Privacy Policy

Version privacy-v2026-10-21 · Last updated: October 21, 2026

1. Who we are

Souvely (“we”, “us”) provides Shopify apps under the Souvely brand, including:

This single privacy policy covers those apps and the marketing site at https://www.souvely.com. Use the www URL (not the apex domain alone) on Shopify App Store listings.

Contact: support@souvely.com

Merchants using Souvely: Returns & Exchanges also accept the Merchant Terms and Data Processing Addendum in the app admin. Merchants using Souvely: Commerce Intelligence are covered by the Commerce Intelligence Merchant Terms and the Commerce Intelligence DPA.

2. Who this policy covers

Shopify also processes data under its own privacy policy when you use Shopify.

3. Souvely: Product Personalizer — data we collect

From merchants (via Shopify): shop domain and settings; products, variants, collections, and themes; order and line-item information needed to show personalization for fulfillment; staff context needed to run the embedded admin app. We request only the scopes required to operate the app.

From store customers: personalization text; uploaded images; layout choices (position, size, rotation, fonts, side); generated preview images; and limited technical data (such as IP address or device information) needed to deliver the app proxy and uploads securely.

From website visitors: when you browse souvely.com we may collect limited technical data (such as IP address or device information) needed to serve the site securely. The custom development inquiry at /services collects your name, business email, Shopify store URL, project type, project description, estimated budget, and desired timeline so we can reply about a project. That inquiry is emailed to support@souvely.com. It does not ask for a shop’s customer list.

Payment data: we do not process card payments. Checkout is handled by Shopify.

4. Souvely: Returns & Exchanges — data we collect

This app processes protected customer data needed to look up orders, run the return portal, apply eligibility rules, and notify shoppers. We request Shopify scopes including products, orders, returns, customers (read), locations, fulfillment orders, and files, as required to operate the app.

Shopper email: collected when a shopper enters it in the returns portal to look up an order and to receive status notifications. Email may also be used to match an order when Shopify provides order/customer email for that shop.

Order and line items: order identifiers and names, line-item / fulfillment-line identifiers, titles, quantities, SKUs, prices/currency, and return reason/resolution choices needed to create and manage returns and exchanges.

Return photos: images shoppers upload when a return reason requires a photo (stored via Shopify Files / app storage references).

Customer id and tags: Shopify customer id (GID) and customer tags, plus product/order tags, used to evaluate merchant return rules. Merchants may also add internal operational tags on a return in the admin (not Shopify customer tags).

Country code: shipping-address country code (for example countryCodeV2) used for country-based return rules. We do not collect phone numbers or street addresses.

Customer name: we do not collect customer name from Shopify for this app.

Merchant admin access: shop domain, session/staff context for the embedded admin, portal branding settings, return reasons/rules, and return-request records merchants review and process.

Email delivery (Resend): when configured (RESEND_API_KEY), return-related notifications (such as status, refund, or store-credit notices) are sent through Resend to the shopper email on the return request. Delivery metadata (recipient, subject, status) may be logged.

Compliance webhooks: we handle Shopify’s mandatory customers/data_request, customers/redact, and shop/redact webhooks, plus uninstall cleanup.

Purposes: authenticate portal access; evaluate eligibility; create and process returns/exchanges/refunds/store credit; show merchants return details; send notifications; maintain security; and meet Shopify/legal requirements.

Retention / redact (high level): return data is kept while the merchant uses the app and as needed to fulfill returns and support. On customers/redact, we clear customer email/name/note/customer id on matching return requests and delete related customer uploads. On uninstall or shop/redact, we delete or remove shop-owned return data within a reasonable period, except where retention is required for legal, security, or dispute reasons.

5. Souvely: Smart Promotions — data we collect

Smart Promotions is a different product (promotions and discounts rather than returns), but it is operated by the same Souvely brand/legal entity and is covered by this policy URL. It uses scopes such as products, orders, discounts, cart transforms, and markets—not read_customers.

