How Reveu handles app data.

01

About this policy

Reveu provides review, customer-engagement, email-automation, storefront, moderation, import, and conversion tools to merchants who use Shopify.

This App Privacy Policy applies to information processed through:

• The Reveu embedded Shopify administration application
• Reveu Shopify theme app extensions and app embeds
• Storefront review widgets and rating displays
• Review-submission forms
• Review-request links and emails
• Review moderation and merchant replies
• Review reports and helpful votes
• CSV review imports
• Discount popups and engagement tools
• Reveu support and privacy workflows
• Application webhooks, queues, logs, and related systems

The public Reveu website has a separate Website Privacy Policy.

The Data Processing Overview provides additional information about the expected merchant–processor relationship.

02

Privacy roles

Merchant-controlled information

A Shopify merchant will typically determine why and how personal information relating to its customers, orders, reviews, communications, and storefront is used.

In those circumstances, the merchant normally acts as the controller or business responsible for the information, and Reveu processes it to provide the merchant-selected service.

The merchant determines matters including:

• Whether Reveu is installed
• Which Reveu features are enabled
• Who receives review-request emails
• When review requests are scheduled
• Which email templates and content are used
• Whether reviews require verification
• How reviews are moderated and published
• Whether customer photos are displayed
• Whether merchant replies are published
• Which reviews are imported
• How storefront widgets are configured
• Whether discount or engagement tools are enabled

Information controlled by Reveu

Reveu may act as an independent controller where it determines how and why information is used for its own legitimate operations.

This may include:

• Merchant administrator and support contact information
• Application installation and account records
• Security, fraud-prevention, and misuse records
• Service-performance and diagnostic information
• Privacy, legal, and compliance communications
• Records required to establish or defend legal claims

The precise legal role may depend on the processing activity and applicable law.

03

Information Reveu may collect

The categories of information processed depend on the merchant’s Shopify store, enabled features, permissions, and customer interactions.

04

Where information comes from

Reveu may receive information from:

• Shopify APIs, webhooks, app-proxy requests, and authorised application interfaces
• Merchants and authorised merchant users who configure or use Reveu
• Merchant-provided CSV files and other import material
• Customers who submit reviews, photos, forms, reports, votes, or popup entries
• Storefront visitors who interact with Reveu widgets
• Email-delivery, hosting, storage, security, and infrastructure providers
• Reveu’s own application systems, logs, and security controls
• Support, privacy, and legal communications

Where Reveu obtains customer information through Shopify or a merchant, the customer may not have provided the information directly to Reveu.

05

How Reveu uses information

Reveu may process information to:

• Install and connect the application to a Shopify store
• Authenticate stores and authorised application requests
• Save and apply merchant settings
• Collect ratings, written reviews, and customer photos
• Associate reviews with products and orders
• Determine or display verified-purchase status
• Moderate, publish, hide, report, or remove reviews
• Display review summaries, ratings, and review widgets
• Publish merchant replies
• Process helpful votes and review reports
• Schedule and send review-request emails
• Manage email suppression and opt-out records
• Customise and preview email templates
• Import and validate reviews from CSV files
• Match imported reviews with Shopify products
• Operate discount popups and engagement tools
• Provide customer and merchant support
• Maintain application reliability and performance
• Diagnose errors and failed processing
• Prevent spam, fraud, misuse, and unauthorised access
• Respond to privacy and data-protection requests
• Comply with Shopify requirements and applicable law
• Establish, exercise, or defend legal claims

Reveu does not sell merchant or customer personal information.

Reveu does not use merchant customer information for unrelated third-party behavioural advertising.

06

Lawful bases

The lawful basis for processing depends on the information, purpose, relationship, and applicable law.

Where Reveu acts for a merchant

The merchant is responsible for identifying and documenting the lawful basis for its collection and use of customer, order, review, marketing, and storefront information.

Reveu processes that information to provide the service in accordance with the merchant’s instructions, applicable terms, and the Data Processing Agreement.

Where Reveu acts as a controller

Reveu may rely on:

• Contract: processing required to provide the application, administer merchant access, communicate about the service, or respond to requested support.
• Legitimate interests: operating, securing, maintaining, improving, and protecting Reveu; preventing misuse; understanding service performance; and managing business communications.
• Legal obligation: processing required to comply with applicable legal, regulatory, tax, accounting, security, or privacy obligations.
• Consent: processing based on a freely given permission where consent is appropriate and required.

