Firesio ("we") explains how it handles personal data in connection with Team Up, a Shopify app for group and team orders. It applies to merchants who install the app and to the shoppers who join a team order.
What personal data do we collect?
From merchants: the store's domain and the access token Shopify issues when the app is installed; the store name, the account owner's email address, the store's contact email, logo, public URL and time zone, which Shopify provides; the plan, trial and renewal dates Shopify reports for the subscription; any extra email addresses the merchant asks us to copy on order mail; and the messages, email address and attachments in any support request the merchant sends us. From organizers who start a team order: their name and email address, the email addresses they invite, and their answers to the questions the merchant set up. From team members who join a team order: the name they enter, an optional email address, the products, options and quantities they choose, and their answers to the merchant's questions (for example a player name or number), including any file they attach. We also keep a delivery record of each email we send (the recipient address, the type of message and whether it was delivered). Our servers log basic request data, such as IP address and timestamps, for security and troubleshooting. We do not use advertising trackers. The product video on our home page is hosted on YouTube and loads, from YouTube's privacy-enhanced domain, only if you press play. From shoppers who log in to the store's customer account to use the store's team orders page: the Shopify customer ID that Shopify passes to us with each request from that page, never a password.
What do we keep about shoppers who use the store's team orders page?
A store can show a Team Up page on its own website, opened through a Shopify app proxy, where shoppers start, join and manage team orders. Logging in there is optional and uses the store's own customer login: we never see or store a password. When a shopper is logged in, Shopify tells us their customer ID with each request, and we store that ID with the orders they organize, the entries they add and the invitations they claim, so the page can show them their own orders and so an invitation is used by one account only. We do not receive the customer's email address from Shopify for this; the names and addresses people type into a form are kept as described above. The page also keeps a few items in the visitor's own browser, in local and session storage, never in cookies: the name and email last typed (offered again only to the same logged-in customer, or to a guest, and forgotten after 30 days or when the visitor presses "Not you? Clear"), the last orders opened on this device, and forms that are half filled in. None of it is sent anywhere until the visitor submits the form, and clearing the browser's site data removes it.
What do we read from and write to your Shopify store?
With your approval at install, we read your products, variants, collections, prices and images so a team order shows what your store sells. We read your live theme's template files only to check whether the Team Up button has been added. We create, read and delete draft orders for team orders and ask Shopify to send the invoice for them. A draft order we create carries the organizer's email address, the products, quantities and prices, and the team members' answers to your questions as line item properties (for example a player name or number). We ask for permission to read orders for one purpose: so Shopify can tell us when an order is paid. We subscribe to Shopify's order-paid notice, and in each notice we look only for the reference that marks an order as made from one of our draft orders; we ignore the rest of the notice, including any details about the buyer, and we do not store it. We then confirm the payment by checking the status of the draft order with Shopify. We do not use order or customer records for anything else. The Shopify notices we subscribe to are order paid, app uninstall, a change to the app's permissions, and Shopify's three mandatory privacy requests.
Why do we collect it, and what do we do with it?
We use this data to run each team order: to build the live roster and production sheet, to create the consolidated draft order in the store and see when it is paid, to send the invite, join-confirmation and order emails, deadline reminders and progress updates, to keep the app secure, and to answer support requests. We do not sell personal data, use it for advertising, or make automated decisions with it.
Who do we share it with?
We share data only with the service providers that run the app, acting on our instructions. Shopify receives what the app writes to your store, as described above, and sends the invoice email for a draft order. Cloudflare hosts the app, stores its data in Workers, D1, KV and R2, and delivers our email. Cloudflare Workers AI may process the text of a support conversation so that our staff can draft a reply; a person reads and edits every draft before it is sent. If you press play on the video on our home page, YouTube serves it and receives your request. We may also disclose data where the law requires it. We never share it with anyone else.
What is our role, and what is the merchant's?
For personal data that belongs to a merchant's customers, which includes the organizers and team members of a team order, the merchant is the data controller and Team Up acts as a data processor. We process that data only on the merchant's instructions and only to provide the app's features, we keep it encrypted in transit and at rest, we apply the retention and deletion described below, and we support the merchant in responding to data subject requests through Shopify's mandatory privacy requests.
Where is it stored, and for how long?
Data is stored on Cloudflare's infrastructure. Shopify session tokens are kept in Cloudflare KV. Team-order data (rosters, selections, team member and organizer contact details, invites, and the delivery record of our emails) and support requests are kept in a Cloudflare D1 database, and files attached to answers and to support requests are kept in Cloudflare R2. We keep this data for as long as the app is installed. When you uninstall, we delete the store's access tokens at once. Shopify sends a shop/redact request 48 hours after an uninstall, and we erase everything we hold for that store when it arrives, promptly and always within the 30 days Shopify allows. When Shopify sends a customers/redact request, we replace the matching team member's name, remove their email address, answers, invites and attached files, and remove the name and email of an organizer from the orders they organized; the items and quantities stay so the store's order remains accurate. When Shopify sends a customers/redact request, we also replace the recipient address in the delivery records of that store's emails with a placeholder; the record of the message type, the time and whether it was delivered stays. Any remaining delivery records are erased when the store is erased. The email address that comes with a privacy request is kept only until the request is completed, and is deleted after 30 days in any case. After an erasure we keep only a one-way hash of the store's domain, so late or repeated requests cannot bring the erased data back.
How do we keep it secure?
Data travels over encrypted connections and is stored on Cloudflare's platform. We verify Shopify's session tokens and webhook signatures before acting on a request. Access to production data is limited to what operating the app requires. No system is perfectly secure, so if we learn of a breach affecting personal data, we will tell the affected merchants without undue delay.
What rights do individuals have, and how are they exercised?
A team member or organizer can ask the store that ran the team order, or write to us directly at the address below, to access, correct or delete their data, and we will respond within the time the law requires. When a store passes a customer's privacy request on through Shopify, it reaches us automatically: for a data request we email the store owner (not the customer) a copy of what we hold under that customer's email address, and the store answers the customer; for an erasure request we erase as described above. We find a person's data by the email address, or the customer ID, that Shopify names in the request, so data entered under a different address and without a login cannot be matched automatically, and in that case you should write to us. Depending on where you live, you may have rights under laws such as the GDPR and the CPRA.
Is the app for children?
Team Up is a tool for stores and their customers and is not directed at children under 13. We do not knowingly collect data from them.
How do you contact us?
Write to us at the address below with any question about this policy or your data.
How will we tell you about changes?
We update the date at the top of this page when the policy changes. If a change is material, we will tell merchants in the app before it takes effect, where we can.
Contact
Firesio
support@teamup.firesio.app