This policy explains how UAB Essential apps handles personal data in connection with the Shopify app Essential Preorder & Back in Stock (the "App"). The App lets stores take preorders (including partial and later payments) and lets shoppers sign up to be notified when a product is back in stock.
1. Who we are
UAB Essential apps ("we", "us")
Company code 306227239, VAT code LT100015773711
Baltupio g. 45-27, LT-08324 Vilnius, Lithuania
Privacy contact: support@essential-apps.com (subject line: "Privacy")
We have not appointed a data protection officer.
2. Our two roles
| You are… | Our role | What applies |
|---|---|---|
| A merchant, or staff of a merchant, who installs or uses the App | Controller of your account, billing, support and marketing data | This policy (sections 3–11) |
| A shopper or customer of a store that uses the App, including if you placed a preorder or signed up for a back-in-stock alert | Processor for the merchant. The merchant is the controller | The merchant's privacy policy. Section 12 explains what the App does with your data |
3. Data about merchants and their staff
| Data | Source | Purpose | Legal basis (GDPR / UK GDPR) |
|---|---|---|---|
| Store details: store domain, Shopify store ID, settings, plan and usage | Shopify; your use of the App | Provide the App; apply plan limits | Contract (Art. 6(1)(b)) |
| Store contact email address | Shopify | Service, billing and payment-collection status emails; marketing (see below) | Contract; legitimate interests |
| Shopify access credentials (access tokens) | Shopify | Access your store with the permissions you approved | Contract |
| Credentials for services you connect (Klaviyo connection tokens, Omnisend API key), stored encrypted | You | Send back-in-stock sign-ups to your own marketing tools | Contract |
| Your campaigns: preorder and back-in-stock settings, texts, designs, email templates, markets | You | Provide the App | Contract |
| AI support assistant: your messages, attachments you upload, and a summary if the conversation is handed to our support team | You | Answer your questions quickly; hand over to a person when needed | Contract; legitimate interests in efficient support |
| Support conversations with our team: name, email, messages | You | Respond to support requests | Contract; legitimate interests |
| App usage events and error data | Your use of the App | Improve the App; detect and fix errors | Legitimate interests |
| Technical logs: IP address, browser, request times | Your browser, via our hosting providers | Security, abuse prevention, troubleshooting | Legitimate interests in security |
| Marketing contact: store contact email and store domain | Shopify | Product updates and news about Essential Apps | Legitimate interests in direct marketing, and EU e-privacy "soft opt-in" for similar products. You can opt out at any time (section 9) |
AI assistant: conversations are processed by our AI provider (Anthropic) to generate answers. Under Anthropic's commercial API terms, conversations are not used to train its models and are kept by Anthropic for up to 30 days. Please don't share customer personal data or passwords in the chat.
We do not use your data for automated decisions that have legal or similarly significant effects on you.
4. How long we keep merchant data
| Data | Retention |
|---|---|
| Store details, settings, campaigns, access credentials and connected-service credentials | Until we receive Shopify's shop deletion request (about 48 hours after uninstall), unless you reinstall before then |
| AI assistant conversations and attachments | Attachments are deleted when the conversation ends (by you, or automatically after 7 days without activity). Messages are kept until we receive Shopify's shop deletion request |
| Billing records | 10 years from the end of the year of the transaction, as required by Lithuanian accounting and tax law |
| Marketing contact | Moved to our uninstalled-merchant list when you uninstall; kept until you unsubscribe and no longer than 24 months after uninstall |
| Support conversations with our team | For as long as we need them to support you and other merchants well: to understand your store's history when you contact us again (including after a reinstall), to resolve recurring issues, and to handle any dispute. We review this periodically and delete conversations on request (section 8) unless we need them for a legal claim |
| Usage events | Until we receive Shopify's shop deletion request |
| Error data and logs | Up to 30 days |
| Backups | Database point-in-time restore history of 14 days |
5. Who we share data with
Shopify, which provides the platform the App runs on.
Service providers that process data for us, including:
Vercel (hosting, EU – Frankfurt)
Neon / Databricks (database, EU – Frankfurt)
Trigger.dev (background jobs, EU – Frankfurt)
Upstash (queues and cache, UK – London)
Google Cloud (inventory and fulfilment event delivery; any region)
Twilio SendGrid (email delivery)
Anthropic (AI support assistant)
Sentry (error monitoring, EU – Germany)
Help Scout and Google Workspace (support and email)
MailerLite (email marketing)
Slack (internal alerts)
Make.com (support automation)
Services you choose to connect, such as Klaviyo or Omnisend: we send them back-in-stock sign-ups on your instruction. They act under your own agreement with them.
Authorities, courts and advisers, where required by law or to establish, exercise or defend legal claims.
A buyer or successor of our business, if the App or our business is transferred.
