Legal

Privacy policy

Last updated October 2, 2026

Who this covers

“We” means the developer of Appnux Store Locator (the “app”). “You” means the Shopify merchant who installs it. “Shoppers” means visitors to your storefront who use the store locator widget.

What the app accesses from Shopify

The required access-scope list is empty, so installation grants no access to Shopify resources. The app asks for an optional scope only when you choose the feature that needs it. You can decline or revoke that access without breaking the rest of the locator.

• Your shop domain and access token — required to keep you signed in to the embedded admin and to receive webhooks.
• Shopify Locations. If you enable Sync from Shopify, the app requests read_locations and copies the location names, addresses, phone numbers, and coordinates that the sync imports.
• Product data. If you enable Carried lines or Find in store, the app requests read_products to retrieve collection names or the product catalog data that feature needs.
• Inventory data. If you enable Find in store, the app requests read_inventory to show availability at your Shopify locations.
• Customer privacy webhooks. Shopify requires every App Store app to subscribe, but documents customer data-request and erasure delivery as conditional on customer or order data access. Our current features do not request that access. If we receive a valid request containing an email, we use it only to prepare the requested shopper-message and stockist-application snapshot or erase matching submissions and request-ticket data. You can also contact us directly using the address below.

What you give the app

• Store locations. The business records you import by CSV or enter by hand: name, address, coordinates, phone, email, website, images, social links, opening hours, and tags. These describe your retail locations, not individual people.
• Widget settings. Colors, labels, custom CSS, map provider choice, and any map API key you choose to supply.
• Carried lines. For each location, the app stores the Shopify collection IDs you select and a snapshot of each collection title.
• Import jobs. Progress and per-row validation results, kept so an interrupted import can resume.

What the app records about shoppers

When a shopper searches your locator, the app writes one analytics row containing the search text, whether any store matched, how many results were returned, and an approximate coordinate for the heatmap. Before analytics storage, email-shaped values, phone-shaped values, and long digit runs are replaced with a fixed marker. Coordinates from a shopper’s device location are rounded to roughly one kilometre before they are stored.

These rows do not intentionally collect a shopper account, customer ID, session ID, IP address, or advertising identifier. Search text is free text, however, and can contain personal information a shopper types. Analytics rows become eligible for deletion after 90 days; cleanup runs through an hourly scheduled pass and may also run on an eligible storefront or Analytics-page request.

Forms you can switch on

Two optional features collect information from people directly. Both are off unless you turn them on, and while a feature is off its form accepts nothing at all.

• Stockist applications. A retailer applying to appear on your map submits their business name, address, phone, email, website, and an optional message. These describe a business, and once you approve one it becomes a location on your map.
• Shopper messages. If you enable the “Contact this store” button, a shopper submits their name, email, and message. This is personal data. It appears in the app’s Inbox so that you can reply. When outbound email is configured for the deployment, a limited notification digest is also sent through Resend to your shop’s notification address. A shop that has not set one receives no digest, except a development store on the operator’s allowlist, which uses a deployment-wide fallback.

Neither form stores the sender’s IP address. An IP address is read in memory to rate-limit submissions and is discarded immediately; it is never written to the database.

Who else receives data

• Geoapify — when you import or edit a location, its address is sent to Geoapify to convert into map coordinates. Shopper-typed searches are also geocoded so results can be sorted by distance. When a shopper asks for nearby stores without sharing their device location, the shopper’s IP address is sent to Geoapify once to estimate an approximate area; the app does not store the IP address. See the Geoapify privacy policy.
• Google — when the Help page says answers are written by AI, every question you ask it is sent to Google’s Gemini API to compose the reply. Sent with it: the conversation so far in that chat, and the app’s own documentation — our help guides and an internal support handbook describing how the app works. The app does not read or send your store name, locations, shopper messages or stockist applications for this request. A question can still contain information you choose to type or paste, so do not include personal information. If the Help page instead says answers come from our help guides, no assistant is configured and no request is made at all. See the Google privacy policy.
• Resend — only when outbound email is configured. Notification digests for new stockist applications or shopper messages include recent senders’ names, email addresses, stated locations, and submission times. They go to the shop’s notification address when set; otherwise no digest is sent, except for an allowlisted development store, which uses the deployment-wide fallback recipient. A support message you choose to send includes your reply address, shop domain, subject, message, and any in-app support conversation you attach. See the Resend privacy policy. No data is sent to Resend while outbound email is unconfigured.
• Your chosen map provider — the built-in map loads tiles from its provider. If you supply your own Google Maps or Mapbox key, shoppers’ map requests go to that provider under your account and their terms.
• Our hosting and database provider — stores the data above on our behalf.

We do not sell your data, and we do not share it for advertising.

How long data is kept

• Analytics rows — become eligible for deletion after 90 days; cleanup runs through an hourly scheduled pass and may also run on an eligible storefront or Analytics-page request.
• Admin performance samples — page load and interaction timings from your own admin, with no shopper or customer data in them. Deleted automatically after 35 days.
• Locations and settings — kept until you uninstall the app or Shopify sends a shop-redact request.
• Import jobs — completed and failed jobs become eligible for deletion after 30 days. Jobs in other states are kept until you uninstall the app or Shopify sends a shop-redact request. Cleanup uses the same scheduled and request-driven retention passes as analytics rows.
• Shopper messages — become eligible for deletion 90 days after you mark a message as handled; cleanup runs after a later successful shopper-message submission.
• Stockist applications — kept until you uninstall the app or Shopify sends a shop-redact request, unless a customer erasure request deletes a matching application earlier. Customer erasure removes the application in any status; the merchant location record created from an approved application stays on your map with its business name, address and website, and customer erasure blanks the email address and phone number on that location record. A customer data request lists that location record alongside the application. Merchants can edit or delete those separate location records from the Locations page.
• Customer data-request tickets — kept for 30 days. The ticket stores the customer email and a snapshot of matching shopper messages and stockist applications as they existed when Shopify sent the request, so the response remains complete if those submissions later change.
• On uninstall — your session, locations, settings, analytics, form submissions, and customer data-request tickets are deleted when Shopify sends the uninstall webhook.
• On a Shopify erasure request — a shop/redact webhook deletes all remaining locations, settings, import jobs, analytics, form submissions, and sessions for your shop. If delivered, a customers/redact webhook deletes any shopper message, stockist application, and request ticket associated with that person’s email address within your shop. Search-query personal-data-shaped values are never retained, so they do not require a free-text match for either customer webhook. If delivered, a customers/data_request creates a request on the authenticated Privacy requests page for 30 days, where you can download the request-time shopper-message and stockist-application snapshot as JSON and supply it to the requester.

Security

Traffic to the app is served over HTTPS. Storefront requests reach the app through Shopify’s signed app proxy, and admin requests are verified with Shopify session tokens. Access tokens are stored server-side and are never exposed to the storefront.

Your rights

You can export or delete your location data at any time from the app’s Locations page, and export analytics from the Analytics page. Uninstalling removes your data as described above. Depending on where you live, you may also have the right to request a copy of your data, correct it, or ask us to erase it — write to us and we will action it.

Changes

If this policy changes materially, the date at the top of this page is updated and, where the change affects how merchant data is handled, we notify installed merchants.

Contact

Questions or requests: support@appnux.com