This Privacy Policy explains how FlexCover Protection (“FlexCover”, “we”, “us”) collects, uses, stores, and protects information when merchants install and use our application (“the App”) on the Shopify platform, and how shoppers’ information is handled as a result. By using the App, merchants agree to this policy.
1. Who we are
FlexCover Protection is a Shopify app that lets merchants offer shipping protection and extended warranty plans to their customers. We act as a processor for order data belonging to merchant stores: the merchant remains the controller of that data, and we only process it to provide the App’s functionality. For our own business data (such as merchant account details), we act as a controller.
2. Information we collect
2.1 Store (merchant) information
When a merchant installs the App through Shopify, we receive and store:
- Shop name and .myshopify.com domain
- Store currency and IANA time zone
- Shopify plan name (e.g. Basic, Advanced)
- Installation status and timestamps (install / uninstall events)
2.2 Order information
To measure protection attach rates and revenue, the App receives order data from Shopify webhooks (orders/create, orders/update). For each order we store:
| Field | Purpose |
|---|---|
| Shopify order ID and order number (e.g. #1001) | Identify the order and prevent duplicate records |
| Order name | Display in the merchant dashboard |
| Customer email address | Analytics and order attribution; fulfilled for data requests/redaction |
| Currency, total price, subtotal price | Revenue and attach-rate analytics |
| Financial status, fulfillment status | Order state in analytics |
| Whether a protection plan was added, which plan, and its price | Core App functionality: measuring plan performance |
| Order timestamps and test-order flag | Analytics accuracy (excludes test orders) |
2.3 Storefront widget
The widget that shoppers see on a merchant’s storefront (cart page / checkout) only reads the merchant’s public plan configuration from our API. It does not collect any personal information from shoppers, does not set cookies, and does not fingerprint or track visitors across sites.
2.4 Support communications
If a merchant contacts us through in-app live chat or email, we receive the content of that conversation and the contact details provided, and use it only to provide support.
3. What we do not collect
We do not collect or store customer names in full profiles, shipping or billing addresses, phone numbers, payment card details, or browsing behavior. We do not sell personal information to anyone, and we do not use order data for advertising or to build customer profiles beyond the App’s own analytics for the merchant it belongs to.
4. How we use information
- To provide the App’s core functionality: offering protection plans, syncing orders, and computing analytics.
- To operate, secure, and troubleshoot the App (e.g. detecting webhook redeliveries).
- To respond to merchant support requests.
- To comply with Shopify’s mandatory webhook requirements and applicable law.
We do not use order or customer data for any other purpose, and we never use it to contact shoppers directly.
5. Legal bases (GDPR)
Where the EU/UK GDPR applies, we process personal data on the following bases: performance of a contract (providing the App to the merchant), legitimate interests (securing and improving the App), and legal obligation (responding to mandatory data requests and redaction notices).
8. Data retention & security
We keep order data only for as long as the merchant’s subscription is active, plus a short grace period after uninstall for account restoration. When a store is uninstalled and the retention window passes, or when Shopify sends a shop/redact webhook, the store’s record and every stored copy of its orders are permanently erased.
All traffic to our services is encrypted in transit (TLS). Data is stored in access-controlled databases, and access is limited to personnel who need it to operate and support the App.
9. Your rights & data requests
Merchants may uninstall the App at any time from their Shopify admin, which stops all new data collection. Under GDPR and similar laws, individuals may have rights to access, correct, export, or erase their personal data.
We fully implement Shopify’s three mandatory GDPR webhooks. Merchants and end customers exercise these rights through Shopify (Shop Settings → Customers → Manage customer data, or via the store owner):
| Webhook | What we do |
|---|---|
customers/data_request | We compile the data we hold for that customer in that store and send it to the merchant through Shopify, within 30 days. |
customers/redact | We permanently delete that customer’s personal data (including their email address) from our records, while keeping anonymized order aggregates. |
shop/redact | We permanently delete the store’s record and all stored order data, within 30 days. |
Requests made directly to us by shoppers will be redirected to the merchant store, since the merchant is the controller of that data.
10. International data transfers
Our infrastructure may be located outside the merchant’s or customer’s country of residence. Where personal data is transferred internationally, we rely on appropriate safeguards such as standard contractual clauses and equivalent transfer mechanisms.
11. Changes to this policy
We may update this policy as the App evolves. Material changes will be announced through the App or Shopify’s app update mechanism, and the “effective date” above will always reflect the current version.
12. Contact us
Questions about this policy, or privacy requests from merchants, can be sent to:
FlexCover Protection
Email: support@flexcover.app