Privacy Policy

Introduction

EasyApps Ecommerce ("we," "us," or "our") operates the website easyappsecom.com (the "Site"). This Privacy Policy explains what information we collect, how we use it, and your rights regarding your data. We are committed to protecting your privacy and being transparent about our data practices.

Information We Collect

Analytics Data

We use Google Analytics 4 (GA4) to collect anonymous, aggregated usage data about how visitors interact with our Site. This includes:

• Pages visited and time spent on each page
• Referring website or source
• Browser type and device category (desktop, mobile, tablet)
• General geographic region (country/city level)
• Interactions such as clicks and scroll depth

GA4 data is anonymized and does not include personally identifiable information such as your name, email address, or physical address. Google Analytics uses cookies to distinguish unique visitors. For more information, see Google's Privacy Policy.

Information We Do Not Collect

Our website does not:

• Collect personal information (names, email addresses, phone numbers) directly
• Use contact forms, account registration, or login systems
• Store any personal data on our servers
• Use advertising cookies or tracking pixels beyond GA4
• Sell, rent, or share personal information with third parties

Our Shopify Apps

EasyApps Ecommerce develops and publishes Shopify apps available through the Shopify App Store. This section applies to merchants who install our apps and to shoppers who use features our apps add to a merchant's store. For shopper data, the merchant is responsible for its store and we process data on the merchant's behalf.

• Store data. When a merchant installs an app, Shopify gives us the store's basic details (such as the shop domain, store name and the store contact email) and access to the Shopify data covered by the permissions the merchant approves. We use it only to provide, support and bill for the app.
• Where it is processed. Our app servers run on Heroku, app data is stored in Google Cloud (Firebase/Firestore), transactional emails are sent through SendGrid, and AI features in the app admin are processed by Anthropic. EA Email Popup & Spin Wheel also sends a store's discount-code email template and basic store details to Anthropic for an automated anti-abuse check. These providers process data for us under their own security and privacy terms.
• AI features are merchant-only. AI features run in the app admin for the merchant; shoppers cannot use or trigger them.
• No sale. We do not sell merchant or customer data, and we do not use it for advertising.
• Privacy requests. Our apps receive Shopify's mandatory privacy webhooks (customer data requests, customer data erasure and shop data erasure). Merchants and shoppers can also contact us at the address below.

The app-specific sections below describe three apps whose data use needs more detail. For the other apps, see each app's listing on the Shopify App Store or contact us.

EA Accessibility

Accessibility menu usage. The storefront menu reports which tools and profiles are used, as counts per month (for example, how many browsing sessions turned on larger text). These counts contain no information that identifies a shopper.

Orders from shoppers who use the menu (optional, off by default). If a merchant turns on "Count add-to-carts from shoppers who use the menu" and approves Shopify's read-orders permission:

• When a shopper turns on a tool in the menu, the app adds a hidden cart attribute (_ea_accessibility: used) to that shopper's cart. It travels to the order and is visible to the merchant on the order under "Additional details". Add-to-cart events from these shoppers are counted per day.
• The app reads the store's orders from the current and the previous calendar month and requests only each order's date, its custom attributes and its total price with currency. It does not request customer names, email addresses, phone numbers, addresses or the products ordered.
• It keeps only the totals: the number of orders that carry the attribute and their total value, per month. No order IDs and no customer data are stored. The totals are cached for up to an hour and are shown only to the merchant in the app admin.
• The totals are deleted when Shopify sends the shop data erasure request (48 hours after the app is uninstalled). Turning the setting off stops the attribute from being added to new carts.
• This data is not sold, shared or used for any other purpose.

Report-a-problem form. If the merchant enables it, shoppers can send an accessibility problem report from the menu: a category, optionally the assistive technology they use, a message and optionally an email address. The app attaches the page address and a short device summary (for example "Mobile · iOS · Safari"); it does not store the shopper's IP address, full browser user agent or cookies. Reports are stored for the merchant's inbox in the app and emailed to the merchant unless the merchant turns those emails off. A shopper's email address is removed from a report 365 days after it was sent. Reports sent with an email address are deleted when Shopify sends a customer data erasure request for that email, and all reports are deleted with the shop data erasure request. IP addresses are used only briefly, in memory, to limit how often reports can be sent.

