1. INTRODUCTION

Review Box (“we,” “us,” “our,” or “the App”) is a Shopify application that helps store owners collect, moderate, and display customer product reviews. This Privacy Policy explains how we collect, use, and share personal information when you use our app.

Important: Review Box operates as a data processor on behalf of Shopify merchants. Shopify is the data controller for most merchant and customer data. We only process data as instructed by merchants and in accordance with Shopify’s platform requirements.​

Developer Information:

• Company Name: Techies Inc.
• Contact Email: connect@techies.it
• Business Address:https://techiesindiainc.com 
• Support: connect@techies.it

2. WHO CONTROLS YOUR DATA?

2.1 Data We Control (Data Controller)

We are a data controller for:

• Information you provide when creating a Review Box account directly on our website
• Communication preferences and support interactions with us
• Analytics on how you use the Review Box admin interface

2.2 Data We Process (Data Processor)

We are a data processor for:

• Merchant information received from Shopify (store name, email, store URL)
• Customer review submissions (name, email, ratings, review text, photos)
• Order information used to facilitate review requests 

For this data, the merchant (store owner) is the data controller, and Shopify provides the underlying data infrastructure.​

3. INFORMATION WE COLLECT

3.1 From Merchants (Store Owners)

When you install Review Box via Shopify, we receive:

Identity Data:

• Shopify store name and URL
• Store owner email address
• Shopify merchant ID

Store Data:

• Product information (titles, IDs, descriptions)
• Store settings (currency, timezone, language)

Configuration Data:

• Your Review Box app settings and customization preferences
• Design choices (colors, layouts, fonts)
• Feature configurations

Usage Data:

• How you interact with the Review Box dashboard
• Features you enable or disable
• App performance metrics

3.2 From Your Customers (Review Submitters)

When customers submit reviews through your store:

Review Content:

• Customer name (required)
• Email address (required)
• Star rating (1-5)
• Written review text
• Photos (optional)

Metadata:

• Submission timestamp
• IP address (for spam prevention only)
• Browser and device information
• Product being reviewed

Important: This data is collected on behalf of the merchant. The merchant owns this data and controls how it’s used.​

3.3 Automatically Collected Information

Technical Data:

• Cookies for session management
• Server logs (IP address, browser type, timestamps)
• Error reports and debugging data

Analytics Data:

• Anonymous usage statistics
• Feature adoption metrics
• Performance monitoring data

4. HOW WE USE YOUR INFORMATION

4.1 To Provide Core Review Functionality

• Display reviews on product pages, homepage, and reviews page
• Enable review moderation (approve/reject reviews)
• Generate review carousels and widgets
• Provide filtering and search functionality
• Export review data to CSV
• Show review statistics and analytics

Legal Basis: Performance of contract; Legitimate interests (provide service)​

4.2 To Improve Our Service

• Analyze usage patterns to enhance features
• Debug technical issues and improve performance
• Conduct research and development
• Test new features

Legal Basis: Legitimate interests (improve service quality)​

4.3 To Communicate With You

• Send account-related notifications
• Provide customer support
• Send service updates and feature announcements
• Request feedback about the app
• Send billing and subscription notifications

Legal Basis: Performance of contract; Legitimate interests (maintain customer relationship)​

4.4 For Security and Legal Compliance

• Prevent fraud, spam, and abuse
• Enforce our Terms of Service
• Comply with legal obligations
• Respond to law enforcement requests
• Protect our rights and property

Legal Basis: Legal obligation; Legitimate interests (security and fraud prevention)​

5. DATA SHARING AND DISCLOSURE

We do NOT sell your personal information to third parties.​

5.1 Sharing with Shopify

Review Box shares data with Shopify and Shopify’s Shop app, including:

• Review content (name, email, ratings, text, photos)
• Product association data
• Merchant store information

Why: Shopify provides the infrastructure for our app and may display reviews in the Shop app and other Shopify services. Shopify’s Privacy Policy governs their use of this data: 

https://www.shopify.com/legal/privacy.

5.2 Service Providers

We share data with trusted third-party service providers who help us operate the app:

• Cloud Hosting Providers: Secure data storage and app infrastructure
• Email Service Providers: Transactional emails and review request notifications (if enabled)
• Analytics Services: Anonymous usage analytics (Google Analytics)
• Payment Processors: Subscription billing (Shopify Billing system)

All service providers are contractually obligated to protect your data and use it only for specified purposes.​

5.3 Legal Requirements

We may disclose information when required by law:

• Compliance with subpoenas, court orders, or legal processes
• Enforcement of our Terms of Service
• Protection against fraud or security threats
• Investigation of violations
• Protection of rights, property, or safety

We may disclose data to regulators, law enforcement, professional advisors (lawyers, auditors, accountants), and government agencies as legally required.​

5.4 Business Transfers

If Review Box is involved in a merger, acquisition, or sale of assets, your information may be transferred. You will be notified via email and/or app notification before any transfer occurs.​

5.5 With Your Consent

We may share data with third parties when you explicitly provide consent.

