Privacy policy

Information we collect

Blog comment events

When a visitor submits a comment on a blog article (and the theme app embed is enabled), the App may temporarily receive and store:

• Comment author name
• Comment author email address
• Comment text
• Blog article path and title
• Submission timestamp
• Your shop domain

This information is used solely to trigger your Shopify Flow workflows (for example, sending an internal email to your team).

Shop and usage data

We store non-content records about your shop, including:

• Shop domain
• Install and uninstall dates
• Aggregate comment counts (lifetime totals for usage tracking)
• Date of the most recent comment received

Aggregate counts may persist across reinstalls. They do not include comment text or commenter email addresses.

Session data

Like other Shopify apps, we store OAuth session data (such as access tokens and shop identifier) so the App can authenticate with your store. Session data is deleted when you uninstall the App.

How long we keep data

• Comment content (author, email, body) is kept only until it is successfully sent to Shopify Flow, then deleted from our systems. Events that fail to reach Flow are removed after a short retention period (7 days), enforced automatically by a database expiry (TTL) policy.
• On uninstall, remaining comment content and session data are deleted. Aggregate usage counts may be retained briefly in deactivated form, then removed when Shopify sends a shop redact request (typically within 48 hours after uninstall).
• Aggregate usage totals on your shop record survive reinstall so Plan and Usage reporting stays accurate; they contain no comment text or personal details from commenters.

Where data is processed

The App is hosted on Google Cloud Run and persistent data is stored in Google Cloud Firestore. Both run in Google Cloud's Montréal, Canada region (northamerica-northeast1). Shopify processes Flow events and any actions you configure within Shopify Flow according to Shopify’s own terms and policies.

Sharing and disclosure

We do not sell personal information. We share data only as needed to operate the App:

• Shopify — authentication, Flow trigger delivery, and app platform services
• Google Cloud — application hosting (Cloud Run) and data storage (Firestore)

Comment details you choose to include in Flow workflows (such as internal emails) are handled by Shopify and your configured Flow actions.

Your rights and GDPR

We subscribe to Shopify’s mandatory compliance webhooks and respond to:

• Customer data requests — we provide any comment data we still hold for the requested customer email
• Customer redact — we delete comment records matching the customer email
• Shop redact — we delete all shop-related data after uninstall

Because comment content is deleted soon after Flow processing, we may no longer hold data when a request arrives. We will still acknowledge and fulfill each request within Shopify’s required timeframe.

If you are a merchant and have questions about data we hold for your store, contact us using the details below.

Security

App proxy and webhook requests are authenticated by Shopify. Access tokens are stored securely. We do not log comment content in production application logs.

Stored data is encrypted in transit (TLS) and at rest by Google Cloud. The database is not reachable from the public internet: all direct client access is denied by security rules, and only the App's own server identity can read or write data.

Changes to this policy

We may update this policy from time to time. The “Last updated” date at the top of this page will change when we do. Continued use of the App after changes constitutes acceptance of the updated policy.

Contact

Bricks2Clicks.Online
Email: support@bricks2clicks.online
Web: bcn.bricks2clicks.online