AI features. When a merchant generates alt text, the product image and product title are sent to Anthropic to write the description. The optional AI summary of reports sends the reports' category, page, status and message (not email addresses) to Anthropic.

Store scans. Scans load the store's public pages. If the merchant enters a storefront password so a password-protected store can be scanned, it is stored encrypted on our servers and is never published to the storefront.

EA Email Popup & Spin Wheel

What shoppers enter. A popup can ask for an email address and/or a phone number, extra fields the merchant adds (for example a first name or birthday) and answers to quiz or question steps. If the merchant turns it on, it can also ask for consent to WhatsApp marketing. With “Continue with Shop” turned on, a shopper whom Shopify’s Shop sign-in already recognizes can fill in their email from Shop; it then goes through the same sign-up.

Saved in the merchant’s Shopify store. Each sign-up creates or updates a customer in the merchant’s Shopify store with the email address and/or phone number, email or SMS marketing consent recorded as subscribed (given by signing up), WhatsApp marketing consent when the shopper ticks that box, the extra fields and answers (as customer fields, metafields or, if the merchant chooses, tags), the tag ea-spin-wheel and the discount code won. The merchant manages these customers in Shopify, and Shopify’s own privacy tools apply to them.

Sent to the merchant’s own tools. If the merchant connects them, the contact details, answers, prize, discount code, the visit’s UTM source and the shopper’s country are sent to the merchant’s email and SMS tools (Klaviyo, Omnisend, Mailchimp, Attentive, Brevo, ActiveCampaign, Postscript), to a webhook address the merchant sets, and to Shopify Flow. Those tools belong to the merchant, and their own privacy terms apply.

Emails to shoppers. When the merchant chooses to email the discount code, or to confirm the email address before giving the code, we send that email through SendGrid from no-reply@mail.easyappsecom.com with the store’s name and the merchant’s reply-to address, or from the merchant’s own email domain once they have verified it. SendGrid receives the shopper’s email address and the email’s content. Delivery results (delivered, bounced, marked as spam) come back to us only as counts per store per day.

Automated anti-abuse check. To stop stores from using the discount-code email for spam or phishing, an AI model from Anthropic reviews the email as it will be sent (subject, text, links, the store name and the reply-to address) when the store’s email template changes, and reviews the store’s last few emails when it sends an unusual number in a day. The review receives only the domain of each recipient’s address (for example gmail.com), never the full shopper address, plus basic store details (store name and domain, Shopify plan, product count, when the store and its theme were created, campaign names). We keep the last 5 emails each store sent, without the recipients’ addresses, for these reviews.

Records we keep. In our Google Cloud database (Firestore and Firebase Realtime Database):

• For each sign-up, for the merchant’s analytics: the time, campaign, prize, discount code, answers, UTM source, device type, country and the Shopify customer ID. No email address or phone number is stored in these records.
• Counts of popup views, sign-ups and orders per campaign.
• If the merchant shows “real recent winners”: the winner’s first name or a masked email (for example “ann***”), country and prize. Winners from the last 30 days are shown in the popup.
• If the merchant limits duplicate sign-ups, sign-ups per IP address or invite-a-friend spins: one-way hashes of the contact or IP address, never the email address, phone number or IP address itself.
• If the merchant asks shoppers to confirm their email first: the pending sign-up (email address, IP address, country and the sign-up inputs). Confirmation links expire after 72 hours.

The popup also uses the shopper’s browser storage to remember when it was last shown and whether they signed up.

Retention and deletion. When the app is uninstalled it can no longer access the store. Campaign settings and the records above are kept, so everything is still there if the merchant installs the app again. Merchants and shoppers can have this data deleted, or ask for a copy of what we hold, by emailing info@easyappsecom.com.

EA SEO & Page Speed Optimizer: Google Search Console

Connecting Google Search Console is optional. A merchant chooses to connect it from the app admin, signs in with Google and approves access. The app uses Google user data only as described here.