6. DATA RETENTION

6.1 Active Accounts

We retain merchant and customer review data as long as your Review Box account is active and the app is installed on your Shopify store.​

6.2 After App Uninstallation

Important Limitation: When you uninstall Review Box, we do not have the ability to automatically delete all data immediately because:

1. Shopify controls the underlying data infrastructure
2. Data may be cached or stored in Shopify’s systems
3. Review may have been shared with Shopify’s Shop app

What happens when you uninstall:

• Your Review Box account is marked as inactive
• We stop processing new reviews immediately
• Existing review data is retained for 30 days to allow for reinstallation
• After 30 days, we delete data from our systems that we directly control
• However, we cannot unilaterally delete data from Shopify or the Shop app​

6.3 Data Deletion Requests

If you request deletion of specific customer data:

• We will delete data from our direct database systems
• We will forward deletion requests to Shopify as we cannot directly delete data from Shopify’s infrastructure
• Merchants are responsible for ensuring Shopify complies with the deletion request
• Full deletion may take up to 45 days to process across all systems​

6.4 Backup Retention

Backup copies are retained for up to 30 days for disaster recovery, then automatically purged.​

6.5 Legal Retention

We may retain basic information for up to 6 years when required by tax, accounting, or legal regulations.​

7. DATA SECURITY

We implement industry-standard security measures:

• Encryption: TLS/SSL for data in transit; AES-256 for data at rest
• Authentication: Secure OAuth authentication via Shopify
• Access Controls: Role-based access limitations for employees
• Monitoring: 24/7 security monitoring for suspicious activity
• Regular Audits: Periodic security assessments
• Secure Infrastructure: SOC 2 compliant cloud hosting

However, no internet transmission is 100% secure. While we use commercially reasonable security measures, we cannot guarantee absolute security.​

For more security details, visit: [your-security-page-url]

8. YOUR RIGHTS

8.1 General Rights

You have the right to:

• Access: Request a copy of personal information we hold about you
• Rectification: Request correction of inaccurate or incomplete data
• Deletion: Request deletion of your personal information*
• Data Portability: Export your review data in CSV format anytime
• Restrict Processing: Request we limit how we process your data
• Object: Object to processing for certain purposes
• Withdraw Consent: Withdraw consent for marketing communications

*See Section 6.3 regarding deletion limitations due to Shopify’s data infrastructure.​

To exercise these rights, email: [your-email@domain.com]

We will respond within 30 days (or 45 days for complex requests).​

8.2 GDPR Rights (European Users)

If you are in the European Economic Area (EEA) or UK:

Legal Basis for Processing:

• Contract Performance: To provide Review Box services
• Legitimate Interests: To improve our service and prevent fraud
• Consent: Where you’ve explicitly opted in (e.g., marketing)
• Legal Obligations: To comply with applicable laws​

Data Transfers: Your data may be transferred outside the EEA/UK. We ensure appropriate safeguards through Standard Contractual Clauses (SCCs) and adequacy decisions.​

Supervisory Authority: You have the right to lodge a complaint with your local data protection authority ( UK: ICO at  www.ico.org.uk ).

EU Representative (if applicable): [Representative contact information]

8.3 CCPA Rights (California Users)

If you are a California resident, you have additional rights:

Categories of Personal Information We Collect:

• Identifiers (name, email, IP address)
• Commercial information (review submissions, purchase associations)
• Internet activity (usage data, analytics)

Your CCPA Rights:

• Right to Know: Request details about data collected in the past 12 months
• Right to Delete: Request deletion of personal information (subject to exceptions)
• Right to Opt-Out of Sale: We do NOT sell personal information
• Right to Non-Discrimination: We won’t discriminate for exercising your rights​

To exercise CCPA rights, email: [your-email@domain.com]

We will respond within 45 days (extendable by another 45 days if necessary).​

California “Shine the Light” Law: California residents can request information about data shared with third parties for direct marketing (we don’t share for this purpose).

9. COOKIES AND TRACKING

Review Box uses cookies for:

Essential Cookies:

• Session management and authentication
• App functionality and user preferences

Analytics Cookies:

• Google Analytics (anonymous usage statistics)
• Performance monitoring

Managing Cookies: You can control cookies through your browser settings. Disabling cookies may limit app functionality.​

Do Not Track: Our service does not respond to Do Not Track (DNT) signals.​

10. CHILDREN’S PRIVACY

Review Box is not intended for individuals under 13 years old (or 16 in the EEA). We do not knowingly collect data from children. If you believe we have collected data from a child, contact us immediately at [your-email@domain.com]

for prompt deletion.​

11. INTERNATIONAL DATA TRANSFERS

Your information may be transferred to and processed in countries outside your residence, including the United States, where data protection laws may differ.

Safeguards: We ensure appropriate protections through:

• Standard Contractual Clauses (SCCs) approved by EU authorities
• Adequacy decisions for specific countries
• Contractual commitments with service providers

By using Review Box, you consent to these transfers.​

12. THIRD-PARTY LINKS

The app may contain links to third-party websites or services. We are not responsible for their privacy practices. Please review their privacy policies.​

13. DATA BREACH NOTIFICATION

In the event of a data breach affecting personal information:

• We will notify affected users within 72 hours of discovery
• We will describe the nature and scope of the breach
• We will outline steps being taken to address it
• We will notify relevant supervisory authorities as required by law​

14. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy periodically. Changes will be communicated via:

• Updated “Last Updated” date at the top
• Email notification for material changes
• In-app notification banner

Your continued use after changes constitutes acceptance of the updated policy.​

15. CONTACT US

For questions, concerns, or data rights requests:

Review Box Support

• Email: [your-email@domain.com]
• Support Portal: [your-support-url]
• Address: [Your Business Address]

Response Time: We aim to respond within 2 business days for general inquiries and 30 days for data rights requests.​

For GDPR-related inquiries (EU users):

• EU Representative: [If applicable]
• Email: [eu-representative@domain.com

16. CONSENT

By installing and using Review Box, you acknowledge that you have read, understood, and agree to this Privacy Policy.