This policy explains how the Collection Tiles app ("the App", "we", "us"), provided by Stock Atlas (based in the United Kingdom), handles information when you install and use it on your Shopify store. Stock Atlas is the data controller for the merchant data described below; you remain the controller of your own store and customer data.
This policy is for the Shopify merchants (store owners and staff) who install and use Collection Tiles. It also explains why the App does not collect personal data about the shoppers who visit your storefront.
To run the App, manage your subscription and provide support, we store the following in our database (hosted on Railway — see section 7):
The App requests only the Shopify permissions it needs: read/write access to Files (for tile images), read/write access to metaobjects and to products and collections (tile configuration is stored in collection metafields — in Shopify's API, collections are governed by the products permission), and read access to your theme and content to place and preview tiles.
Collection Tiles is a merchandising tool and does not require shopper personal data to function. We do not request access to your customers' names, addresses, emails, orders or payment details, and we do not build profiles of individual shoppers. Tiles render the same content for everyone viewing a collection, and our usage tracking (section 5) records anonymous counts only — no IP addresses, cookies or device fingerprints.
We do not sell your data, and we do not use it for advertising.
So you can see how your tiles perform, the App counts tile impressions (a tile becoming visible) and clicks. These are collected as a first-party request through Shopify's App Proxy and stored only as daily aggregate totals per tile and collection. We do not record who viewed a tile, their IP address, device or any other personal data about shoppers.
We send emails through our email provider, Resend (section 7). These include service emails (a welcome message on install, an uninstall confirmation, and a reminder if the App's storefront block is switched off after a theme change) and support replies when you contact us.
We may also send occasional product emails, such as a one-time invitation to review the App on the Shopify App Store roughly a week after install. You can opt out of these product emails at any time by contacting us at the address below; we will still send essential service emails about your account.
When you message us through the in-app contact form, we store your message, the email address you give us for our reply, and an optional technical diagnostics snapshot (such as your store, plan, theme and tile counts) to help us resolve the issue. Support messages and reply addresses are kept as part of our support history.
We share data only with the infrastructure providers needed to run the App, each under their own security and privacy commitments:
We do not sell your data. We may disclose information if required by law.
When you uninstall Collection Tiles, your access token is cleared and tiles stop showing on your storefront. We retain your store record (in anonymised, aggregate form) so we can understand overall product usage. Your theme, products and uploaded files in Shopify are not altered by uninstalling.
If your store is deleted, Shopify sends us a redaction request. Within 30 days we pseudonymise your store identifier (replacing it with a one-way hash) and delete the personal data we held — your email, the owner's name, your primary domain and any internal notes. Anonymised installation and usage statistics may be retained for aggregate metrics. Support reply emails are kept only as long as needed for our support history.
As required by Shopify, the App implements the mandatory compliance webhooks
customers/data_request, customers/redact and
shop/redact. Because the App stores no shopper personal data, the two customer
webhooks confirm we hold no such data; the shop/redact webhook performs the
pseudonymisation and deletion described in section 9.
Access tokens are stored encrypted, data is transmitted over HTTPS, and access to our systems is restricted. No system is perfectly secure, but we take reasonable measures to protect the data we hold.
Depending on where you are based (for example under UK/EU GDPR), you may have rights to access, correct or delete data we hold about you, to object to certain processing, or to opt out of product emails. To exercise these rights, contact us using the details below. Stock Atlas is the data controller for the merchant data described above.
We may update this policy as the App evolves. We'll change the "last updated" date above and, for material changes, make reasonable efforts to notify merchants.
Stock Atlas, United Kingdom
Email: hello@stockatlas.app
