Privacy Policy

Who this covers

Pretty Product Options (“the app”, “we”) is a Shopify app operated by HomeDrop LLC. It lets merchants offer made-to-measure and configurable products, and lets shoppers configure those products, see a price, and save or share what they configured.

For personal data belonging to a merchant’s customers, the merchant is the data controller and we act as their processor: we handle that data only to provide the app, on the merchant’s instructions. For the merchant’s own account details, we are the controller.

What we collect

From shoppers, only when they take an action that requires it:

• The configuration itself — the options, dimensions and quantities chosen, and the price quoted for them.
• A Shopify customer identifier, when a signed-in shopper saves a cart, so their saved carts can be shown back to them.
• An email address, only when a shopper asks us to email them a link to a saved cart. Saving a cart does not require one.
• A country, used to price and display currency correctly.

From merchants: the store domain, the access token Shopify issues at install, the app’s own configuration, and an email address if a support request is raised.

We do not collect names, postal addresses, phone numbers or payment details. Payment is handled entirely by Shopify checkout and never reaches us.

Why we use it

• To calculate and display prices for a configured product.
• To let a shopper return to, share, or receive a link to a cart they saved.
• To match a completed order back to the configuration it came from, so the merchant can fulfil it, and to adjust stock when an order is placed or refunded.
• To answer support requests.

We do not use this data for advertising, profiling, automated decision-making, or analytics about individuals. We do not sell or rent personal data, and we do not share it with anyone except the service providers listed below.

Where it is stored

Data is held in a PostgreSQL database hosted by Supabase in Amazon Web Services’ US West (Oregon) region, and processed by application servers hosted by Render in the same region. Data is encrypted in transit (TLS) and at rest.

Our service providers:

• Shopify — the platform the app runs on and the source of store and order data.
• Supabase — database hosting.
• Render — application hosting.
• Resend — transactional email, used to send support replies and saved-cart links a shopper has asked for. Email is never used for marketing.

If you access the app from outside the United States, your data is transferred there.

How long we keep it

• Saved carts (including the customer identifier and any email address) are deleted twelve months after they were last used. Opening a saved cart restarts that period; a cart nobody opens is removed automatically by a scheduled job.
• Configurations and orders are kept while the merchant’s store needs them to fulfil and support the sale, and are deleted when the app is uninstalled.
• Merchant access tokens are deleted when the app is uninstalled.
• Support requests are kept for as long as needed to resolve them and for a reasonable period afterwards.

Deletion and your rights

We support Shopify’s mandatory privacy webhooks. When a shopper asks a merchant to delete their data, or a merchant uninstalls, Shopify notifies us and we erase the corresponding records — saved carts, saved configurations, shared cart links and the store’s configuration — from our database.

Depending on where you live, you may have the right to access, correct, export, delete or restrict the use of your personal data, and to object to it being processed. If you are a shopper, please contact the store you were shopping with, since they control that data; they can ask us on your behalf and we will act on their instruction. If you are a merchant, contact us directly at support@homedrop.io.

Security

Access to production data is restricted to the people who operate the app. The database enforces row-level security, access tokens are stored so they are unreachable from public interfaces, and prices carried into a cart are cryptographically signed so they cannot be altered before checkout.

No system is perfectly secure. If a breach affects your personal data, we will notify the affected merchants and, where required, the relevant supervisory authority without undue delay.

Changes

If this policy changes materially, we will update the date above and notify merchants through the app or by email before the change takes effect.

Contact

HomeDrop LLC
1213 W Morehead St STE 500-303, Charlotte, NC 28208, USA
support@homedrop.io