Privacy policy

This policy explains how Blazier (“Blazier”, “we”, “us”) handles personal data in connection with Blazier Wishlist, an app for Shopify stores (the “App”), and this website, blazier.app.

It covers two groups of people:

• Merchants: businesses that install the App on their Shopify store, and their staff.
• Shoppers: people who use the wishlist on a merchant’s store.

1. Who we are

Blazier Wishlist is provided by DRG Technologies and Consultancy, Ranchi, Jharkhand, India.

Contact for anything in this policy: support@blazier.app.

2. Our role

• Merchant data. We are the controller of the personal data we process about merchants to provide the App and run our business.
• Shopper data. Each merchant is the controller of their shoppers’ data. We process shopper data only on the merchant’s behalf and instructions, as a processor (or “service provider”), under our Data processing addendum. If you are a shopper, the privacy policy of the store you are shopping on also applies.

3. Data we process about merchants

When a merchant installs the App, Shopify shares some store information with us. We process:

• Store details: shop domain (for example example.myshopify.com).
• Plan and billing status: the selected plan, trial status, and billing interval. Payments are handled entirely by Shopify; we never receive card or bank details.
• App configuration and usage: settings chosen in the App, setup status, and counts of wishlist adds used to measure plan usage.
• Support correspondence: emails you send to us and our replies.
• Technical data: access tokens issued by Shopify (stored encrypted), and server and security logs that include IP addresses and request details.

Why and on what legal basis

We don’t send merchants marketing email without the consent the law requires, and you can opt out at any time.

4. Data we process about shoppers (on behalf of merchants)

When a shopper uses the wishlist on a merchant’s store, we process the minimum needed to save and show their wishlists:

• Shopify customer ID, when the shopper is logged in to the store.
• A random guest identifier, when the shopper isn’t logged in. It is generated by us, is specific to one store, and doesn’t identify the person by itself.
• Wishlist contents: list names, product and variant IDs, and a small snapshot of each saved product (title, price, currency, product handle and image link) so the list can be shown quickly.
• Timestamps: when lists and items were created, changed, or last used.
• Share tokens: random tokens that make a shared-list link work.
• Technical data: IP address and request details in server and security logs, used for security and to prevent abuse.

We do not collect shoppers’ names, email addresses, postal addresses, phone numbers, or payment details in the current version of the App.

In the shopper’s browser

On the merchant’s store, the App keeps the guest identifier, a copy of the shopper’s wishlists, and a short-lived sign-in token in the browser’s local storage and session storage. This is needed for the wishlist feature the shopper is using. The App doesn’t set cookies, doesn’t track shoppers across different stores, and doesn’t use this data for advertising.

Purposes

We use shopper data only to provide the wishlist to the merchant and their shoppers: saving and showing lists, merging a guest list into the shopper’s account when they log in on the same browser, syncing lists across devices for logged-in shoppers, shared-list links, and giving the merchant aggregate wishlist statistics (such as most-saved products) for their own store. We don’t sell shopper data, share it for cross-context behavioral advertising, combine it across stores, or use it to build profiles.

5. This website

blazier.app doesn’t use cookies, analytics scripts, or third-party trackers. Our hosting provider records standard access logs (such as IP address, page requested, and browser type) for security and operations.

6. Where data is stored

Data is stored with Amazon Web Services (AWS) in the us-east-1 (N. Virginia, United States) region. Encrypted backups are kept in a second AWS United States region for disaster recovery.

7. Sub-processors

We use the following sub-processor to provide the App:

The current list is always at Sub-processors.

Shopify is the platform the App runs on. Shopify’s handling of data is governed by Shopify’s own terms and privacy policy, not this one.

8. International transfers

Data is stored in the United States. If you are in the European Economic Area, the United Kingdom, or Switzerland, transfers to the United States rely on appropriate safeguards, such as the European Commission’s Standard Contractual Clauses (and the UK addendum), or our sub-processor’s certification under the EU-U.S. Data Privacy Framework where applicable. Contact us for a copy of the relevant safeguards.

9. How long we keep data

• Guest wishlists are deleted after 180 days without activity by default. Merchants can change this period in the App’s Settings.
• Customer wishlists are kept while the merchant uses the App, until the merchant deletes them, or until Shopify asks us to erase that customer’s data.
• Uninstall: when a merchant uninstalls the App, we delete all of that store’s data, including all shopper wishlists, within 48 hours. We also delete it when Shopify sends a shop/redact request.
• Customer erasure: when Shopify sends a customers/redact request for a shopper, we delete that shopper’s data for that store.
• Backups are encrypted and expire on a rolling schedule; deleted data disappears from backups when they expire.
• Logs are kept for 30 days, then deleted.
• Support emails and billing records are kept as long as needed to help you and to meet legal obligations.

10. Security

• Encryption in transit (TLS) and at rest (AWS-managed encryption keys) for all stored data, including backups.
• Shopify access tokens and signing keys are kept in a secrets manager and are never sent to browsers.
• Storefront requests are authenticated with short-lived tokens issued only through Shopify’s signed app proxy, and every token is limited to one store.
• Access to production systems is limited to staff who need it, protected by multi-factor authentication, and logged.
• Rate limiting and a web application firewall protect the service from abuse.
• Separate environments for development and production; production data isn’t copied to development.

No system is perfectly secure. If we become aware of a security incident affecting personal data, we will notify affected merchants and Shopify without undue delay, as required by law and by our agreements.

11. Your rights

Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal data, to object to or restrict certain processing, and to complain to a data protection authority.

• Merchants: email support@blazier.app. We’ll respond within the time the law requires.
• Shoppers: because the store is the controller of your wishlist data, please contact the store you shopped with. Stores can send us data requests through Shopify (customers/data_request and customers/redact), and we respond to them. You can also email support@blazier.app; we’ll pass your request to the store and help them fulfil it. You can delete individual items or lists yourself at any time from the wishlist.

We don’t discriminate against anyone for exercising their rights.

12. Children

The App and this website are intended for businesses, and are not directed at children. We don’t knowingly collect personal data from children. Merchants are responsible for their own stores’ audiences.

13. Changes to this policy

We may update this policy as the App changes. We’ll change the “Last updated” date above and, for significant changes, notify merchants in the App or by email before they take effect.

14. Contact

DRG Technologies and Consultancy Ranchi, Jharkhand, India Email: support@blazier.app