Privacy Policy — Smart Sorting

Last updated: July 20, 2026

Smart Sorting ("the App", "we", "us") is a Shopify application developed by Holly Palm that automatically sorts products on collection pages based on rules configured by the merchant. This Privacy Policy explains what information the App collects, how it is used, how long it is retained, and the rights available to merchants and their customers.

By installing and using the App, you agree to the collection and use of information as described in this policy.

1. Information We Collect

1.1 Information collected from Shopify

When you install the App, we access data from your Shopify store through Shopify's APIs, limited to the permissions (scopes) you approve during installation:

• Store information: your store name, myshopify domain, email address, plan, currency, and timezone.
• Product data: product titles, handles, status, tags, variants, prices, images, and publication state, used to build and maintain the sorted order of your collections.
• Collection data: collection titles, handles, membership, and current sort settings, used to apply your sorting rules.
• Inventory data: inventory levels per product and variant, used for rules such as moving sold-out products to the bottom of a collection.
• Order data: order line items and dates from a limited recent window (for example, the last 30 days), used only in aggregate to compute sales-based sorting signals such as best sellers. We do not use order data for any other purpose.
• Subscription and billing status: your App subscription plan and its status, provided by Shopify's Billing API. All payments are processed by Shopify; we never receive or store payment card details.

1.2 Information collected directly from you (the merchant)

• Contact information you provide when reaching out to our support channels (for example, your name, email address, or phone number if you contact us via WhatsApp or email).
• Configuration data you create inside the App, such as sorting rules, pinned products, update frequency, and alert settings.
• Basic technical logs generated when you use the App (timestamps, requested actions, and error information), used for security, debugging, and service reliability.

1.3 Information collected from your customers

The App does not add tracking scripts, cookies, or analytics to your storefront and does not collect personal information directly from your store's visitors. Sorting is applied to your collections on the server side.

Order data processed for sales-based sorting may technically include customer-related identifiers as part of Shopify's order records. We do not use, profile, or store customer personal information for any purpose beyond computing aggregate product sales metrics.

2. How We Use the Information

We use the information described above solely to provide and operate the App's services:

• Applying and maintaining the product order of your collections according to your rules.
• Computing sales- and inventory-based sorting signals (for example, best sellers, sold-out detection).
• Displaying dashboards and metrics inside the App.
• Managing your subscription and plan limits.
• Providing customer support and responding to your requests.
• Maintaining the security, stability, and performance of the App.

We do not sell, rent, or share your data with third parties for marketing or advertising purposes, and we do not use your data for any purpose other than providing the App's services.

3. Data Retention

• Store, product, collection, inventory, and configuration data are retained only while the App is installed on your store.
• Order-derived sales metrics are computed from a rolling recent window and older raw data is not retained beyond what is needed to compute those metrics.
• When you uninstall the App, we receive Shopify's app/uninstalled webhook and delete your store's data from our systems within 30 days, except where retention is required by law (for example, billing records).
• Support correspondence may be retained as long as necessary to handle your request and for our legitimate record-keeping.

4. GDPR and Data Subject Rights

We comply with Shopify's mandatory privacy webhooks:

• customers/data_request — if a customer requests their data, we provide the merchant with any customer-related data we hold (in most cases, none beyond aggregate metrics).
• customers/redact — upon request, we delete any data related to a specific customer from our systems.
• shop/redact — after uninstallation, we delete all data related to the store when Shopify sends this webhook.

If you are located in the European Economic Area (EEA), the United Kingdom, or another jurisdiction with similar data protection laws, you have the right to access, correct, export, restrict the processing of, or delete your personal data. To exercise any of these rights, contact us using the details in Section 8.

5. Data Storage, Processing, and Third-Party Services

Your data is stored and processed on secure cloud infrastructure provided by our hosting providers. These providers act as data processors on our behalf and are contractually bound to protect your data. Where data is transferred outside the EEA, transfers rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

We share data only with:

• Shopify, as the platform through which the App operates (see Shopify's own privacy policy).
• Cloud hosting and infrastructure providers, strictly for operating the App.

6. Security

We take reasonable technical and organizational measures to protect your data, including encrypted connections (HTTPS/TLS) for all data in transit, access tokens stored securely, and access to production systems restricted to authorized personnel. No method of transmission or storage is completely secure, but we work to protect your information against unauthorized access, alteration, or destruction.

7. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the "Last updated" date at the top of this page. Continued use of the App after changes take effect constitutes acceptance of the revised policy.

8. Contact Us

If you have questions about this Privacy Policy or want to exercise your privacy rights, contact us:

• Email: hello@hollypalm.com
• Developer: Holly Palm

We will respond to privacy-related requests within 30 days.