This policy explains how UAB Essential apps handles personal data in connection with the Shopify app Essential Announcement Bar (the "App"). The App shows announcement bars configured by the store (messages, links, countdowns, free-shipping messages and similar).
1. Who we are
UAB Essential apps ("we", "us")
Company code 306227239, VAT code LT100015773711
Baltupio g. 45-27, LT-08324 Vilnius, Lithuania
Privacy contact: support@essential-apps.com (subject line: "Privacy")
We operate the App directly. We have not appointed a data protection officer.
2. Our two roles
| You are… | Our role | What applies |
|---|---|---|
| A merchant, or staff of a merchant, who installs or uses the App | Controller of your account, billing, support and marketing data | This policy (sections 3–11) |
| A visitor or customer of a store that uses the App | Processor for the merchant. The merchant is the controller | The merchant's privacy policy. Section 12 explains what the App does on stores |
3. Data about merchants and their staff
| Data | Source | Purpose | Legal basis (GDPR / UK GDPR) |
|---|---|---|---|
| Store details: store domain, Shopify store ID, store URL, Shopify plan | Shopify, when you install the App | Provide the App; determine plan features and limits | Contract (Art. 6(1)(b)) |
| Store contact email address | Shopify | Service and billing notices; marketing (see below) | Contract; legitimate interests |
| Shopify access credentials (access tokens) | Shopify | Access your store data with the permissions you approved | Contract |
| App plan, subscription and usage status | The App; Shopify billing | Charge fees, apply plan limits | Contract; legal obligation (accounting, Art. 6(1)(c)) |
| Your App settings: texts, links, designs, placement, targeting and offer rules | You | Provide the App | Contract |
| Uploaded images | You | Show your announcement designs | Contract |
| Announcement statistics: views and clicks per bar | Your store's visitors (section 12) | Show you how the App performs | Contract |
| Product usage events from the App admin (which features and templates you use) | Your use of the App | Improve the App | Legitimate interests in improving our product |
| Support conversations: name, email, messages, attachments; your store domain and plan shared with our support tool | You, through the in-App chat or email | Respond to support requests | Contract; legitimate interests |
| Review requests: a flag that your store may be asked for an App Store review after a support conversation | Our support team | Ask satisfied merchants for a review once | Legitimate interests |
| Error and performance data from the App | Your use of the App | Detect and fix errors | Legitimate interests in a reliable service |
| Technical logs: IP address, browser, request times | Your browser, via our hosting providers | Security, abuse prevention, troubleshooting | Legitimate interests in security |
| Marketing contact: store contact email and store domain | Shopify | Product updates and news about Essential Apps | Legitimate interests in direct marketing, and EU e-privacy "soft opt-in" for similar products. You can opt out at any time (section 9) |
We do not use your data for automated decisions that have legal or similarly significant effects on you.
4. How long we keep merchant data
| Data | Retention |
|---|---|
| Store details, access credentials and settings | Until we receive Shopify's shop deletion request (about 48 hours after uninstall), unless you reinstall before then |
| Uploaded images | Kept after uninstall. We delete them on request (section 8) and are adding automatic deletion after uninstall |
| App statistics | Kept as totals per store (no visitor-level data) for as long as you use the App. We delete them on request (section 8) and are adding automatic deletion after uninstall |
| Billing records | 10 years from the end of the year of the transaction, as required by Lithuanian accounting and tax law |
| Marketing contact | Moved to our uninstalled-merchant list when you uninstall, and removed when we receive Shopify's shop deletion request |
| Support conversations | For as long as we need them to support you and other merchants well: to understand your store's history when you contact us again (including after a reinstall), to resolve recurring issues, and to handle any dispute. We review this periodically and delete conversations on request (section 8) unless we need them for a legal claim |
| Error data | 90 days |
| Technical logs | 8 days (our log management provider, EU) |
| Backups | Daily database backups, kept for 7 days |
5. Who we share data with
Shopify, which provides the platform the App runs on. Shopify's own privacy policy applies to Shopify.
Service providers that process data for us, including:
Heroku (hosting)
Supabase (database and file storage, United States)
Heroku Redis (queue and cache)
Cloudflare (network delivery)
Sentry (error monitoring, United States; error reports can include the IP address and request details of the person whose request failed, with cookies and credentials removed)
Better Stack (log management, EU – Frankfurt)
Twilio SendGrid (email)
Help Scout and Google Workspace (support and email)
MailerLite (email marketing)
Make.com (support automation)
PostHog (product analytics, EU)
Authorities, courts and advisers, where required by law or to establish, exercise or defend legal claims.
