This policy explains how UAB Essential apps handles personal data in connection with the Shopify app Essential Subscriptions App (the "App"). The App lets stores sell products as subscriptions, with recurring orders and payments, and gives subscribers a portal to manage them.
1. Who we are
UAB Essential apps ("we", "us")
Company code 306227239, VAT code LT100015773711
Baltupio g. 45-27, LT-08324 Vilnius, Lithuania
Privacy contact: support@essential-apps.com (subject line: "Privacy")
We have not appointed a data protection officer.
2. Our two roles
| You are… | Our role | What applies |
|---|---|---|
| A merchant, or staff of a merchant, who installs or uses the App | Controller of your account, billing, support and marketing data | This policy (sections 3–11) |
| A customer of a store who buys a subscription through the App | Processor for the merchant. The merchant is the controller | The merchant's privacy policy. Section 12 explains what the App does with your data |
3. Data about merchants and their staff
| Data | Source | Purpose | Legal basis (GDPR / UK GDPR) |
|---|---|---|---|
| Store details: store domain, Shopify store ID, settings, plan and usage | Shopify; your use of the App | Provide the App; billing | Contract (Art. 6(1)(b)) |
| Store contact email address | Shopify | Service and billing notices; marketing (see below) | Contract; legitimate interests |
| Staff details from your Shopify sign-in: name, email address, language | Shopify | Provide the App, manage access, support | Contract; legitimate interests |
| Shopify access credentials (access tokens) | Shopify | Access your store with the permissions you approved | Contract |
| Your subscription settings: selling plans, campaigns, discounts, email templates and design, sender email address and email domain settings, retention survey questions | You | Provide the App | Contract |
| Support conversations: name, email, messages | You | Respond to support requests | Contract; legitimate interests |
| Error data and technical logs (IP address, browser, request times) | Your use of the App | Security, troubleshooting | Legitimate interests |
| Marketing contact: store contact email and store domain | Shopify | Product updates and news about Essential Apps | Legitimate interests in direct marketing, and EU e-privacy "soft opt-in" for similar products. You can opt out at any time (section 9) |
We do not use your data for automated decisions that have legal or similarly significant effects on you.
4. How long we keep merchant data
| Data | Retention |
|---|---|
| Store details, settings and access credentials | Until we receive Shopify's shop deletion request (about 48 hours after uninstall). We then delete sign-in sessions and email settings, anonymise your store details, and erase all of your customers' personal data |
| Billing records | 10 years from the end of the year of the transaction, as required by Lithuanian accounting and tax law |
| Marketing contact | Removed from our lists on Shopify's shop deletion request |
| Support conversations | For as long as we need them to support you and other merchants well: to understand your store's history when you contact us again (including after a reinstall), to resolve recurring issues, and to handle any dispute. We review this periodically and delete conversations on request (section 8) unless we need them for a legal claim |
| Error data and logs | Up to 8 days (Better Stack); our hosting provider keeps a short log buffer for up to a week. Logs are filtered in the App to remove personal details |
| Backups | Continuous database backups covering the last 4 days |
5. Who we share data with
Shopify, which provides the platform the App runs on.
Service providers that process data for us, including:
Heroku (hosting, database and queues, United States)
Better Stack (logs)
Postmark (email delivery, United States)
Help Scout and Google Workspace (support and email)
MailerLite (email marketing)
Slack and Make.com (internal operations)
Authorities, courts and advisers, where required by law or to establish, exercise or defend legal claims.
A buyer or successor of our business, if the App or our business is transferred.
We do not sell personal data, and we do not share it for cross-context behavioural advertising.
6. International transfers
The App's servers, database and queues are located in the United States (Heroku). Email delivery and support providers may also process data in the United States. Where a country does not have an adequacy decision, we rely on the EU–US Data Privacy Framework (and its UK Extension) where the provider is certified, or on the European Commission's Standard Contractual Clauses, together with the UK Addendum. You can request a copy of the relevant safeguards at support@essential-apps.com.
