Privacy Policy — Clevyre

Thank you for choosing Clevyre (hereafter called the "Company" or "we"). We are committed to protecting your personal data and your right to privacy.

We appreciate your decision to use our apps and website and to trust us with your valuable personal data. In this document, we seek to explain in the clearest terms possible our privacy practices. We strongly encourage you to read this document (and any other related documents) carefully before using our services. If there are any terms or conditions in this document that you do not agree with, please do not use our apps or website, or in case you are already using them, please discontinue use immediately. We also advise you to check this document from time to time for any changes that we may bring to be in line with the law and our privacy practices.

By using our apps or website, you are accepting and consenting to the practices described in this Privacy Policy.

1. Legal basis for processing

We will only use your personal data when the law allows us to do so. We will be using your personal data in the following circumstances:

To fulfil any contractual obligations that we have with you.
Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.
To fulfil any legal obligation.

To the extent we process your personal data for any other purposes, we ask for your consent in advance or require that our partners obtain such consent.

2. Data that we may collect about you

We may collect and process personal data about you. Personal data, or personally identifiable data, is any piece of data that can be used to identify a natural person. It does not include any data where the identity has been removed (also called anonymous data or de-identified data). We collect, store and use various personal data that can be found in the following table. For your convenience, we have also added the purpose of such data.

Purpose	Type of data	Lawful basis
To identify the Store and the Merchant, and provide data and services provided by us	Store name and URL	To perform contractual obligations we have with the customer
To send notifications and communicate with you	Email	To perform contractual obligations we have with the customer
For the functioning of our apps	Shop domain, theme information, and permissions required for each app's core functionality	To perform contractual obligations we have with the customer
To store and apply your app settings and preferences	Configuration data, settings	To perform contractual obligations we have with the customer
To ensure the security of our apps and website, detect and address technical issues	IP addresses, security fingerprints	To perform contractual obligations we have with the customer
For providing support to customers	Name and email address	To perform contractual obligations we have with the customer

We may also collect data that is not mentioned here. However, before doing the same, we will be getting your consent. Only after getting your consent, we will collect and process your personal data.

3. How do we collect the data?

We use different methods to collect the data including the following ways:

Direct interactions: You may provide us with information when you install our apps, configure settings, or contact our support team.
From third parties: We may collect data such as IP address, store name, URL, and email address from third parties, including your Shopify Partner account, AWS (where our Shopify app is hosted), and Cloudflare (where our website is hosted and assets are served).

4. Special categories of data

We do not collect, store or use any special categories of data about you. This means details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health, and genetic and biometric data are not collected, used or stored.

5. Cookies

Our website is hosted on Cloudflare, and our assets are served via Cloudflare CDN and R2 storage. Cloudflare may use strictly necessary cookies and similar technologies to maintain your session, protect against threats (such as DDoS attacks), and ensure the stability and security of our website. Our Shopify app is hosted on AWS Lambda (via SST) and does not set cookies on your store. We also use analytics cookies (Google Analytics and Hotjar) on our website to understand how visitors use it.

For detailed information on specific cookies, please refer to our Cookie Policy.

6. Third party sites and services

We use third party vendors to host and serve our services:

AWS (Amazon Web Services): Our Shopify app is hosted on AWS Lambda (using SST). AWS may process and store app data on our behalf. AWS Privacy Policy
Cloudflare: Our website is hosted on Cloudflare. Our assets (images, scripts, etc.) are served via Cloudflare CDN and R2 storage. Cloudflare may process and protect website traffic. Cloudflare Privacy Policy
Shopify: When you use our app, data flows through Shopify's platform. Shopify Privacy Policy

7. Disclosure to third parties

We may share your data with third parties for the purposes set out in this privacy policy. This may include the following:

Any member of our group, which means our subsidiaries, our ultimate holding company and its subsidiaries.
Business partners, suppliers and sub-contractors for the performance of any contract we enter into with them or you to provide services such as hosting services.
Professional advisors acting as service providers to us in relation to the Site or Services – including lawyers, bankers, auditors, and insurers who provide consultancy, banking, legal, insurance and accounting services.
Tax authorities, regulators and other authorities who require reporting of processing activities in certain circumstances.