A buyer or successor of our business, if the App or our business is transferred. We will notify you as described in the Terms.
We do not sell personal data, and we do not share it for cross-context behavioural advertising.
6. International transfers
The App's servers run in the EU (Heroku), and its logs are kept in the EU (Better Stack, Frankfurt). Its database and file storage are located in the United States (Supabase, Virginia), and error reports are processed in the United States (Sentry). Support and email providers may also process data in the United States. Where a country does not have an adequacy decision, we rely on the EU–US Data Privacy Framework (and its UK Extension) where the provider is certified, or on the European Commission's Standard Contractual Clauses, together with the UK Addendum. You can request a copy of the relevant safeguards at support@essential-apps.com.
7. Security
We protect data with:
encryption in transit, and encryption of stored access credentials;
database access restricted to our servers;
signature verification of Shopify webhooks;
removal of secrets from error reports; and
data minimisation: the App has no access to your orders or customer records.
No system is completely secure, but we work to protect your data and will notify you and authorities of breaches as required by law.
8. Your rights
Depending on where you are, you have the right to:
access your personal data;
correct it;
delete it;
restrict processing;
receive a portable copy;
object to processing based on legitimate interests (and to object at any time to direct marketing); and
withdraw consent where we rely on consent.
To exercise these rights, email support@essential-apps.com. We reply within one month, which can be extended where the law allows. We may need to verify your identity.
Complaints: you may complain to the State Data Protection Inspectorate of Lithuania (Valstybinė duomenų apsaugos inspekcija, vdai.lrv.lt), to the supervisory authority where you live or work, or, in the UK, to the Information Commissioner's Office (ico.org.uk).
9. Marketing emails
You can unsubscribe at any time using the link in any marketing email, or by emailing us. Unsubscribing does not stop service and billing messages, which we need to send while you use the App.
10. US state privacy disclosures
This section applies to residents of California and other US states with comprehensive privacy laws, in relation to the merchant data we control.
Categories collected in the last 12 months:
identifiers (name, email, store domain, IP address)
commercial information (plan and billing history)
internet or other electronic network activity (admin usage, errors, technical logs)
Sources: you, Shopify, and your use of the App.
Purposes: as in section 3.
Disclosed for business purposes to: the service providers in section 5.
Sale or sharing: we have not sold or "shared" (for cross-context behavioural advertising) personal information. We have no actual knowledge of selling or sharing personal information of anyone under 16.
Sensitive personal information: we collect account credentials (Shopify access tokens) solely to provide the App, and not to infer characteristics.
Retention: section 4.
Your rights: to know/access, delete, correct and opt out of sale/sharing (we do not sell or share), and not to be discriminated against for exercising them. You may use an authorised agent. Appeals: if we decline your request, reply to our decision to appeal. If your appeal is denied, you may contact your state Attorney General.
How to exercise: email support@essential-apps.com.
11. Children
The App is for businesses and is not directed to children. We do not knowingly collect children's personal data as a controller.
12. Information for visitors of stores using the App
If you visit a store that uses this App, the store is responsible for your data. Please read the store's privacy policy and contact the store first. We act on the store's instructions.
What the App does on a store:
Shows announcement bars chosen by the store. To decide which bar to show, it may use the country you appear to be browsing from. Your browser sends a request to our location service, which works out your country from your IP address. Our network provider (Cloudflare) adds the country to the response; the App does not store your IP address.
Counts bar views and clicks for the store's statistics. Each event contains only the store, the bar and the type of interaction, not your name, email, customer account or any device identifier. Our statistics service does not store your IP address or browser details, and it keeps only totals, not individual events.
Remembers in your browser's local storage that you closed a bar, so it doesn't show again. No cookies are set.
Does not access your orders, payment details, addresses or customer account data.
If you contact us about a store's data, we will forward your request to the store.
13. Changes
We will post updates here and change the effective date. If changes are significant, we will notify merchants by email.
14. Contact
UAB Essential apps · Baltupio g. 45-27, LT-08324 Vilnius, Lithuania · support@essential-apps.com