Legal
Privacy policy
How we collect, use and protect personal data across our website, Shopify apps and extensions for other platforms.
This policy explains how Zieasoft Limited ("Zieasoft", "we", "us" or "our") collects, uses and protects personal data when you visit our website, use our apps and extensions for e-commerce and business platforms, or contact us for support.
1. Who we are
Zieasoft Limited is a company registered in England and Wales under company number 11358998. Our registered office is 167-169 Great Portland Street, 5th Floor, London, England, W1W 5PF. We are registered with the Information Commissioner's Office (ICO) under registration number ZB333436.
For any privacy question or request, email [email protected] with "Privacy" in the subject line, or write to us at the address above.
2. What this policy covers
This policy applies to:
- Our website at zieasoft.com.
- Our help and feedback sites at help.zieasoft.com and feedback.zieasoft.com, and our support email address.
- Our Shopify apps, meaning every app we publish on the Shopify App Store or install on a Shopify store.
- Our extensions for other platforms, meaning any app, plugin, add-on or integration we publish for another e-commerce or business platform now or in the future.
In this policy, "Apps" means our Shopify apps and our extensions for other platforms together, and "Platform" means the platform an App runs on (for example Shopify).
Easy DOC Builder and ArtworkDesk have their own websites and their own privacy policies, which apply when you use those products. See easydocbuilder.com and artworkdesk.com.
3. Our role: controller or processor
Under UK and EU data protection law, we act in two different roles:
- Controller. We decide how and why we use personal data about website visitors, people who contact us, and the merchants and businesses who install our Apps (for example your name, email address and billing status). We are responsible for that data.
- Processor. When an App handles personal data about your own customers (for example names, email addresses or order details held in your store), we process it only on your behalf and on your instructions, to provide the App. You, the merchant, are the controller of that data and are responsible for telling your customers about it, usually in your store's privacy policy.
If you are a customer of a store that uses one of our Apps and you want to access, correct or delete your data, please contact the store first. We will help the store respond to your request.
4. Information we collect
When you visit our website, help centre or feedback board
- Technical information such as IP address, browser type, device type, pages viewed, referring page and the date and time of your visit. This is recorded in server and security logs.
- Information stored in cookies. See Cookies.
- If you accept analytics cookies on zieasoft.com: information collected by Google Analytics about how you use the site, such as the pages you view, how you arrived, your approximate location (country or city), and your device and browser.
When you contact us, ask for support or post feedback
- Your name, email address, company or store name and anything you include in your message, such as screenshots or files.
- If you create an account on our feedback board: your name, email address, profile picture (if you add one), the ideas you post, your comments and your votes. Ideas, comments and your display name may be visible to other visitors.
- A record of our conversation and how the request was resolved.
When you sign up for launch updates
- Your email address, when you signed up and when you confirmed it, and basic email statistics such as whether you open our emails or click a link in them. We only email you about our apps and launches, and you can unsubscribe at any time using the link in any email.
When you install or use one of our Apps (merchants)
- Store and account details from the Platform: store name, store URL or domain, store ID, the name and email address of the store owner and of staff members who install or use the App, store country, language, currency, time zone and Platform plan.
- Billing details: which App plan you are on, trial dates and charge status. On Shopify, payments are taken by Shopify and we do not receive your card or bank details.
- Store data the App needs to work: depending on the App, this may include products, collections, inventory, orders, discounts, files, settings or theme data, accessed through the Platform's APIs using the permissions you approve when you install the App.
- Settings and content you create inside the App.
- Usage and diagnostic information: which features are used, error reports and logs of requests between the App and the Platform. We use this to keep the App working and to improve it.
Information about your customers (store customers)
Some Apps need access to customer or order data to work, for example a customer's name, email address, shipping address or order history. An App only requests this access when a feature needs it, and only the fields that feature needs. If an App adds anything to your storefront (such as an app block or app embed), it may collect limited technical information from shoppers, for example to remember a choice they made. Each App's help page states what it accesses. See Shopify apps and other platform extensions.
We do not ask for special category data (such as health information) and ask you not to send it to us in support messages.