8. International transfers

Our services are global and your personal data may be stored and processed in any country where we have operations, our staff are located or where we engage service providers engaged in, among other things, the fulfilment of your order or the provision of support services. This will involve a transfer of your personal data to countries outside of your country of residence, where data protection rules are different from those of your country of residence.

Processing of your personal data will involve a transfer of data to countries outside the European Economic Area ("EEA"), Switzerland or the UK.

We will take all steps reasonably necessary to ensure that your personal data is treated securely and in accordance with this Privacy Policy. In particular this means that your personal data will only be transferred to a country that provides an adequate level of protection (for example, where the European Commission or the UK Data Protection Authority ("ICO") has determined that a country provides an adequate level of protection) or where the recipient is bound by standard contractual clauses according to conditions provided by the European Commission or ICO.

9. Data security

We have taken appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. We limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know.

Our website is hosted on Cloudflare and our app runs on AWS Lambda. Data in transit is encrypted using TLS 1.3. Unfortunately, the transmission of information via the Internet is not completely secure. Although we will endeavour to protect your personal data, we cannot guarantee the security of your personal data transmitted to our site or the services. Any transmission is at your own risk. Once we have received your personal data, we will use strict procedures and security features to try to prevent unauthorised access.

We also engage with third parties to store the data that we collect from you or third parties. Please note that their privacy and security policies may differ from that of ours. Please refer to the links mentioned in "Third party sites and services" for more information.

10. Data retention

We retain the data that we collect from you for as long as it is necessary for us to fulfil the purposes for which it was collected or provided including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal data for a longer period in the event of a complaint, if we reasonably believe there is a prospect of litigation in respect to our relationship with you, to comply with law enforcement requests, maintain security, prevent fraud and abuse, resolve disputes, enforce our legal agreements, or fulfil your request to "unsubscribe" from further messages from us.

We will retain the data for as long as we provide access to the site or services to you, your account with us remains open or any period set out in any relevant contract you have with us. After you have closed your account or deleted our app for a period of 48 hours, we usually delete personal data.

We comply with Shopify's mandatory privacy webhooks: Customer Data Request (to provide stored data upon request), Customer Redact (to delete customer data upon request), and Shop Redact (to delete all merchant data within 48 hours of app uninstallation).

11. Your rights

Depending on the privacy law of your country you have the following rights:

Right to be informed: you have the right to be informed of the collection and use of your personal data
Right to access: you have the right to view and request for copies of the personal data that you have provided us
Right to rectification: You have the right to request inaccurate or outdated information be corrected or updated
Right to be forgotten/right to erasure: You have the right to ask your personal data be deleted. You have to note that this right is not absolute and may be subject to exemptions under certain laws.
Right to data portability: You have the right to ask for your data to be transferred to another controller or provided to you, in a machine readable, electronic format
Right to restrict processing: you have the right to restrict processing of your personal data
Right to withdraw consent: you have the right to withdraw consent to processing of your personal data. Please note that this may make us unable to serve you with our services.
Right to object to processing: You have the right to object to processing of your personal data. Exercising this right may affect our ability to provide you with our services.
Right to object to automated processing: You have the right to object to automated processing. This may also affect our ability to provide you with our services.

If you wish to exercise any of the above rights, please contact us. We will respond to such queries within 30 days and deal with requests we receive from you, in accordance with the provisions of the applicable Data Protection Law. Occasionally it could take us longer, if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we could refuse to comply with your request in these circumstances.

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

12. Complaints

If you have any complaints about our use of your personal data, please contact us or contact your local data protection supervisory authority.

13. Appropriate age

Our apps and services are intended for the use of people who are major in accordance with the applicable laws and may not be used by anybody who does not meet this criteria.

14. Changes to this privacy policy

Any changes we may make to our Privacy Policy in the future will be posted here and, where appropriate, notified to you by email. Please check back frequently to see any updates or changes to our Privacy Policy.

This Privacy Policy was last updated on 24 February 2026 and this version replaces any other Privacy Policy previously applicable from this date.

15. Contact

If you have any questions, comments, requests or complaints regarding our privacy policy or our privacy practices, kindly reach out to us using the following:

Clevyre
[Your Physical Business Address]
Email: Contact us