Last updated: 27/08/26

1. Data Controller

The data controller is:

NEW DREAM di Alberto Bianchi Crema

Strada Zanni 60, 65125 Pescara, Italy

Email: privacy@myshopviz.com

For any question regarding this policy or our data processing practices, please contact us at the email address above.

2. What MyShopViz is

MyShopViz is an embedded application for the Shopify platform, voluntarily installed by merchants for multi-location analysis and management of their store (business intelligence on sales, inventory, margins, customers, promotions; operations on inventory counts, transfers, variants, and pricing).

3. Core principle: no persistent storage of store data

MyShopViz is built around a core architectural principle: no store data — customers, orders, or products — is permanently stored on MyShopViz servers.

All data required for the app to function (sales, inventory, customers, orders, products, prices) is requested in real time from Shopify's APIs (Admin GraphQL API, ShopifyQL) at the moment the merchant uses a feature, processed in memory to generate the requested result, and returned to the merchant's browser. Once processing is complete, this data is not written to any database or persistent log related to the store's content.

This means MyShopViz does not retain copies of:

• Personal data or records of the merchant's end customers
• Order or transaction history
• Product catalogs, stock levels, or price lists
• Any other commercial data belonging to the store

4. Data we actually process

Despite the principle in section 3, some minimal technical data is required for the app to function and is processed as follows:

• OAuth session tokens: upon installation, Shopify issues an access token that MyShopViz stores in a session database (SQLite) in order to make authorized API calls to the merchant's store. This token identifies the app installation on a given store, not an end customer.
• App configuration data: language preferences, filter settings, and similar technical settings needed for the interface to function.
• Billing data: subscription information (plan, trial status, renewal date) is managed directly through Shopify's Billing API; MyShopViz does not process or store payment data (card numbers, etc.), which remains exclusively managed by Shopify.
• Minimal technical logs: operational logs (e.g., application errors, call timestamps) that contain no personal data of end customers, used solely for diagnostics and security purposes.

5. Legal basis for processing

Processing of the technical data described in section 4 is based on:

• Performance of a contract: necessary to provide the service requested by the merchant upon installing the app.
• Legitimate interest: for security, fraud prevention, and technical diagnostics purposes.

6. Sharing data with third parties

The technical data processed by MyShopViz is not sold, rented, or shared with third parties for advertising or marketing purposes.

The only parties involved in processing are:

• Shopify Inc., as the platform on which the app operates and the provider of the APIs used.
• Our server infrastructure provider (Aruba SPA), used solely for hosting the application and storing session tokens.

We do not use third-party services for advertising tracking, invasive third-party analytics, or data resale.

7. Data retention

• Session tokens are retained for the duration of the app's installation on the merchant's store and are automatically deleted upon uninstallation (in response to the app/uninstalled webhook and, where applicable, shop/redact).
• Because store data (customers, orders, products) is never persisted, there is no retention period applicable to it: this data is discarded immediately after generating the response shown to the user.

8. Data subject rights and GDPR compliance webhooks

MyShopViz supports the mandatory privacy compliance webhooks required by Shopify:

• customers/data_request: if a merchant requests, on behalf of one of their customers, access to data collected about that customer, MyShopViz responds confirming that no personal data of the customer is stored on its servers, since all data is processed in real time and never persisted.
• customers/redact: similarly, since no customer data is retained, there is nothing for MyShopViz to delete.
• shop/redact: upon app uninstallation (after the timeframe set by Shopify), MyShopViz deletes any remaining technical data related to the store (e.g., session tokens), completing the deletion.

For the technical data actually processed (section 4), data subjects may at any time exercise the rights provided by the General Data Protection Regulation (EU) 2016/679 (GDPR) and other applicable data protection laws, including: the right to access, rectify, erase, restrict processing, port data, and object to processing. Requests may be sent to privacy@myshopviz.com.

9. International data transfers

The servers hosting the application are located in Italy. Should any data transfers outside the European Economic Area become necessary, they will take place in accordance with the safeguards required by applicable law (e.g., standard contractual clauses).

10. Cookies and tracking technologies

As an application embedded within the Shopify Admin, MyShopViz uses only technical cookies strictly necessary to maintain the authenticated session (via Shopify App Bridge). No profiling or third-party advertising tracking cookies are used.

11. Security

We adopt appropriate technical and organizational measures to protect processed data, including: encrypted communications via HTTPS/TLS, HMAC signature verification on all incoming webhook requests, restricted and controlled access to server systems, and a firewall (UFW) and reverse proxy (Caddy) configured according to security best practices.

12. Children's data

MyShopViz is not intended for direct use by minors and is aimed exclusively at merchants using the Shopify platform as professional users.

13. Changes to this policy

We reserve the right to periodically update this policy. Any material changes will be communicated through the app or our website. The "last updated" date at the top of this document indicates the most recent version.

14. Governing law

This policy is governed by the laws of Italy. Any dispute shall be subject to the exclusive jurisdiction of the courts of Pescara, except where mandatory consumer protection law provides otherwise.

15. Contact

For questions about this privacy policy or to exercise your rights, contact: privacy@myshopviz.com