This policy covers the CRO Toolbox app for Shopify ("the app") and this website. CRO Toolbox is run by OMC ("we"). Questions: contact us through our support page.
The short version
- The app's settings are saved in your own Shopify store, not on our servers.
- Our database holds only what the app needs to work: Shopify login sessions, back in stock requests and return requests.
- We never store shoppers' names, phone numbers or full addresses.
- When you uninstall, Shopify asks us to delete your store's data and we do.
- This website has no cookies, no analytics and no forms.
Data the app uses
When a merchant installs the app, Shopify gives it access to the store data it asks for (its access scopes). The app uses that data as follows.
| Data | Why | Where it's kept |
|---|---|---|
| Store settings: offers, bundles, designs, reviews, FAQ and other content you create in the app | To show your offers and sections on your store and apply them at checkout | In your store, as app data Shopify keeps for the app (metaobjects and metafields) |
| Products, collections, files and menus | To let you pick products, images, videos and menus in the app, and to create the bundle products and pages you ask for | Read from Shopify when needed, not copied to our database |
| Orders from the last 60 days | Analytics (which sales came from the app's offers), the monthly order count for your plan, "bought together" suggestions, sales pop ups (product and time, and the shipping city only if you turn it on), and the order lookup on the track order and returns pages (order number and email typed by the shopper) | Read from Shopify when needed. The sales pop up list is kept in your store |
| Reviews written on your store: the name, text, rating and location the shopper enters (no email) | So you can approve and show them | In your store |
| Wishlists, and choices like gift notes, delivery dates and personalization text | To save the shopper's wishlist, and to pass their choices to the order | Wishlists stay in the shopper's own browser. Choices are added to the cart and order in Shopify |
| Login sessions: your store's address, its access token and, for staff who open the app, the name and email Shopify provides | To keep you signed in to the app inside Shopify admin | Our database |
| Back in stock requests: the email a shopper types and the product they want | So the store can tell the shopper when the product is back | Our database |
| Return requests: order number, email, items, reason and note | So the merchant can review the return in the app | Our database |
The app's widgets read your store's own data as the page loads. Only the forms shoppers send (reviews, back in stock requests, return requests and order lookups) reach our server, through Shopify. Checkout logic (discounts, bundles, payment and delivery rules, order limits) runs inside Shopify. We do not sell data, and we do not use it for advertising.
Security
All connections use HTTPS. Requests from Shopify are verified with Shopify's signatures, and each store's data is only accessed with that store's own access token.
Service providers
- Shopify: the platform the app runs on, and billing for paid plans.
- Render: hosts the app's server (United States).
- Supabase: hosts the app's database (United States, East).
How long we keep it, and deleting it
- Uninstall: 48 hours after a store uninstalls the app, Shopify asks us to delete the store's data. We then delete its sessions, back in stock requests and return requests. App data saved in the store is removed by Shopify together with the app.
- Shopper requests: when a shopper asks a store to delete their data, Shopify tells us and we delete that shopper's back in stock requests, return requests and sales pop up entries.
- Merchants can also delete reviews, return requests and other content in the app at any time.
Shoppers
If you shopped at a store that uses CRO Toolbox, the store is responsible for your data. Contact the store first; we help stores answer data requests through Shopify's privacy tools.
This website
This website is a static site. It sets no cookies, runs no analytics and has no forms. Like any website, our hosting provider may keep standard server logs (such as IP address, browser and page requested) for security and reliability. Links to the Shopify App Store carry tags that tell Shopify which page you came from; Shopify's own privacy policy applies there.
Your rights
Depending on where you live, you may have the right to access, correct or delete your personal data, or to object to how it's used. Merchants can contact us through our support page. We answer within 30 days.
Changes
We update this policy when the app changes what it collects. The date at the top shows the latest version.