5. How we use information and our legal bases
| What we do | Legal basis |
|---|---|
| Provide, host, secure and support the Apps you install | Contract with you |
| Manage subscriptions, trials and billing, and keep financial records | Contract; legal obligation (tax and accounting) |
| Answer support requests, enquiries and feedback | Legitimate interests (helping you and running our business); contract where you are a customer |
| Send service messages, such as security notices, billing notices and important changes to an App | Contract; legitimate interests |
| Send product news or marketing emails | Consent, or legitimate interests for existing customers (you can unsubscribe at any time) |
| Monitor, fix and improve our Apps and website, using usage and diagnostic information | Legitimate interests |
| Measure how visitors use zieasoft.com with Google Analytics | Consent (you can withdraw it at any time using Cookie settings at the bottom of every page) |
| Prevent fraud and abuse, and keep our services secure | Legitimate interests; legal obligation |
| Process store customer data on a merchant's behalf | Processed on the merchant's instructions (the merchant is the controller and relies on its own legal basis) |
| Comply with the law and respond to lawful requests | Legal obligation |
We do not sell personal data. We do not use merchant store data or store customer data for advertising, and we do not combine one merchant's store data with another's.
6. Shopify apps and other platform extensions
Permissions
Before an App is installed, the Platform shows you the permissions (access scopes) it requests. We only request the access an App needs for its features. Each App's help page on help.zieasoft.com lists what data it accesses and why.
Shopify privacy requests
Our Shopify apps respond to Shopify's mandatory privacy requests:
- Customer data requests. When a store customer asks a merchant for their data, Shopify notifies us and we provide the merchant with any data we hold about that customer.
- Customer deletion requests. When a merchant asks for a customer's data to be erased, Shopify notifies us and we delete or anonymise that customer's data.
- Store deletion after uninstalling. Shopify notifies us 48 hours after an App is uninstalled. We then delete the store's data from that App.
We complete each of these within 30 days of receiving the request, except where the law requires us to keep certain records (for example invoices).
Other platforms
Extensions for other platforms follow the same principles: we request only the access needed, honour the platform's privacy and deletion requests, and delete a store's or account's data after the extension is removed, as described in How long we keep information. Any platform-specific details will be shown on that extension's help page.
App-specific details
| App | Platform | Store customer data accessed | Storefront cookies or storage |
|---|---|---|---|
| Ticklist: Order Checklist | Shopify | None. Ticklist uses only the order ID and order number, never customer names, email addresses, phone numbers or addresses | None. Ticklist works only in the Shopify admin and adds nothing to the storefront |
| Notch: Order Fields | Shopify | None read from Shopify. Notch uses only the order ID and order number. Staff may choose to type customer details into a field (see below) | None. Notch works only in the Shopify admin and adds nothing to the storefront |
| Handoff: Order Assignment | Shopify | None. Handoff uses only the order ID and order number, never customer names, email addresses, phone numbers or addresses | None. Handoff works only in the Shopify admin and adds nothing to the storefront |
| Cue: Order Workflow | Shopify | Order details shown on the board and job sheets: products, product images, options and personalisation (which may include names or messages the customer entered), and ship-by dates. Cue reads these from Shopify when needed and does not store them | None. On the Pro plan, if the store turns it on, the customer's order status page shows the order's current stage. This sets no cookies and collects nothing from the customer |
| Uplift: Gift Aid | Wix | Donors' names, home addresses and email addresses, their Gift Aid declarations, and the charity's Wix Donations payments. These are stored in the charity's own Wix site, not on our servers | The Gift Aid widget on the charity's donation pages collects the details a donor enters to make a declaration |
Ticklist: Order Checklist stores the store's checklist steps and tag settings and, for each ticked step, the order ID and order number, the step, the time and the name of the staff member who ticked it. It also keeps the name and email address of staff members who open the app, with their sign-in session. It uses Shopify's order permission only to show the checklist and to add or remove its order tags. All of a store's Ticklist data is deleted when Shopify sends the store deletion notice, 48 hours after the app is uninstalled.
