1. About this policy
This policy explains how MerchantKits, operated by Khalid Mehmood Durani (sole proprietor) ("MerchantKits", "we", "us") handles personal data in MerchantKits Recall & GPSR ("the app"), a Shopify app that helps merchants run product recalls and show EU GPSR product safety information. It covers merchants who install the app and the merchants' customers who receive recall notices. Our other products have their own policies.
Questions: support@merchantkits.com.
2. Who we are and our role
The app is provided by MerchantKits, Hyderabad 71700, Sindh, Pakistan. Contact: support@merchantkits.com.
Merchant data — we are the controller
Data about your store and your use of the app, which we need to provide the app to you.
Your customers' data — you are the controller, we are your processor
When you run a recall, we process your customers' data only on your instructions and under our Data Processing Agreement. You decide whether to recall, whom to notify and what the notice says.
3. Data we process
Merchant (store) data
Your store's myshopify domain and name, the store owner's email and the store contact email (used as the reply-to address of recall emails), the store's language and time zone, your plan and subscription status as reported by Shopify, the permissions you granted, Shopify access tokens (encrypted, see section 8), app settings, and records of your activity in the app (recalls, their event log, background jobs, and requests made under privacy law).
Customer data (processed for the merchant)
For each customer included in a recall: email address, first name, order number and order ID, Shopify customer ID, language, delivery status of the recall email and reminders (with the email provider's message ID and any delivery error), when reminders were sent, when the customer confirmed the notice, and the remedy they chose (for example a refund or replacement). The personal confirmation link is stored only as a one-way hash, plus an encrypted copy that is deleted when the recall is closed. This data comes from the merchant's Shopify orders. We do not read customers' postal addresses, phone numbers or payment details. Privacy requests that Shopify forwards to us contain the customer's email (and phone number, if known); we use them only to find and handle that customer's records and do not store them.
Confirmation page visits
To protect the confirmation page from abuse, we count requests per visitor using a one-way hash of the IP address. The hash is deleted after one day. Raw IP addresses are not stored in our database.
Product safety (GPSR) data
Manufacturers, EU responsible persons and warnings you enter (names, business postal addresses, email addresses, websites, warning texts and their translations). This is business information, but it can include a contact person's name or email. It is stored in your Shopify store and, as a backup, in our database so it can be restored if you reinstall the app (section 7). For the gap scan and the recall monitor we also keep product titles, vendors, barcodes and scan results.
Public recall data
The recall monitor (Pro plan) stores official recall notices published by the European Commission (EU Safety Gate) and the U.S. Consumer Product Safety Commission. These notices describe products, not people.
4. Why we use it
- · To provide the app to merchants (performance of our contract with you).
- · To find the customers who bought a recalled product, send the recall notice and reminders the merchant confirmed, record acknowledgments, and produce the merchant's evidence report (on the merchant's instructions, as processor).
- · To keep the app secure, prevent abuse and fix errors (our legitimate interest).
- · To handle billing through Shopify and to meet legal obligations.
Recall emails are product safety notices, never marketing. We do not sell data, use it for advertising, or use customer data for any purpose of our own.
5. Where data is stored and who processes it
We use these subprocessors:
Cloudflare and Resend are based in the United States, and Resend stores email delivery data (recipient addresses, message metadata and logs) in the United States. Transfers outside the EEA are covered by the European Commission's Standard Contractual Clauses (modules 2 and 3) and the UK Addendum in the Cloudflare Customer DPA and the Resend DPA, which apply to our accounts, and by both companies' participation in the EU-U.S. Data Privacy Framework.
6. Cookies
The app sets no cookies and stores no login data in your browser. In the Shopify admin, the app identifies you with short-lived session tokens provided by Shopify. The customer confirmation page is shown on the merchant's store domain through Shopify; it sets no cookies of its own (the store itself may use cookies under the merchant's and Shopify's policies).
7. How long we keep data
8. Security
All traffic uses HTTPS. Data is encrypted at rest by Cloudflare; Shopify access tokens are additionally encrypted by the app (AES-GCM) and confirmation links are stored as one-way hashes. The app requests only the Shopify permissions it uses. Access to production systems is limited to MerchantKits' authorised staff, protected by strong passwords and two-factor authentication, and our logs are designed not to contain customer contact data. If a personal data breach affects you, we will notify you as described in the DPA.
9. Your rights
Merchants: under the GDPR and similar laws you can ask for access to, correction or deletion of your data, restriction of or objection to its processing, and a copy in a portable format. Email support@merchantkits.com.
Customers who received a recall notice: the store that sent the notice is responsible for your data. Please contact that store first; you can reply to the recall email. Requests you make to the store through Shopify reach us automatically: for an access request we send the store owner the recall records we hold about you, and for an erasure request we delete them. You can also write to us and we will pass your request to the store and help it respond.
You have the right to lodge a complaint with a data protection supervisory authority.
10. Data sources and credits
The recall monitor uses EU Safety Gate data, © European Union, published by the European Commission under the Creative Commons Attribution 4.0 licence (CC BY 4.0); we shorten and reformat it. It also uses recall data from the U.S. Consumer Product Safety Commission, which is in the public domain. Pictures are shown from the official sources.
11. Children
The app is for businesses. We do not knowingly process data of children, other than where a store's customer is a minor and the store sends them a recall notice; the store is responsible for that processing.
12. Changes
We may update this policy. We will tell merchants about material changes by email to the store owner address before they take effect. The date at the top shows the latest version.