Privacy Policy
1. Who we are and our role
Navrel is an embedded Shopify application that lets merchants build automations: a trigger (a store event) optionally filtered by conditions, running one or more actions. For personal data belonging to a merchant’s customers, the merchant is the data controller and Navrel acts as a data processor on the merchant’s instructions.
2. Data we process
From the merchant’s store (to run automations):
- Customer personal data — name, email, phone, and address (shipping country/city/zip). We process these only to evaluate merchant-defined conditions and execute merchant-defined actions (e.g. tagging a customer, sending an email the merchant configured, posting to the merchant’s Slack/Discord/webhook).
- Order, checkout and product data — totals, line items, tags, timestamps, and identifiers used by triggers and conditions.
From the merchant (to operate the service):
- Shop domain, Shopify access tokens (encrypted), plan, and app configuration (the automations, conditions and actions the merchant creates).
- Automation run history.
We do not use customer personal data for our own marketing, we do not sell personal data, and we do not build cross-merchant profiles.
3. Why we process it (purpose & legal basis)
We process personal data solely to provide the Navrel service the merchant has configured. Our legal basis is the performance of our contract with the merchant and the merchant’s legitimate interests / consent as data controller.
4. Where it’s processed and how it’s protected
Processed and stored on Amazon Web Services in the United States (us-east-1). Safeguards: encryption in transit (TLS) and at rest, network isolation, least-privilege access, environment separation, audit logging, and automated backups.
5. Sub-processors
- Amazon Web Services — hosting, database, storage (US).
- Amazon SES — sending emails the merchant configures.
- Shopify — the platform the app runs on.
- Merchant-configured action destinations (e.g. Slack, Discord, or a webhook URL the merchant supplies) receive the data the merchant chooses to send them.
6. Retention
We retain automation configuration for as long as the app is installed, and automation run history for the period defined by the merchant’s plan (from 7 days on the Free plan up to 1 year on Pro). On uninstall or a shop/redact request, we delete shop data. On a customers/redact request we delete the associated customer data.
7. Data subject rights
Customers should contact the merchant (the controller) to exercise rights. We support merchants via Shopify’s mandatory privacy webhooks (customers/data_request, customers/redact, shop/redact).
8. Changes
We may update this policy; material changes will be notified to merchants.
9. Contact
3Bit Machine LLC
1021 E Lincolnway #7185, Cheyenne, WY 82001-4851, United States
privacy@navrel.io