1. Scope and roles
This policy covers the website tidebird.io and the Tidebird apps for Shopify. Tidebird is operated by [COMPANY LEGAL NAME], [REGISTERED ADDRESS].
- Website visitors and merchants who install our apps: we decide how this data is used, so we are the controller.
- Shoppers in a merchant's store: the merchant is the controller. We process shopper data only on the merchant's instructions, as set out in our data processing addendum. Shoppers with questions should contact the store first.
2. What we collect
On tidebird.io
- Usage data collected by Google Analytics 4: pages viewed, referring site, device and browser type, approximate location (country or city) and a random cookie identifier. GA4 does not log or store IP addresses.
- What you send us when you email us: your name, email address and message.
When you install an app
- Store details from Shopify: shop domain, store name, plan, currency and locale.
- The store owner's or staff member's name and email address, as provided by Shopify.
- Your app settings, for example the gift product, the minimum spend and widget appearance.
- Technical logs: request times, errors and app events, used to keep the app working.
About shoppers
Tidebird Gift Lift reads the cart in the shopper's browser to show progress toward the gift, and Shopify applies the gift discount at checkout. [CONFIRM: Gift Lift does not store shopper names, emails, addresses or payment details on our servers.] Future apps (subscriptions, back-in-stock alerts) will need shopper contact details to work; we will update this policy before they launch.
3. Why we use it
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Provide and run the apps | Store details, settings, logs | Contract |
| Support and service messages | Name, email, messages | Contract |
| Security, abuse prevention, fixing bugs | Logs | Legitimate interests |
| Understand website traffic | GA4 usage data | Consent where required, else legitimate interests |
| Meet legal duties | As needed | Legal obligation |
We do not sell personal data and we do not use it for advertising profiles.
4. Cookies and Google Analytics
tidebird.io uses Google Analytics 4, which sets the cookies _ga and _ga_[ID] (up to 2 years) to tell visits apart. Visitors in the EEA, UK and Switzerland are asked for consent first, using Google Consent Mode [CONFIRM]. You can withdraw consent from the cookie settings link in the footer or block analytics with the Google Analytics opt-out browser add-on. The apps themselves do not set analytics cookies in your storefront.
5. Where data is stored
App data is hosted on Google Cloud Platform in the [REGION, e.g. europe-west1 (Belgium) or us-central1 (Iowa)] region. Website analytics data is processed by Google LLC. Where data moves outside the EEA or UK, we rely on the European Commission's Standard Contractual Clauses, the UK addendum, and Google's certification under the EU-U.S. Data Privacy Framework.
6. Who we share it with
- Service providers who process data for us under contract: Google Cloud (hosting, database, storage) and Google Analytics (website analytics). The current list is in the DPA.
- Shopify, as the platform the apps run on.
- Authorities, when the law requires it.
- A buyer of our business, if Tidebird is sold, under the same protections.
7. How long we keep it
- App data: while the app is installed. When you uninstall, Shopify sends us a deletion request (shop/redact) 48 hours later, and we delete the store's data within 30 days of it.
- Technical logs: [30] days.
- Google Analytics data: [14] months (GA4 retention setting).
- Support emails: [24] months after the conversation ends.
8. Your rights
Depending on where you live, you can ask to access, correct, delete or export your data, object to or restrict how we use it, and withdraw consent. Email [privacy@tidebird.io]; we answer within 30 days. You can also complain to your local data protection authority. For shopper data, we handle Shopify's customers/data_request and customers/redact requests for the merchant. California residents: we do not sell or share personal information as defined by the CCPA.
9. Security
Data is encrypted in transit (TLS) and at rest (Google Cloud default encryption). Access is limited to the people who need it, with two-factor sign-in. We ask Shopify only for the access scopes each app needs.
10. Children
Our website and apps are for businesses and are not directed at children under 16.
11. Changes
We will update the date at the top when this policy changes and tell merchants in the app or by email about important changes.
12. Contact
[COMPANY LEGAL NAME], [REGISTERED ADDRESS] · [privacy@tidebird.io]. EU/UK representative: [IF REQUIRED].