From merchants (via Shopify): shop domain and admin session context; product and collection catalog data synced for suggestions and targeting; discount and promotion configuration; markets-related settings needed for targeting; and order summaries used for promotion analytics and suggestions.

Synced order data: order identifiers, order name (for example #1001), totals/currency, processed time, and line-item product/title/quantity /price fields. We do not store shopper email, phone, or street address as primary fields for this app.

Storefront / checkout targeting (ephemeral): to evaluate promotion eligibility, the storefront and Shopify Functions may use logged-in status, customer id, order count, merchant-defined customer tags, country/market codes, and similar targeting signals. Merchant-configured tag lists live in promotion settings; we do not use this app to store shopper email or phone.

Promotion events: attribution events may reference an order id and revenue for analytics (for example after orders/create).

Compliance webhooks: we handle customers/data_request, customers/redact, and shop/redact. Customer redact removes synced orders listed in the webhook and clears related promotion-event order references. Shop redact / uninstall removes promotions, sync data, and sessions for that shop.

Purposes: create and apply promotions; sync catalog/order aggregates for suggestions; attribute promotion performance; run A/B experiments where configured; maintain security; and meet Shopify/legal requirements.

6. Souvely: Quotes & B2B — data we collect

Quotes & B2B processes customer and quote data needed to accept quote requests, let merchants prepare and send quotes, provide a customer portal, send notifications, and convert accepted quotes into Shopify draft orders / orders. We request only the Shopify scopes required to operate the app (products, draft orders/orders, and related admin context).

Quote cart / customer fields: name, email, company, phone, purchase order (PO) number, tax identifiers, notes, and shipping/billing addresses when the shopper (or merchant) provides them on the quote request form. Merchants configure which fields are required or optional.

Quote lines and commercial terms: product/variant references, titles, quantities, SKUs, unit prices, discounts, shipping/tax amounts or modes, currency, payment terms / deposits configuration (where enabled), file uploads attached to a quote when used, and merchant/customer notes on the quote.

Portal tokens: secure, quote-scoped access tokens (and related URLs) so buyers can view and respond to a quote in the customer portal without merchant-admin access. Tokens are used only to authorize portal access to that quote.

Email delivery (Resend): quote lifecycle and merchant notification emails are sent through Resend when configured (RESEND_API_KEY), typically from a Souvely Quotes sender such as quotes@mail.souvely.com. Delivery metadata (recipient, subject, status) may be logged.

Draft orders / orders (Shopify): when a quote is converted, we create or update Shopify draft orders (and related order records as checkout completes) via the Shopify Admin API. Card payments are handled by Shopify Checkout — we do not store card numbers or payment credentials.

Rules and shop settings: product/collection eligibility and quote rules, custom field definitions, branding/support email settings, and staff/assignment settings needed to run the merchant admin.

Compliance webhooks: we handle Shopify’s mandatory customers/data_request, customers/redact, and shop/redact webhooks, plus uninstall cleanup for shop-owned quote data.

Purposes: accept and manage quote requests; authenticate portal access; notify merchants and customers; convert quotes to draft orders; enforce eligibility rules; maintain security; and meet Shopify/legal requirements.

Retention / redact (high level): quote data is kept while the merchant uses the app and as needed to fulfill quotes and support. On customers/redact, we remove or anonymize customer personal fields on matching quotes. On uninstall or shop/redact, we delete or remove shop-owned quote data within a reasonable period, except where retention is required for legal, security, or dispute reasons.

7. Souvely: Commerce Intelligence — data we collect

Commerce Intelligence is a merchant admin app. It reads Shopify orders, products, discounts, and inventory so the merchant can see estimated contribution. It is not a shopper portal. The App requests read-only scopes for products, orders, discounts, and inventory. It does not request read_customers, and it does not request scopes that write discounts or change prices.

From the merchant’s Shopify store: shop domain; order identifiers and order name; shop and presentment currency; gross, discount, net, shipping, and tax money totals; financial status and processed or cancelled times; line-item product and variant identifiers, SKU, title, and quantities; discount application type, title, code, and allocation; refund and adjustment totals tied to an order; and inventory unit cost when Shopify provides it.

