The short version. We collect only what our apps need to work: your store's basic details, your settings, and order totals for your results dashboard. We never collect your customers' names, emails or addresses. Our storefront code sets no cookies and does no tracking. We don't sell data, ever. When you uninstall, we delete your store's data.
Who we are
Lyravant (“we”, “us”) makes software for small businesses, including Shopify apps such as Lyravant: Free Shipping Bar. Lyravant is operated by Alex Naum, who is the data controller for the personal data described here. You can reach us at support@lyravant.com about anything in this policy.
What this policy covers
This policy covers our Shopify apps (currently Lyravant: Free Shipping Bar; “the apps”), this website, lyravant.com, and email you exchange with us.
When a merchant uses our apps, the merchant decides what happens on their store. For any shopper data an app touches on a merchant's behalf, the merchant is the controller and we act as their processor. In practice our apps are designed to avoid shopper personal data altogether (see Your shoppers).
What we collect
From merchants who install an app
| Data | Examples | Where it comes from |
|---|---|---|
| Store details | Store domain (your-store.myshopify.com), store name, store contact email, currency, time zone | Shopify, when you install and use the app |
| Staff session data | Access tokens Shopify issues to the app, and, for signed-in staff, the name, email, locale and account-owner flag Shopify attaches to the session | Shopify's sign-in, each time you open the app |
| App settings and state | Your bar styles, messages, thresholds, product picks, which features are on, setup progress, plan and billing status, whether we've asked for a review | You, in the app |
| Order data, limited | For orders in the last 30 days: order ID, subtotal, currency, the titles of automatic discounts applied, and cart attributes our blocks set | Shopify's orders API, for your results dashboard |
| Product references | IDs and titles of the products and collections you pick in the app | You, via Shopify's product picker |
We do not collect customer names, email addresses, phone numbers, postal addresses or payment details. Our order queries simply don't request those fields. Billing is handled entirely by Shopify; we never see your card or bank details.
From anyone who emails us
Your email address, name if you give it, and whatever you write to us, so we can reply.
From visitors to this website
Nothing beyond what any web server sees. lyravant.com has no analytics, no advertising, no cookies and no third-party scripts or fonts. Our hosting provider processes standard request data (IP address, browser user agent, page requested) to serve the site and keep it secure, and may keep short-lived server logs.
Your shoppers (storefront)
Our storefront blocks are delivered by Shopify as part of your theme. Shoppers' browsers never contact our servers. Our storefront code:
- sets no cookies and does no tracking, profiling or analytics;
- may keep a small flag in the browser's session storage (for example, so the same moment isn't recorded twice), which never leaves the shopper's browser and is cleared when the tab closes;
- adds a hidden cart attribute (such as which feature was used) to the shopper's cart, so the merchant's results dashboard can count orders. It contains no personal information;
- uses Shopify's own storefront features (cart, product recommendations) on the merchant's domain.
Why we use it
- To run the apps: sign you in, save and apply your settings, show your features on your store, and apply quantity discounts through Shopify.
- To show your results: calculate what the app helped sell in the last 30 days.
- To bill you correctly: track your plan, trial and founding-price status (Shopify does the charging).
- To support you: answer emails and fix problems.
- To keep the apps secure and working: detect abuse, debug errors, and verify that requests really come from Shopify.
- To communicate about the app: service messages and, occasionally, onboarding emails or a request for a review. We never offer anything in exchange for a review.
We don't use your data for advertising, and we don't build profiles of you or your shoppers.
Legal bases (GDPR and UK GDPR)
- Contract: providing the apps you install, including settings, results and billing status.
- Legitimate interests: security, fraud prevention, debugging, improving the apps, and occasional product emails to merchants. You can object at any time.
- Legal obligation: keeping records we're required to keep, and responding to lawful requests.
- Consent: where we ask for it, which you can withdraw at any time.
Who we share it with
We don't sell or rent personal data, and we don't share it for cross-context behavioral advertising. We use a small number of service providers (subprocessors) who process data only on our instructions:
| Provider | What they do | Data involved |
|---|---|---|
| Shopify | Platform the apps run on; sign-in, APIs, billing, storefront delivery | All app data, as part of your Shopify store |
| Railway | Application hosting, including our database; also hosts this website | Store details, sessions, settings, order aggregates, server logs |
| Cloudflare | Domain name (DNS) and email routing for lyravant.com | DNS queries; email to our addresses passes through its routing |
| Google (Gmail) | Our support mailbox | Emails you send us |
We may also disclose data if the law requires it, to protect rights and safety, or as part of a merger or sale of the business (in which case this policy continues to apply).
International transfers
We and our providers may process data in the United States and other countries. Where data from the EEA, UK or Switzerland is transferred, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or the provider's certification under the EU-U.S. Data Privacy Framework.
How long we keep it
- While installed: we keep your store details and settings for as long as the app is installed.
- Raw order references (order IDs used to compute your results) are kept no longer than 90 days.
- Aggregated results (totals and counts, no order-level detail) are kept no longer than 13 months.
- After you uninstall: staff sessions and access tokens are deleted when Shopify notifies us of the uninstall. Shopify then sends a shop data deletion request (
shop/redact) 48 hours later, and we delete everything else for your store within 48 hours of receiving it. - Support emails are kept as long as needed to help you, then deleted within 2 years of the conversation ending.
Settings stored by Shopify in your store's app data are removed by Shopify along with the app.
Security
All data is encrypted in transit (HTTPS/TLS) and at rest in our hosting provider's database storage. Access is limited to the people who run Lyravant, protected by strong authentication. Every request from Shopify is verified with Shopify's signatures, and we request only the permissions the apps need (currently: read orders, read products, write discounts). No method is perfectly secure, but we take care proportionate to the data we hold, and we'll notify you and the relevant authorities of a breach as the law requires.
Your rights
Depending on where you live, you can ask us to: access the personal data we hold about you; correct it; delete it; restrict or object to how we use it; receive a portable copy; and withdraw consent. You can also complain to your local data protection authority, though we'd appreciate the chance to help first.
Email support@lyravant.com with your request. We'll verify it's really you (usually by replying from the store's contact email) and respond within one month, or sooner where the law requires.
Shopify privacy requests. We honor Shopify's mandatory privacy webhooks. For customers/data_request and customers/redact, our apps hold no customer personal data to return or delete; we confirm this to the merchant on request. For shop/redact, we delete all data for the store as described above. If you're a shopper, please contact the store you bought from; we'll help them with any request.
California residents (CCPA/CPRA)
In the last 12 months we have collected the categories described in What we collect: identifiers (store domain, email), commercial information (limited order totals), and internet activity limited to server logs. We use them only for the business purposes listed above. We do not sell or share personal information, and we do not use or disclose sensitive personal information. You have the right to know, delete and correct, and we won't treat you differently for exercising them. You may use an authorized agent. Email support@lyravant.com to make a request.
Children
Our apps and website are for businesses and are not directed to children under 16. We don't knowingly collect their data.
Changes to this policy
If we change this policy, we'll update the date at the top. For material changes, we'll tell installed merchants in the app or by email before they take effect.
Contact
Lyravant (Alex Naum), support@lyravant.com.