7. Security
We protect data with:
encryption in transit;
signature verification of Shopify webhooks;
safeguards against charging the same billing cycle twice; and
complete redaction of a customer's personal data, including addresses, payment-method details and survey comments, when Shopify asks us to delete it.
No system is completely secure, but we work to protect your data and will notify you and authorities of breaches as required by law.
8. Your rights
Depending on where you are, you have the right to:
access your personal data;
correct it;
delete it;
restrict processing;
receive a portable copy;
object to processing based on legitimate interests (and to object at any time to direct marketing); and
withdraw consent where we rely on consent.
To exercise these rights, email support@essential-apps.com. We reply within one month, which can be extended where the law allows. We may need to verify your identity.
Complaints: you may complain to the State Data Protection Inspectorate of Lithuania (Valstybinė duomenų apsaugos inspekcija, vdai.lrv.lt), to the supervisory authority where you live or work, or, in the UK, to the Information Commissioner's Office (ico.org.uk).
9. Marketing emails
You can unsubscribe at any time using the link in any marketing email, or by emailing us. Unsubscribing does not stop service, billing and payment-collection messages, which we need to send while you use the App.
10. US state privacy disclosures
This section applies to residents of California and other US states with comprehensive privacy laws, in relation to the merchant data we control.
Categories collected in the last 12 months:
identifiers (name, email, store domain, IP address)
commercial information (plan and billing history)
internet or other electronic network activity (app usage, errors, technical logs)
Sources: you, Shopify, and your use of the App.
Purposes: as in section 3.
Disclosed for business purposes to: the service providers in section 5.
Sale or sharing: we have not sold or "shared" (for cross-context behavioural advertising) personal information. We have no actual knowledge of selling or sharing personal information of anyone under 16.
Sensitive personal information: we collect account credentials (Shopify access tokens) solely to provide the App, and not to infer characteristics.
Retention: section 4.
Your rights: to know/access, delete, correct and opt out of sale/sharing (we do not sell or share), and not to be discriminated against for exercising them. You may use an authorised agent. Appeals: if we decline your request, reply to our decision to appeal. If your appeal is denied, you may contact your state Attorney General.
How to exercise: email support@essential-apps.com.
11. Children
The App is for businesses and is not directed to children. We do not knowingly collect children's personal data as a controller.
12. Information for subscribers of stores using the App
If you buy a subscription from a store that uses this App, the store is responsible for your data and for your subscription terms. Please read the store's privacy policy and subscription terms, and contact the store first. We act on the store's instructions.
What the App keeps about your subscription for the store:
your name, email address and language, your delivery and billing addresses (which may include a phone number) and your chosen shipping method;
a summary of your payment method (type, card brand, last digits and the email address linked to it). We do not store your full card details; payments are processed by Shopify;
your subscription products, prices, schedule, the orders it created, and payment results (including failed payments and retries);
actions you take in the subscription portal (skip, pause, resume, swap, cancel);
if you cancel and answer the store's survey, your reason and any comment you write;
if the store moved your subscription from another app, the details imported from that app.
What the App does with it:
charges your payment method automatically on each billing date, through Shopify, according to your subscription;
if a payment fails, retries it according to the store's settings and tells you;
sends you subscription emails on the store's behalf (for example reminders before an upcoming charge, if the store turns them on, or notices about payment problems). Our email provider, Postmark, keeps these messages for 45 days;
lets you manage your subscription in your customer account. Some stores require a minimum number of payments before a subscription can be cancelled online; the store must tell you about this before you subscribe.
In your browser, the App's campaign widget uses your browser's session storage to run the store's free-gift offer during your visit. It is cleared when you close the browser tab. The App sets no cookies of its own.
Deletion: when the store or Shopify asks us to delete your data, we redact your personal details, addresses, payment-method summary and survey comments. When the store uninstalls the App, all its subscribers' personal data is erased after Shopify's deletion request.
If you contact us about a store's data, we will forward your request to the store.
13. Changes
We will post updates here and change the effective date. If changes are significant, we will notify merchants by email.
14. Contact
UAB Essential apps · Baltupio g. 45-27, LT-08324 Vilnius, Lithuania · support@essential-apps.com