Where legitimate interests are used, Reveu considers whether those interests are outweighed by the rights and interests of the affected person.

07

Review-request emails

Merchants may configure Reveu to send review-request emails after an order has been fulfilled.

To provide this feature, Reveu may process:

• The customer’s name and email address
• The relevant order and fulfilment date
• Purchased products and variants
• The merchant’s configured delay and template
• The customer’s recorded marketing or communication preference
• Delivery, failure, suppression, and submission status
• A signed or otherwise protected review-request link

Reveu may check the marketing or communication preference recorded in Shopify when deciding whether a configured request should be sent.

The merchant remains responsible for determining whether it has an appropriate legal basis to send review requests and for complying with applicable direct-marketing, electronic- communications, privacy, and consumer-protection requirements.

Customers may use an unsubscribe or suppression option where provided. Reveu may retain a limited suppression record so that a previous opt-out can continue to be respected.

08

Reviews, photos, and public content

Customers may submit ratings, written reviews, names, email addresses, and photos through Reveu-powered forms.

Depending on the merchant’s configuration and moderation decision, published content may include:

• The reviewer’s displayed name
• The rating
• The review title and written review
• Customer-submitted photos
• The review date
• Verified-purchase indicators
• The merchant’s public reply
• Helpful-vote information

Published review content may be visible publicly on the merchant’s storefront and may be indexed, copied, shared, or cached by third-party services outside Reveu’s control.

A reviewer should submit only information and media they are authorised to share. Reviewers should avoid including passwords, payment information, private addresses, or unnecessary information about another person.

The merchant controls whether review content is approved, hidden, removed, or replied to. Reveu may also restrict or remove content where necessary to protect the service, comply with law, or address abuse.

09

Verified reviews and matching

Reveu may use order, product, customer, and review-request information to determine whether a review can be presented as connected to a purchase.

Verification may be established through:

• A review-request link connected to an eligible order
• A protected review token
• Matching a review to relevant order and product data
• Merchant-approved verification information

A verification indicator means that Reveu identified a qualifying connection using the available information and configured verification rules. It does not guarantee that every statement in the review is accurate.

Reviews submitted without a qualifying match may be displayed without a verified-purchase indicator or may be restricted by the merchant’s review policy.

10

Storefront widgets and engagement tools

Reveu may provide storefront features including review lists, star ratings, rating summaries, sorting, filtering, review forms, helpful voting, reports, and discount popups.

When a visitor interacts with these features, Reveu may process:

• The submitted review or form information
• The product or page associated with the interaction
• The date and time of the interaction
• Technical request and security information
• Limited identifiers needed to prevent duplicate activity
• Popup submissions and marketing preferences
• Discount-delivery or redemption-related information

Essential browser storage or similar technical mechanisms may be used where required to operate, secure, or remember the state of a storefront feature.

The merchant is responsible for describing its own use of storefront technologies in its privacy and cookie information where required.

11

How information is shared

Reveu may disclose information to:

• The relevant Shopify merchant: to provide review, order, moderation, email, import, storefront, support, and privacy functionality.
• Shopify: through the platform, APIs, webhooks, app administration, theme extensions, and privacy processes.
• Storefront visitors: when a merchant publishes a review, reviewer name, photo, rating, verification indicator, or merchant reply.
• Service providers: where required for hosting, databases, storage, email delivery, networking, monitoring, security, or support.
• Professional advisers: including legal, accounting, insurance, security, or compliance advisers where reasonably necessary.
• Authorities and other parties: where disclosure is required by law or reasonably necessary to protect rights, safety, security, or the service.
• A business successor: in connection with a proposed or completed merger, acquisition, financing, reorganisation, or transfer of the relevant business or assets.

Reveu does not sell merchant or customer personal information.

12

Service providers and subprocessors

Reveu uses third-party services to operate and support the application.

Provider categories may include:

• Shopify platform and application services
• Application-hosting providers
• Database providers
• File and review-media storage providers
• Email-delivery providers
• Queue, cache, or background-processing providers
• Domain, DNS, network, and content-delivery providers
• Error-monitoring and security providers
• Technical-support and operational providers

These providers may process information only to provide their contracted services, support Reveu’s operations, protect the service, or comply with applicable law.