Access the app requests.

• openid and email: only to show which Google account is connected.
• https://www.googleapis.com/auth/webmasters.readonly: read-only access to Search Console.
• https://www.googleapis.com/auth/webmasters: requested only if the merchant clicks the button to allow sitemap submission. It is used only to submit the store's own sitemap (https://<store domain>/sitemap.xml) when the merchant asks. The app makes no other changes in Search Console.

Data the app reads. The list of Search Console properties the account can access (to find the one that matches the store); search performance data (clicks, impressions, click-through rate and average position, by date, search query, page, country, device and search type); the property's sitemaps and their status; and URL Inspection results for pages the merchant chooses to inspect.

How it is used. Only to show the merchant their own search performance inside the app and to help them act on it: performance totals and changes, winning and losing keywords, page insights that link to fixes in the app, and positions for up to 10 keywords the merchant chooses to track. If the merchant asks the app's AI assistant a question, a short summary of the data already loaded in the app (the property, totals and changes, the top 8 search queries and up to 5 page insights) is included in the request to Anthropic so the assistant can answer. Google user data is not used for advertising, is not sold, is not used to train AI or machine-learning models, and is not read by people except with the merchant's permission for support, for security reasons, or where the law requires it.

Storage. The Google refresh token is stored only on our servers, encrypted with AES-256-GCM, in our Google Cloud (Firestore) database; it is never sent to the storefront or the browser. Short-lived access tokens are kept in server memory for up to an hour. Performance results are cached for up to 6 hours so the app does not call Google on every page view. Daily positions of tracked keywords are kept for up to 26 weeks.

Revoking access and deletion. You control the Google connection: remove the app’s access at any time at myaccount.google.com/permissions, or click “Disconnect” on the Search Console card in the app, which revokes the app’s access with Google and deletes the stored token. The app does not remove the connection by itself: your settings, the Search Console connection and the data above are kept when you uninstall the app and when Shopify later sends its shop data erasure request, so everything is still there if you return. If you don’t want the connection kept, disconnect or revoke access before or after uninstalling. To have the other data deleted, email info@easyappsecom.com.

Limited Use. EA SEO & Page Speed Optimizer's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Cookies

Our website uses only the cookies required by Google Analytics 4 to measure site usage. These cookies are:

• _ga — Used to distinguish unique users. Expires after 2 years.
• _ga_* — Used to maintain session state. Expires after 2 years.

We do not use advertising cookies, social media tracking cookies, or any other third-party cookies beyond GA4.

Your Rights Under GDPR

If you are located in the European Economic Area (EEA), you have the following rights:

• Right to access — You can request information about what data we hold about you
• Right to erasure — You can request deletion of your data
• Right to opt out — You can opt out of analytics tracking by using browser privacy settings, enabling "Do Not Track," or installing the Google Analytics Opt-out Browser Add-on

Since we do not collect personal information on this website, there is typically no personal data to access or delete. If you have questions about data collected through our Shopify apps, please email info@easyappsecom.com.

Your Rights Under CCPA

If you are a California resident, the California Consumer Privacy Act (CCPA) provides you with specific rights regarding your personal information:

• Right to know — You can request disclosure of what personal information we collect and how it is used
• Right to delete — You can request deletion of personal information we hold
• Right to opt out of sale — We do not sell personal information to third parties
• Right to non-discrimination — We will not discriminate against you for exercising your privacy rights

Data Security

Our website is served over HTTPS and hosted on Google's Firebase Hosting infrastructure. We do not store personal data on our servers. Analytics data is stored and secured by Google in accordance with their security practices.

Children's Privacy

Our Site is not directed at children under the age of 13. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us so we can take appropriate action.

Third-Party Links

Our Site contains links to third-party websites, including the Shopify App Store, LinkedIn, and other external resources. We are not responsible for the privacy practices of these external sites. We encourage you to review their privacy policies before providing any personal information.

Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date. We encourage you to review this page periodically.

Contact Us

If you have questions about this Privacy Policy or our data practices, email us at info@easyappsecom.com or reach us through our Shopify Partner page. Privacy and deletion requests are answered by email.