Privacy Policy

1. App provider and privacy contact

Suvrana — Italian sole proprietorship
Via Bruceto 88/E
51010 Massa e Cozzile (PT), Italy
VAT ID: IT01900300474
Email: biosuvrana@gmail.com

For questions about this notice or information handled by Geo Visibility Manager, contact the email address above. Responsibility for personal data may differ depending on whether data concerns app administration, a merchant's store, or Shopify's own services.

2. Information processed

The app uses Shopify authorization and session management. Its PostgreSQL session records can contain the store domain, access or refresh tokens, session identifiers and metadata, and — when Shopify provides them for an online session — staff account details such as identifiers, names and email addresses.

The app reads merchant-selected pages, collections and navigation data and saves country visibility rules in Shopify metafields. Rules for navigation are stored in app-related Shopify metafields. Information within store content may itself include personal data entered by the merchant.

The storefront extension uses the country selected in Shopify's storefront localization context. It does not independently determine a visitor's location from their IP address. The reviewed application database schema does not contain dedicated customer or order tables; operational logs or Shopify store resources may nevertheless involve personal data.

3. Purposes and legal basis

Information is processed to authorize installed shops, provide and secure the app, retrieve requested Shopify resources, store merchant-configured visibility rules, troubleshoot failures and respond to relevant privacy requests.

Depending on the processing activity and the relationship with the person concerned, relevant legal bases may include performance of a contract, compliance with legal obligations, and legitimate interests in operating and securing the service. Where Suvrana acts on a merchant's instructions, the merchant may determine the applicable basis for the underlying store data.

4. Service providers and international transfers

Geo Visibility Manager integrates with Shopify and is hosted using Render infrastructure. The application web service and managed PostgreSQL database are configured in Frankfurt (EU Central). Shopify metafields remain within the Shopify platform and are subject to Shopify's own infrastructure and applicable terms.

Render publishes information on its data-processing terms and subprocessors. International processing or access may occur under the providers’ applicable contractual arrangements and safeguards. Hosting in an EU region does not, by itself, guarantee that all processing occurs exclusively within the European Economic Area. See Render Data Processing Addendum, Render Privacy Policy and Render subprocessors.

5. Retention, uninstall and deletion

Application session records are deleted from the app's PostgreSQL database when its authenticated app/uninstalled or shop/redact handler successfully processes the relevant Shopify webhook. The application also verifies and acknowledges Shopify customers/data_request and customers/redact webhooks. These acknowledgements do not themselves constitute a complete response to an individual privacy request. Any relevant data in support correspondence or operational records must be evaluated and handled separately as required.

The Render Hobby workspace provides a 7-day dashboard log-access window. No default third-party log-stream destination is currently configured at workspace level. The paid PostgreSQL database offers a 3-day point-in-time recovery window. If an on-demand logical database export is created, Render states that export files are retained for at least 7 days. These windows describe provider features, not a guarantee that every underlying or separately downloaded copy is erased after the stated period.

Country visibility settings stored in Shopify metafields are not necessarily removed by deletion of the app's PostgreSQL session records. Merchants can use the app’s “Remove all visibility rules” function before uninstalling, including if their subscription is no longer active. This action targets the app’s documented visibility metafield keys and does not remove unrelated Shopify data. The treatment of settings remaining after uninstall depends on the Shopify resource and metafield ownership or lifecycle. Requests about remaining store content can be directed to the merchant or Shopify as appropriate.

6. Privacy requests and rights

For access, correction, deletion, restriction, objection or other requests permitted by applicable law concerning data processed by Suvrana, contact biosuvrana@gmail.com. Provide the relevant Shopify store domain and enough information to identify the request; do not send passwords or access tokens.

Depending on the processing relationship, requests concerning a merchant's customers may need to be handled by the merchant as the relevant controller. Individuals may also have the right to lodge a complaint with a competent data-protection authority.

7. Security and changes to this notice

Geo Visibility Manager uses Shopify's authentication and session integration and validates incoming Shopify webhook signatures using HMAC-SHA256 against the original request body before processing. Operational system access is managed through administrative accounts and infrastructure-provider controls. No internet-based service can guarantee absolute security.

This notice may be updated when processing practices, providers or legal requirements change. Material changes will be reflected on this page with a revised update date.