Notch: Order Fields stores the store's field settings (each field's name, type, options and position, and whether it adds order tags) and, for each change to a field on an order, the order ID and order number, the field, the value entered, the time and the name of the staff member who made the change. It also keeps the name and email address of staff members who open the app, with their sign-in session. Field values are whatever the store's staff type in. Notch does not read customer details from Shopify, but if staff enter personal details about a customer in a field, we hold them as store customer data on the merchant's behalf and handle them as described above, including Shopify's customer data and deletion requests. It uses Shopify's order permission only to show and save the fields on the order and to add or remove its order tags. All of a store's Notch data is deleted when Shopify sends the store deletion notice, 48 hours after the app is uninstalled.
Handoff: Order Assignment stores the store's team list (the name and email address of each team member, whether added automatically when a staff member opens the app or added by hand by the store) and, for each assignment, the order ID and order number, who it was assigned to, the time and the name of the person who made the change. It also keeps the name and email address of staff members who open the app, with their sign-in session. When an order is assigned to someone, Handoff sends them an email through Brevo, our app email provider, saying which order is theirs. Team members added by hand do not need a Shopify account; the store is responsible for having a reason to add them and for telling them they will receive these emails. It uses Shopify's order permission only to show assignments on the order and to add or remove its order tags. All of a store's Handoff data is deleted when Shopify sends the store deletion notice, 48 hours after the app is uninstalled.
Cue: Order Workflow stores the store's stages and settings and, for each order on the board, the order ID and order number, its current stage and its history of moves, with the time and the name of the staff member who made each move. It also keeps the name and email address of staff members who open the app, with their sign-in session, and on the Pro plan the email addresses the store chooses for team emails. To show cards and print job sheets, Cue reads the order's products, options and personalisation from Shopify at the time they are viewed; it does not keep copies of them, or of the customer's name or contact details. Team emails are sent through Brevo. It uses Shopify's order permission to show orders on the board, to add or remove its stage tags and, on the Pro plan, to show the order's stage on the order status page. All of a store's Cue data is deleted when Shopify sends the store deletion notice, 48 hours after the app is uninstalled.
Uplift: Gift Aid is a Wix app for UK charities and CASCs. It does not store anything on Zieasoft's servers: it is hosted by Wix and keeps its records in admin-only data collections on the charity's own Wix site. For each declaration it keeps the donor's name, home address and email address, the exact declaration wording shown, the date and time, how the declaration was made (online, paper or phone) and any cancellation date. For each Wix Donations payment it keeps the amount, date, refunds, Gift Aid status and whether a follow-up email was sent. For each claim it keeps the donations included, the HMRC reference and the amount paid. The charity is the controller of this data and Uplift processes it on the charity's behalf. Records are kept for as long as HMRC requires (6 years after the end of the accounting period of the last donation covered), and the charity can export everything as CSV at any time. On the Standard plan, Uplift can send one follow-up email to a donor who gave without Gift Aid; this email is sent by Wix. Uplift never contacts HMRC: the charity downloads the claim file and submits it in Charities Online itself. If the charity removes Uplift, Wix may also remove the app's data from its site, so charities should export their declarations and donations to CSV before removing the app.
7. Who we share information with
We share personal data only with service providers that help us run our business, under contracts that require them to protect it and use it only on our instructions:
| Provider | What they do for us |
|---|---|
| Shopify and other Platforms | Host the stores our Apps connect to, and process App billing |
| Our app hosting provider | Hosts our Apps' servers, databases and backups, on servers located in the EU |
| Our website hosting provider | Hosts zieasoft.com, on servers in the UK |
| Cloudflare | Website delivery, DNS and security |
| Featurebase | Our help centre, feedback board, product updates and support inbox |
| Twilio SendGrid | Delivers emails sent from our support inbox |
| Brevo (Sendinblue SAS) | Delivers emails sent by our Apps, such as Handoff's assignment emails and Cue's team emails, and manages sign-ups and emails for our launch updates |
| Google Workspace | Our business email |
| Google Analytics (Google Ireland Limited) | Website analytics for zieasoft.com, only if you accept analytics cookies |
| Stripe Payments Europe Ltd | Payments for any App we bill directly rather than through a Platform. We do not receive or store full card details |
We may also share information with professional advisers (such as accountants and lawyers), with a buyer or investor if our business is sold or restructured (who must keep to this policy), or where the law requires it. We will update this list if we add or change a provider. A current list is available on request.
