Privacy Policy

1. Definitions and Interpretation

"Personal Data" refers to any information relating to an identified or identifiable natural person.

"Information We Process" includes Personal Data as well as customer-provided business information, confidential information, Shopify Partner API credentials, and Shopify Partner/API data that may not relate to an identifiable natural person.

"Processing" includes any operation performed on Information We Process, whether or not by automated means, such as collection, storage, access, use, organization, transmission, or deletion.

"Controller" refers, where applicable, to the entity that determines the purposes and means of processing Personal Data. Avit Tech, LLC acts as a controller for certain Personal Data described in this Policy and may process other information on behalf of customers to provide the Service.

2. Information We Process and How We Use It

Some Information We Process is Personal Data. Other information consists of customer business records, Partner API Credentials, and Partner API data that may not identify a natural person. When business information identifies or can reasonably be linked to a natural person, we treat it as Personal Data under this Policy.

Types of Information We Process:

• Account and Contact Information: Names, email addresses, phone numbers, account roles, and authentication information.
• Shopify Partner API Credentials: Credentials, tokens, permissions, and related connection information that customers provide or authorize us to store and use to connect the Service to Shopify.
• Shopify Partner and App Information: Partner, organization, app, and referral identifiers and other app information contained in Partner API responses.
• Financial and Transaction Information: Transaction records, app revenue information, subscription or plan information, commissions, and related financial records retrieved through the Shopify Partner API or provided through the Service.
• Installation and Referral Information: App installation and uninstallation events, referral and attribution information, and related activity.
• Shop Identifiers: Shop identifiers contained in Partner API responses where present.
• Other Partner API Data: Other information contained in Partner API responses that is needed to provide customer-requested Service features.
• Usage and Technical Data: IP addresses, browser and device types, log data, diagnostic data, and service usage details.
• Cookies and Tracking Technologies: We use various cookies and similar tracking technologies to understand how you interact with our service and to enhance your user experience.

How We Use Information:

We use the Information We Process for purposes including:

• To provide, secure, maintain, support, and improve the Service.
• To use customer-provided Partner API Credentials to interact with the Shopify Partner API on the customer's behalf.
• To retrieve, synchronize, organize, display, and otherwise process Partner API data needed to provide the Shoffi Service.
• To calculate referrals, attribution, commissions, transactions, and account or app statistics.
• To administer accounts, subscriptions, customer support, and service communications.
• To monitor performance and usage, troubleshoot issues, and detect or prevent fraud, abuse, and security threats.
• To comply with legal obligations and enforce our agreements.

3. Shopify Relationship

Shoffi is an independent service operated by Avit Tech, LLC. Shopify does not operate Shoffi. When a customer connects a Shopify Partner account, the customer authorizes Shoffi to store and use their Partner API Credentials to retrieve and process Partner API data needed to provide the Shoffi Service.

Access to and use of Shopify APIs is also governed by Shopify's applicable API terms and policies and by the customer's agreements with Shopify. Customers are responsible for ensuring that they are authorized to provide credentials and grant access to the corresponding Partner API data.

4. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to track activity on our service and store certain information. Cookies are small pieces of data stored on your device (computer or mobile device) that help us improve our service and enhance your user experience.

Types of Cookies We Use:

• Session Cookies: These cookies are essential for providing you with services available through our website and enable you to use some of its features. They help authenticate users and prevent fraudulent use of user accounts. Without these cookies, the services you have requested cannot be provided, and we only use these cookies to provide you with those services.
• Analytics Cookies: We use Google Analytics cookies to measure and analyze how our customers use the website and to improve its functionality and user experience. Google Analytics is a web analytics service offered by Google that tracks and reports website traffic. More information about Google Analytics cookies can be found on the official Google Analytics page.
• Functionality Cookies: These cookies allow us to remember choices you make when you use our website, such as remembering your language preferences and chat settings. This includes cookies deployed by the Crisp platform to provide live chat support, and potentially other functionality cookies that improve your interaction with our site. These cookies can also facilitate enhanced, more personal features. They do not track your browsing activity on other websites.

Managing Cookies:

You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent. However, if you do not accept cookies, you may not be able to use some portions of our Service. To manage cookies:

• Visit the settings or preferences menu on your browser to manage settings.
• Follow the instructions provided by your browser (usually located within the "help," "tools," or "edit" settings).
• For more detailed information about cookie management with specific web browsers, find the respective browser's websites.

5. Legal Basis for Processing Personal Data

Where applicable privacy law requires a legal basis, we process Personal Data under one or more of the following:

• Consent: We may process your data if you have given us explicit consent to use your personal data for a specific purpose.
• Contract: Processing is necessary for the performance of a contract to which you are a party or to take steps at your request before entering a contract.
• Legal Obligations: Processing is necessary for compliance with a legal obligation to which we are subject.
• Legitimate Interests: Processing is necessary for the purposes of the legitimate interests pursued by us or by a third party.

6. Your Privacy Rights

Depending on where you live and subject to applicable law, you may have rights regarding your Personal Data, including:

• Right to access – You may have the right to request copies of your Personal Data.
• Right to rectification – You may have the right to request that we correct inaccurate Personal Data.
• Right to erasure – You may have the right to request that we erase your Personal Data under certain conditions.
• Right to restrict processing – You may have the right to request that we restrict the processing of your Personal Data.
• Right to object to processing – You may have the right to object to our processing of your Personal Data.
• Right to data portability – You may have the right to request that we transfer certain Personal Data to another organization or directly to you.

7. Data Retention

We retain Information We Process for as long as reasonably necessary to provide the Service, fulfill the purposes described in this Policy, comply with legal, accounting, reporting, or contractual obligations, resolve disputes, and enforce our agreements. In determining an appropriate retention period, we consider the nature and sensitivity of the information, the purposes for processing it, and the potential risks associated with unauthorized use or disclosure.

8. Information Security and Incidents

We maintain reasonable administrative, technical, and organizational safeguards designed to protect Partner API Credentials and Shopify Partner/API data processed through the Service against unauthorized access, loss, misuse, alteration, or disclosure. No security measures, system, or method of transmission can guarantee absolute security.

Shoffi may investigate suspected security incidents and may notify users or require credential rotation where required by law or contractual obligations, or where Shoffi reasonably determines that doing so is appropriate to mitigate security risk. Customers remain responsible for safeguarding their Shopify Partner accounts and credentials and should promptly rotate or revoke credentials they know or suspect have been compromised.

9. Disclosure of Information

We may disclose Information We Process to service providers and contractors that help us host, secure, support, analyze, and operate the Service, subject to appropriate obligations. We may also transmit information to and receive information from Shopify when a customer directs us to connect to Shopify APIs.

We may disclose information when required by law or in response to a valid legal request, or where we believe in good faith that disclosure is reasonably necessary to protect rights or safety, investigate fraud or security issues, enforce our agreements, or respond to a government request. Information may also be disclosed in connection with a merger, financing, acquisition, reorganization, or sale of all or part of our business, subject to applicable law.

We do not disclose Personal Data to third parties for their direct marketing purposes without authorization.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will post the revised Policy and update its effective date. We may communicate material changes by email, in-app notice, or another reasonable method where appropriate or required by applicable law.

11. Contact Us

If you have any questions about this Privacy Policy, you can contact us:

By email: [email protected]