Merchant configuration: cost entries and cost policy, profit-alert rules, in-app notifications, recommendation records, experiment plan drafts, and advisor question logs. Experiment plans are drafts. The App does not publish them as Shopify discounts.

Customer name, email, phone, and street address: the App does not request or store those protected customer fields for its features. Order name (for example #1001) and product titles are stored because they identify the order and the merchandise, not the shopper’s contact details.

Advisor model, if enabled: a paid advisor can send a merchant’s question and the shop evidence used to answer it to an OpenAI-compatible chat provider. That path is off unless Souvely has explicitly enabled and approved paid advisor API calls for the deployment. It is not used for advertising.

Compliance webhooks: we handle customers/data_request, customers/redact, and shop/redact. A customer data request reports that this App stores order economics and not customer contact fields. A customer redact deletes the matching order’s economic records for that shop. Shop redact and uninstall delete shop-owned ledger, cost, alert, recommendation, advisor, experiment, billing, and session records.

Purposes: build an estimated contribution ledger; show product and promotion views; evaluate merchant-configured alerts; answer advisor questions from shop data; store experiment plans as drafts; secure the App; and meet Shopify compliance requirements. Figures are estimates. They are not accounting profit and they are not a promise of promotion-incremental profit. The App does not sell personal information and does not change Shopify discounts.

Retention / redact (high level): shop data is kept while the merchant uses the App. On customers/redact, matching order economics are deleted. On uninstall or shop/redact, shop-owned App data is deleted, except where retention is required for legal, security, or dispute reasons.

8. How we use data

We do not sell personal information. We do not use personalization content, return photos, promotion data, quote contents, or Commerce Intelligence order economics for third-party advertising.

9. Sharing / processors

We may share data with:

10. Storage and retention

Data is stored on our cloud infrastructure and, where applicable, Shopify Files or image hosting providers. Content is retained as needed for merchants to fulfill orders, process returns, run promotions, process quotes, estimate contribution, and use the apps, and may be deleted when the merchant uninstalls or requests deletion, or when Shopify compliance webhooks require redaction—subject to legal or backup limits.

11. International transfers

Data may be processed in the United States or other countries where we or our processors operate. Where required, we use appropriate safeguards for cross-border transfers.

12. Security

We use reasonable technical and organizational measures (HTTPS, access controls, least-privilege app scopes). No method of transmission or storage is 100% secure.

13. Merchant responsibilities

Merchants are responsible for their own privacy notices to store customers, lawful use of personalization, returns, promotion, and quote features (including uploaded content, targeting rules, and quote form fields), and correct app/theme configuration. Merchants using Commerce Intelligence are responsible for the costs they enter and for not treating estimated contribution as accounting profit or as a Shopify-endorsed result.

14. Your rights

Depending on your location, you may have rights to access, correct, delete, or export personal data, or object to certain processing. Store customers should contact the merchant first; merchants can contact us at support@souvely.com with the shop domain and which Souvely app is involved.

15. Children

Our apps are not directed to children under 13 (or the age required by local law). We do not knowingly collect children’s data.

16. Uninstall / deletion

When a merchant uninstalls an app, we stop processing new data for that shop in that app and delete or anonymize stored shop data within a reasonable period, except where retention is required for legal, security, or dispute reasons. Shopify compliance webhooks (customers/data_request, customers/redact, shop/redact) are honored as described in the app sections above.

17. Changes

We may update this policy. We will change the “Last updated” date and, when appropriate, provide additional notice via the app or listing.

18. Contact

Privacy questions: support@souvely.com
Apps: Souvely: Product Personalizer; Souvely: Returns & Exchanges; Souvely: Smart Promotions; Souvely: Quotes & B2B; Souvely: Commerce Intelligence
Privacy policy URL (use this on App Store listings): https://www.souvely.com/privacy
Website: https://www.souvely.com