8. International transfers
We are based in the United Kingdom. Some of our providers store or process data in the European Economic Area, the United States or other countries. When personal data leaves the UK or EEA, we make sure it is protected by an adequacy decision (such as the UK Extension to the EU-US Data Privacy Framework), or by standard contractual clauses or the UK International Data Transfer Agreement or Addendum. Contact us for more information.
9. How long we keep information
| Information | How long |
|---|---|
| Store data and settings held by an App | While the App is installed. Deleted within 30 days of the Platform telling us the App was uninstalled (on Shopify, this notice arrives 48 hours after uninstalling) |
| Store customer data | Only as long as the App needs it for the feature using it, and never longer than store data above. Deleted within 30 days of a deletion request |
| Server, security and diagnostic logs | Up to 30 days |
| Backups | Overwritten on a rolling basis within 30 days |
| Support conversations | Up to 2 years after the last message |
| Feedback board posts and votes | Until you delete them or ask us to remove your account |
| Invoices, billing and accounting records | 6 years after the end of the financial year they relate to, as required by UK law |
| Marketing preferences | Until you unsubscribe, then a suppression record so we do not email you again |
10. Security
We use appropriate technical and organisational measures to protect personal data, including encryption in transit (HTTPS/TLS), encryption of access tokens and data at rest where supported, access controls limited to staff who need it, and keeping our software up to date. No system is completely secure, so if we become aware of a personal data breach that affects you, we will tell you and the relevant authorities where the law requires.
11. Your rights
Wherever you live, you can ask us to:
- tell you whether we hold personal data about you and give you a copy;
- correct data that is wrong or incomplete;
- delete your data;
- restrict or object to how we use it, including for direct marketing (you can always unsubscribe);
- give you your data in a portable format; and
- withdraw consent, where we rely on consent.
Some rights have exceptions, for example where we must keep records by law. To make a request, email [email protected]. We may need to confirm your identity. We will respond within one month, and we will not charge a fee for reasonable requests. We will not treat you differently for using your rights.
If you are a store customer, please contact the store first, as explained in Our role.
California residents: we do not sell or share personal information for cross-context behavioural advertising, and you have the rights above to know, correct and delete your information.
12. Cookies
Cookies are small files stored on your device. We use them as follows:
- zieasoft.com: strictly necessary cookies, such as a session cookie set by our website software and security cookies set by Cloudflare to protect the site from bots. These do not need consent. With your consent, we also use Google Analytics cookies (named _ga and _ga_ followed by an ID) to understand how visitors use the site. They last up to 2 years. We only set them if you click Accept in our cookie banner, and you can change your choice at any time using Cookie settings at the bottom of every page. Your choice is remembered in your browser for 12 months.
- help.zieasoft.com and feedback.zieasoft.com: cookies set by Featurebase to keep you signed in, remember your preferences and keep the service secure.
- Inside the Platform admin: our Apps use the Platform's secure session tokens to recognise you. They do not use tracking or advertising cookies.
- On a merchant's storefront: if an App adds a feature to a storefront that needs cookies or local storage, this is listed on that App's help page and in the App-specific details above. Our Apps respect the store's cookie consent settings where the Platform provides them.
You can block or delete cookies in your browser settings, but some features may then stop working.
13. Children
Our website and Apps are for businesses and are not aimed at children. We do not knowingly collect personal data from anyone under 16.
14. Changes to this policy
We may update this policy when our services or the law change. The date at the top shows when it was last updated. If we make significant changes, we will tell merchants who use our Apps by email or inside the App before the changes take effect.
15. Contact us and complaints
Zieasoft Limited
167-169 Great Portland Street, 5th Floor, London, England, W1W 5PF
Email: [email protected]
If you are unhappy with how we have handled your data, please contact us first so we can try to put it right. You also have the right to complain to the Information Commissioner's Office (ico.org.uk) or, if you are in the EEA, to the data protection authority in your country.