Privacy Policy

This Privacy Policy applies to the WishVerse Wishlist application ("the App", "we", "us", or "our"), designed to provide wishlist functionality, email reminders, and analytics for Shopify merchants ("Merchants") and their online store customers ("Shoppers" or "Users").

By installing the App on your Shopify store, or by interacting with a store that utilizes WishVerse, you acknowledge and accept the collection, storage, and processing of information as described in this policy.

To operate smoothly and deliver high-performance wishlist experiences, WishVerse collects different categories of information depending on whether you are a Merchant or an end-customer:

A. Information Collected from Merchants

• Store & Account Details: Shop domain (e.g., your-store.myshopify.com), primary email address, store owner name, currency, timezone, and shop country via the Shopify Admin GraphQL API.
• App Configuration Settings: Custom theme preferences, button styling, wishlist page layouts, automated reminder rules, and notification preferences configured inside the WishVerse admin dashboard.
• Authentication Tokens: OAuth offline access tokens granted by Shopify to read product listings, themes, and orders in order to provide wishlist features and track wishlist-driven conversions.

B. Information Collected from Shoppers & Customers

• Customer Account Identifiers: Shopify Customer ID, customer first name, last name, and email address (only when the customer is logged into their Shopify store account).
• Wishlist Activity: Product IDs, variant IDs, item titles, prices, dates items were added or moved to cart, custom wishlist names, and privacy settings (private, public, or shared).
• Guest Shoppers: When a customer is not logged in, wishlist items are stored locally in the shopper’s browser localStorage/sessionStorage and associated with an anonymous guest session ID. No personally identifiable information (PII) is collected for guest shoppers until they sign in or share their list.

C. Automatically Collected Technical Data

When interacting with the WishVerse app or storefront extension, basic technical metadata may be logged to ensure reliability, security, and performance: browser user-agent, IP address (for rate limiting and DDoS prevention), locale/language code, and API response timestamps.

We process collected data exclusively for legitimate operational purposes directly tied to providing and optimizing wishlist services:

Under the General Data Protection Regulation (GDPR) and similar privacy frameworks, we act as a Data Processor on behalf of the Merchant (who serves as the Data Controller). Our legal grounds for collecting and processing personal information include:

• Contractual Necessity: Processing is required to fulfill our software agreement with the Merchant and deliver wishlist functionality.
• Merchant & Customer Consent: When shoppers choose to opt-in to marketing communications, back-in-stock notifications, or wishlist sharing.
• Legitimate Interests: Securing our systems, detecting abuse, and preventing fraudulent transactions.
• Legal Obligations: Compliance with Shopify’s mandatory compliance webhooks and statutory reporting requirements.

We do not sell personal data. Information is only transferred to trusted infrastructure sub-processors necessary to run the application:

WishVerse leverages lightweight browser technologies on merchant storefronts to optimize performance without tracking users across third-party websites:

• localStorage.getItem("wishverse_cached_count"): Caches the number of wishlist items so theme header count badges render instantly without waiting for an API call.
• localStorage.getItem("wishverse_settings_cache"): Caches storefront button styling and color settings locally to eliminate layout shifts (FOUC).
• sessionStorage.getItem("wishverse_guest_id"): Temporarily remembers a guest shopper’s wishlist items during an active browsing session.

These keys contain only product references and UI preferences. They are never used for cross-site behavioral retargeting.

WishVerse adheres rigorously to Shopify’s automated data protection lifecycle through mandatory webhook endpoints:

Depending on your jurisdiction, you and your customers have statutory rights regarding your personal information:

Shoppers wishing to exercise these rights should contact the Merchant directly (the Data Controller), who can manage the request via the Shopify Admin or contact our support team.

We enforce industry-standard security safeguards to protect stored and transmitted data:

• TLS / HTTPS Encryption: All communications between merchants, shoppers, Shopify servers, and our application utilize 256-bit TLS/SSL encryption in transit.
• Shopify App Bridge Authentication: We use session token validation and Shopify HMAC signature verification for all incoming API calls and webhook requests to prevent tampering.
• Database Hardening: Database connections are restricted by IP whitelisting, firewalled, and encrypted at rest with regular automated backups.
• Principle of Least Privilege: Access to backend application logs and database records is strictly restricted to authorized engineering personnel for debugging purposes only.

We may periodically update this Privacy Policy to reflect enhancements in our features, changes in Shopify API policies, or evolving international legal requirements. Any modifications will be posted directly to this URL with an updated "Last Updated" timestamp. We encourage merchants to review this page periodically.

If you have questions regarding this Privacy Policy, your data privacy rights, or wish to submit a data access or deletion request, please contact our dedicated Data Protection team: