Privacy Policy

PriceProof: EU Omnibus — Privacy Policy

Effective: 2026-07-04

Gyutae Oh (sole proprietor) ("we") provides the PriceProof: EU Omnibus Shopify app. This policy explains what personal data we process. We are an independent data controller for the limited account data described below. We do not collect, receive, or store your customers' (consumers') personal data.

1. What we collect

• Shop identifiers & owner contact: your myshopify domain, shop owner name and email, and the OAuth access token issued by Shopify at install. Used to operate the App, bill you, and provide support.
• Product & price data: product/variant identifiers, prices, currencies, and timestamps. This is commercial data, not personal data; it is the core input the App needs to compute the prior 30-day lowest price.

We do not request the orders or customers API scopes and do not process consumer personal data. Compliance webhooks that Shopify requires us to register (customers/data_request, customers/redact) may deliver a payload containing a customer identifier; we do not store the body of these payloads — we acknowledge receipt only.

2. Legal bases (GDPR)

Performance of our contract with you (providing and billing the App) and our legitimate interests in operating, securing, and supporting the service.

3. Where data is stored

Our servers are located in the European Union (Frankfurt, Germany), hosted on Fly.io. Your data does not leave the EU, so no third-country transfer mechanism (adequacy decision, Standard Contractual Clauses) is needed. Product/price data is not personal data.

4. Retention & deletion

We retain price history for as long as needed to provide the service (and for audit-evidence purposes you rely on), and at minimum long enough to compute the prior-price window. When you uninstall, Shopify sends a shop/redact request approximately 48 hours later; we permanently delete your shop's data within 30 days of receiving it.

5. Sharing

We do not sell your data and do not use data from one merchant for the benefit of another (no cross-merchant benchmarking). Subprocessors (hosting, error monitoring) act on our behalf under contract; a current list is available on request.

6. Your rights

You may request access, correction, deletion, or export of your account data, or object to processing, by contacting us at nsjokt@gmail.com. You may also lodge a complaint with a supervisory authority. We respond to requests within 30 days.

7. EU representative (Art. 27 GDPR)

An EU representative under Art. 27 has not yet been appointed. When appointed, their name and contact details will be listed here. Until then, contact us directly at nsjokt@gmail.com.

8. Contact

Controller: Gyutae Oh (sole proprietor), nsjokt@gmail.com

*A Korean-language version of this policy is available at PRIVACY_POLICY.ko.md (Korea PIPA §30).*