Privacy notice

Last updated: 20 September 2026.

Who operates the app

Gerard Botines Rates, NIF 43748974F, Carrer la Teuleria, 25110 Alpicat, Lleida, Spain, operates EU PID Ready. Contact support@eupidready.com for privacy questions or requests.

Information processed

The app processes your Shopify shop identifier, installation and authentication information, access tokens, plan status, setup preferences and the product and variant data needed for identifier checks. Shopify authentication may provide staff account identifiers, names and email addresses. Tokens are used by the server to access the authorized shop.

Supplier imports contain the column selections, relevant row values, match decisions, proposed changes and results you provide. The app records readiness results and audit information about identifier changes. It does not request access to Shopify orders or customer records.

Support correspondence contains information you choose to send. Website and hosting systems may process network and security information such as IP addresses and request times.

Purposes and roles

We use this information to provide and secure the service, authenticate installations, check plan access, process confirmed changes and respond to support requests. We process shop data on the merchant’s instructions. For our own service administration and support, the applicable bases are performance of our agreement, legitimate interests in operating and securing the service, and legal obligations where applicable.

Service providers and data locations

• Shopify provides installation, authentication, authorized catalog access and plan information.
• Render hosts the web application, background worker, managed PostgreSQL database, backups and operational logs. Our application services and database use Render’s Frankfurt region. PostgreSQL is the database software, not a separate recipient.
• Cloudflare provides DNS and Email Routing for our domain. Web DNS records are DNS-only: application traffic is served by Render. Support email is forwarded through Cloudflare to a Google Gmail mailbox, where correspondence is received and handled.
• GitHub hosts our private source repository and supplies deployment source to Render. Raw supplier files, merchant database exports and access tokens are not committed to this repository.

We do not sell personal information. The FlavorCloud adapter writes reviewed destination metafields in Shopify. It does not directly transmit data to a FlavorCloud API, or send orders or customs declarations; another installed integration may separately read those Shopify fields.

Frankfurt hosting does not mean every provider processes all information only in the EEA. Provider support, account systems, email services and subprocessors may involve processing outside the EEA. Applicable arrangements depend on the service and account terms. You can request details about recipients and applicable transfer safeguards from our privacy contact.

Provider information: Shopify privacy, Render privacy and data processing addendum, Cloudflare privacy, Google privacy, and GitHub privacy.

Data retention

Raw supplier file bytes are not retained permanently. Parsed cells are retained while awaiting column mapping; after mapping, only relevant values and import records remain. Installation records, results and audit data remain while the app is installed. Processing the uninstall or shop-redaction webhook removes local shop and session data. Merchant-owned canonical identifier metafields in Shopify are not deleted by uninstall.

Support communications are retained for up to 24 months after the last interaction, unless a longer retention period is required for legal, security, fraud-prevention, or dispute-resolution purposes. Deleted data may remain in restricted backups until those backups expire; restored systems must reapply deletions before returning to service.

Completed or skipped product-event records older than 30 days are pruned when a new product event is received; pending events remain for recovery. Import decisions, audit records and readiness data do not have a separate automatic age-based expiry while the app remains installed. Backup and hosting-log retention follow the configured provider plan; a deletion request does not instantly remove restricted historical backups.

Your rights

Depending on the applicable law and processing basis, you may request access, correction, deletion, restriction, portability or object to processing. Contact us using the address above; we may need to verify your identity. You may complain to the Spanish Data Protection Agency (AEPD) or your competent supervisory authority.

Changes

This page will be updated when the service or its processing changes. The date above identifies this version.