We do not sell personal data, and we do not share it for cross-context behavioural advertising.
6. International transfers
Our servers, database and background jobs run in the EU (Frankfurt), and our queue in the UK (London). Delivery of Shopify inventory and fulfilment events may run in any Google Cloud region. Email delivery (SendGrid), our AI provider (Anthropic) and support tools may process data in the United States. Where a country does not have an adequacy decision, we rely on the EU–US Data Privacy Framework (and its UK Extension) where the provider is certified, or on the European Commission's Standard Contractual Clauses, together with the UK Addendum. You can request a copy of the relevant safeguards at support@essential-apps.com.
7. Security
We protect data with:
encryption in transit, and AES-256 encryption of stored Shopify access tokens of active stores and of connected-service credentials;
signed requests between the storefront and our servers (Shopify App Proxy);
one-time keys on every payment charge to prevent duplicate charges;
masking of email addresses and phone numbers in our logs; and
automated processing of Shopify's privacy deletion requests, with alerts if data remains.
No system is completely secure, but we work to protect your data and will notify you and authorities of breaches as required by law.
8. Your rights
Depending on where you are, you have the right to:
access your personal data;
correct it;
delete it;
restrict processing;
receive a portable copy;
object to processing based on legitimate interests (and to object at any time to direct marketing); and
withdraw consent where we rely on consent.
To exercise these rights, email support@essential-apps.com. We reply within one month, which can be extended where the law allows. We may need to verify your identity.
Complaints: you may complain to the State Data Protection Inspectorate of Lithuania (Valstybinė duomenų apsaugos inspekcija, vdai.lrv.lt), to the supervisory authority where you live or work, or, in the UK, to the Information Commissioner's Office (ico.org.uk).
9. Marketing emails
You can unsubscribe at any time using the link in any marketing email, or by emailing us. Unsubscribing does not stop service, billing and payment-collection messages, which we need to send while you use the App.
10. US state privacy disclosures
This section applies to residents of California and other US states with comprehensive privacy laws, in relation to the merchant data we control.
Categories collected in the last 12 months:
identifiers (name, email, store domain, IP address)
commercial information (plan and billing history)
internet or other electronic network activity (app usage, errors, technical logs)
the content of AI assistant conversations
Sources: you, Shopify, and your use of the App.
Purposes: as in section 3.
Disclosed for business purposes to: the service providers in section 5.
Sale or sharing: we have not sold or "shared" (for cross-context behavioural advertising) personal information. We have no actual knowledge of selling or sharing personal information of anyone under 16.
Sensitive personal information: we collect account credentials (Shopify access tokens and connected-service credentials) solely to provide the App, and not to infer characteristics.
Retention: section 4.
Your rights: to know/access, delete, correct and opt out of sale/sharing (we do not sell or share), and not to be discriminated against for exercising them. You may use an authorised agent. Appeals: if we decline your request, reply to our decision to appeal. If your appeal is denied, you may contact your state Attorney General.
How to exercise: email support@essential-apps.com.
11. Children
The App is for businesses and is not directed to children. We do not knowingly collect children's personal data as a controller.
12. Information for shoppers of stores using the App
If you shop on a store that uses this App, the store is responsible for your data. Please read the store's privacy policy and contact the store first. We act on the store's instructions.
If you sign up for a back-in-stock alert, the App:
stores the email address and/or phone number you enter, your language and region, the product you're waiting for, and whether you agreed to the store's privacy terms and (separately) to receive marketing;
sends you the alert by email when the product is available, or passes your sign-up to the store's own email/SMS tool (such as Klaviyo or Omnisend), which then contacts you;
if you ticked the marketing box, records your marketing consent in the store's Shopify customer list;
notes if you later buy the product, so the store can see which alerts led to a sale;
keeps your sign-up for as long as the store uses the App, so the store can see its alert history. It is deleted when the store or Shopify asks us to delete your data, or when the store uninstalls the App.
If you place a preorder, the App:
records which preordered products and amounts are in your order;
may charge the remaining balance for your order later, using the payment method you approved at checkout, when the store instructs it to;
sends you emails about your preorder (confirmation, shipping updates) on the store's behalf;
uses your order details (including name, email and shipping address) from Shopify to send these emails and manage the preorder. We do not store your payment card details; payments are processed by Shopify.
In your browser, the App keeps a temporary list of your back-in-stock sign-ups for the current visit (session storage) to avoid duplicate sign-ups. It sets no cookies and does not track you across websites.
If you contact us about a store's data, we will forward your request to the store.
13. Changes
We will post updates here and change the effective date. If changes are significant, we will notify merchants by email.
14. Contact
UAB Essential apps · Baltupio g. 45-27, LT-08324 Vilnius, Lithuania · support@essential-apps.com