A current application subprocessor list, including provider purposes and relevant processing locations, will be made available before general release and may be requested by emailing hello@reveu.me.

13

International data transfers

Reveu operates from England, United Kingdom. Shopify and other service providers may process information in the United Kingdom, European Economic Area, United States, Canada, or other countries where they operate.

Where applicable law restricts an international transfer, Reveu will use an appropriate mechanism and safeguards.

These may include:

• UK adequacy regulations
• The UK International Data Transfer Agreement
• The UK Addendum to approved standard contractual clauses
• European Commission standard contractual clauses
• Another legally recognised transfer mechanism

Information about applicable safeguards may be requested by contacting Reveu. Some details may be redacted where necessary to protect confidential or security-sensitive information.

14

Retention and deletion

Reveu keeps information only for as long as reasonably necessary for the relevant purpose, merchant instruction, security requirement, contractual obligation, or legal duty.

Reveu may retain limited information where required by law, necessary to establish or defend legal claims, needed to prevent fraud or abuse, or required to honour an opt-out.

Information retained for those purposes will not be used for unrelated activities.

15

Security

Reveu applies technical and organisational measures intended to protect information against unauthorised access, loss, misuse, disclosure, alteration, or destruction.

Measures may include:

• HTTPS-encrypted network connections
• Shopify webhook and app-proxy request verification
• Restricted application and database access
• Server-side processing for trusted operations
• Input, settings, import, and media URL validation
• Controlled production credentials and secrets
• Merchant-specific data separation
• Error, webhook, and queue failure handling
• Privacy, uninstall, and deletion workflows
• Service monitoring and security investigation
• Provider and infrastructure review

No internet-based service can guarantee complete security. Merchants must also protect their Shopify accounts, staff access, themes, devices, and connected services.

Additional information is available on the Security page.

16

Privacy rights

Depending on location, applicable law, and the processing activity, a person may have rights to:

• Request access to personal information
• Request correction of inaccurate information
• Request deletion of information
• Request restriction of processing
• Object to certain processing
• Request data portability
• Withdraw consent where processing relies on consent
• Complain to a data-protection authority
• Receive information about certain automated decisions where applicable

Customer and reviewer requests

Where information is controlled by a Shopify merchant, customers and reviewers should normally contact that merchant first.

Reveu will provide reasonable assistance to the merchant in responding to valid requests in accordance with applicable terms and law.

Merchant and Reveu-controlled information

Requests relating to information controlled directly by Reveu may be sent to hello@reveu.me.

Reveu may need to verify identity or authority before responding. Some rights are subject to legal exemptions and may not apply in every circumstance.

18

Shopify privacy and deletion requests

Reveu supports Shopify’s mandatory privacy request workflows, including:

• Customer data requests: helping identify information connected to a customer and relevant orders.
• Customer redaction requests: deleting or de-identifying relevant customer information where required.
• Shop redaction requests: deleting or de-identifying information associated with an uninstalled merchant store.

Reveu may retain limited information where continued retention is legally required or otherwise permitted, including restricted records needed for security, fraud prevention, dispute resolution, or opt-out compliance.

Privacy requests may also be submitted directly by an authorised merchant through the contact form or by emailing Reveu.

19

Automated processing

Reveu uses automated rules to operate application features. These may include:

• Scheduling review requests after fulfilment
• Checking communication preferences
• Matching reviews to products or orders
• Assigning verified-purchase indicators
• Applying merchant-selected auto-publication rules
• Checking review content against blocked-word settings
• Detecting invalid, duplicate, or abusive interactions

These processes support application administration and merchant-configured workflows.

Reveu does not currently use app information to make decisions based solely on automated processing that produce legal or similarly significant effects on customers.

Merchants may review, moderate, hide, publish, or remove review content through the application.

20

Children’s information

Reveu is a business application intended for Shopify merchants and is not directed to children.

Merchants are responsible for determining whether their products, stores, review requests, or storefront tools are directed to children and for applying any required parental consent, age-assurance, or child-specific privacy measures.

Contact Reveu if you believe personal information relating to a child has been processed inappropriately through the application.

21

Changes to this policy

Reveu may update this policy when the application, infrastructure, service providers, data practices, legal requirements, or Shopify requirements change.

The current version will remain available on this page. The “Last updated” date will be changed when material revisions are made.

Where appropriate, merchants may also be notified through the application, email, release notes, or another reasonable channel.