from, since the merchant is the data controller for their own customers' order information. Merchants can contact us directly using the details below for requests related to their own account and configuration data.

Depending on where you live, you may have additional rights under laws such as the EU/UK General Data Protection Regulation (GDPR) or the California Consumer Privacy Act (CCPA), including the right to access, correct, or delete your personal information, and the right to object to or restrict certain processing. Contact us using the details below to exercise these rights.

8. Cookies

Within the Shopify admin, the App uses session-based cookies and browser storage required for authentication and normal operation of an embedded Shopify app. On the storefront, the App's product option widget does not set advertising or cross-site tracking cookies; it uses standard browser requests to load option data and calculate pricing.

9. Children's privacy

The App is intended for use by Shopify merchants and their customers in the context of e-commerce transactions, and is not directed at children. We do not knowingly collect personal information from children under the age of 16. If you believe a child has provided us with personal information, please contact us so we can take appropriate action.

10. International data transfers

Because Shopify and our hosting infrastructure operate globally, information we process may be transferred to, stored, and processed in countries other than your own. Where required, we rely on appropriate safeguards for such transfers in accordance with applicable data protection law.

11. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, operational, or regulatory reasons. We'll update the "Last updated" date at the top of this page when we do. Continued use of the App after a change becomes effective constitutes acceptance of the revised policy.

12. Contact us

If you have questions about this Privacy Policy or how your information is handled, contact us at:

Storose
Email: storose.com@gmail.com