1. Introduction
Welcome to PPWR Compliance. We are committed to protecting the privacy of merchants. This Privacy Policy describes how we collect, use, and share information when you install and use our App on your Shopify store.
2. Information We Collect
Our App is a packaging responsibility and evidence workspace for Shopify merchants selling into the EU. To provide these services, we process the following data:
- Store Information: Your store name/URL, and the shop domain used to identify your tenant.
- Order Data: Order-level aggregation (destination country, packaging weight/material) that you import from your Shopify admin for packaging compliance calculations.
- Packaging Data: Product packaging bills of materials (materials, weights, codes) that you enter, plus supplier evidence references (file names or links you record — files themselves are not uploaded).
- Registration Data: Official registry lookup results (LUCID, IDU, CONAI) that you record with timestamps and source URLs.
3. Data Storage
Your data is stored in a dedicated PostgreSQL database, isolated per store tenant. We do not share your data across merchants.
4. Data Sharing
We do not sell your personal data. We share data only with the following processors, strictly to operate the App:
- Supabase (managed PostgreSQL database hosting) — stores all merchant-provided data (questionnaire answers, packaging BOM, order aggregates, registration receipts).
- Render — hosts the App's runtime code and receives webhook events (HMAC-signed by Shopify) for processing.
- Shopify — provides order/shop data via the Admin API (read-only).
Error tracking (Sentry) is currently disabled. If subscription telemetry is ever enabled for commercial offerings, we will update this page and list the processor before data is shared.
5. Data Retention
We retain your data for as long as you use the App. When you uninstall the App, we delete your store data after 48 hours via the Shopify shop/redact webhook.
6. Your Rights
Under applicable data protection law (including the GDPR), you have the right to access, correct, or delete your data, and to object to or restrict processing. To exercise these rights, contact us at the email below.
7. Contact & Controller
The data controller for personal data processed under this policy is Zhang Ruilin(Guangzhou, China). For any data protection questions or requests (access, correction, deletion, portability, objection), contact us at: zhang.rainlam@gmail.com