Privacy policy

Who is responsible

For merchant-account, support, security and service-administration data, the controller is Jose Maria Perez Bravo, trading as Devailopment (RecoReady). Tax identification number: 77237084W. Address: Carretera de Coin, 64, 3i, 29570 Cártama, Málaga, España. Contact: support@devailopment.com.

For personal data contained in a merchant's Shopify store, the merchant is normally the controller and RecoReady acts as its processor to provide the app. Store customers should first direct privacy requests to the merchant from whom they purchased.

Data we process

Merchant and store identifiers, authorised staff session claims, installation and entitlement status, and encrypted Shopify offline access tokens.

Product, variant, catalogue and sellability data; order and line-item facts within the Shopify permissions granted to the app; and customer identifiers only when Shopify supplies them and they are needed for recommendation, attribution or a privacy request.

A random storefront identifier stored in local storage, cart token, optional Shopify customer identifier, recommendation impressions, clicks, add-to-cart events and conservative line-level attribution. The public marketing site sets no cookies and loads no third-party analytics.

Support messages and the technical records required to prevent abuse, diagnose faults and protect tenant isolation.

Purposes and legal grounds

We process merchant data to provide the contracted service, authenticate installations, reconcile Shopify billing, synchronise authorised store data, generate recommendations, measure observed attribution and provide support.

We rely on performance of the B2B contract, compliance with legal obligations and legitimate interests in security, fraud prevention, reliability and product improvement. When RecoReady acts as processor, it follows the merchant's documented instructions and Shopify's mandatory privacy webhooks.

We do not sell personal data, use it for third-party advertising or represent attributed revenue as incremental revenue.

Retention

Recommendation event facts are retained for 90 days and attribution records for 730 days. Outcome snapshots are retained for 30 days. Completed privacy-request exports expire after 30 days.

Catalogue and order facts remain while the installation is active and are removed or anonymised when Shopify sends the applicable customer or shop redaction request. Encrypted operational backups rotate after 30 days.

Minimal privacy audit evidence contains only the request topic, delivery identifier, hashed shop domain, action and timestamp, never exported customer values.

Recipients and locations

Production data is hosted with netcup GmbH in Germany. Cloudflare provides DNS and routes support email. Shopify supplies installation, store and billing data under its own terms and privacy framework.

Where Shopify or Cloudflare processes data outside the European Economic Area, its published transfer safeguards and contractual mechanisms apply. RecoReady does not send store data to an external generative-AI or recommendation-model API.

Your rights

You may request access, rectification, erasure, restriction, objection or portability where applicable by emailing support@devailopment.com. You may also complain to the Spanish Data Protection Agency (AEPD) at aepd.es.

If the request concerns a shopper's store data, identify the relevant merchant and order where possible. We will coordinate through the merchant and Shopify's compliance process without disclosing another tenant's data.