Privacy Policy

1 · Overview

This Privacy Policy explains how Obarito ("we", "us") handles information when you visit obarito.com or install one of our Shopify apps. Our apps are built to collect as little as possible and to keep your store's data under your control.

Rewindly, our first app, is a catalog change watchdog. It requests only the read_products and write_products Shopify scopes. It does not request, access, or store any Shopify customer personal information, order data, or payment details.

2 · Data we collect

To operate the app, we process:

Store & account data - your .myshopify.com domain, basic shop details Shopify provides at install, and an offline access token we use to call the Shopify Admin API on your behalf.
Product snapshots - when a product changes, Rewindly stores a snapshot of that product (title, description, price, variants, inventory, status, and similar fields) so it can show history and restore earlier versions.
App configuration - the alert rules and notification settings you create, including any email address or Slack destination you choose to send alerts to.
Usage & diagnostics - log data and error reports used to keep the service reliable.
Communications - messages you send us for support.

We do not collect Shopify customer names, emails, addresses, orders, or payment information.

3 · How we use it

To record product changes, surface suspicious edits, and restore versions.
To deliver the alerts and notifications you configure.
To operate, secure, maintain, and improve the app.
To provide support and respond to your requests.

We do not sell personal data and we do not use your store data for advertising.

We do not sell or rent your data. We share it only with the service providers needed to run the app, each bound by a data-processing agreement, and with destinations you choose (for example, your own Slack workspace or email address when you enable notifications):

Infrastructure providers - the cloud hosting, database, email, and notification services we use to run the app, each bound by a data-processing agreement.
Shopify - the platform your store and our API access run on, under Shopify's own terms.

We may also disclose data where required by law.

5 · Data retention & deletion

Product snapshots are retained for your plan's history window - 30 days on Free and 1 year on Pro - after which older snapshots are pruned automatically.
When you uninstall, your access token is revoked. Shopify then sends a shop/redact request 48 hours later, and we erase all of that store's data - every snapshot, alert, alert rule, and notification setting.
You can ask us to delete your data sooner using the contact below.

6 · Shopify data & mandatory webhooks

Because Rewindly does not access Shopify protected customer data, Shopify's Protected Customer Data requirements do not apply to it. We still follow data-minimization, encrypt data in transit and at rest, and limit retention as described above.

We implement Shopify's three mandatory compliance webhooks:

customers/data_request - we hold no customer personal data, so there is none to compile; we acknowledge and log the request.
customers/redact - we store no customer personal data, so there is nothing to erase.
shop/redact - we permanently delete all of the store's data, as described in Retention above.

7 · Your rights (GDPR / CCPA)

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. To exercise any right, contact us using the details below; the fastest route to deletion is to uninstall the app, which triggers the erasure flow above.

8 · Security

We protect data with encryption in transit and at rest, store your access token securely, and apply least-privilege access controls with regular review. No method of transmission is perfectly secure, but we work to protect your information and to notify you of material incidents as required by law.

9 · Contact

Questions or requests about this policy or your data: privacy@obarito.com. The data controller is Obarito. We aim to respond within a reasonable period.