Privacy policy
Last updated: October 14, 2026
This policy explains how Firesio ("we") handles personal data in connection with VIP Early Access, an application for Shopify stores.
What personal data do we collect?
From merchants: your shop's myshopify.com domain, shop name and time zone, the Shopify access tokens the app needs to act for your store, your plan, and the tiers and launches you set up. If you contact support, the name and email address you give us, your message and any files you attach. From your customers: we do not store names, email addresses, phone numbers or addresses. For each customer we keep only their Shopify customer ID and the VIP tier they hold, plus the tiers you added them to by hand, and we read that customer's tags, total spent and number of orders from Shopify to work out the tier. For orders that buy a launch's products we keep the order ID, the time, the products and quantities, the amounts paid (after discounts, before tax and shipping), the buyer's Shopify customer ID and the tier they held, to show you how the launch performed; the buyer's ID is removed when the customer is deleted or erased on request. When a merchant opens a tier's customer list or searches for a customer to add, the app reads those customers' names and email addresses from Shopify and shows them to that merchant only; they are not stored.
Why do we collect it, and what do we do with it?
We use it only to run the app: to place customers in VIP tiers, open launches at the right time, block checkout for customers whose tier is not open, bill your plan through Shopify, and answer your support requests. We do not sell it, use it for advertising, build profiles from it, train models on it, or make automated decisions about people beyond the tier rules you set.
Who do we share it with?
Shopify, which is where the data comes from and where the app's results are written back (a tier on each customer, a gate on each product). Cloudflare, which hosts the app, its database, its file storage and its email sending, and which processes the data on our behalf. We share data with no one else, except where the law requires it.
Where is it stored, and for how long?
Data is stored with Cloudflare, which may process it in the countries where it operates. We keep a shop's data while the app is installed. About 48 hours after you uninstall, Shopify asks us to erase the shop and we delete its data, including support tickets and attachments; we keep only a one-way hash of the shop domain so the erased shop is not recreated by mistake. Short-lived operational logs identify a shop by a hash, never by name, and hold no customer details.
How do we keep it secure?
Everything is sent over HTTPS, and data is encrypted at rest by Cloudflare's storage services. Shopify requests to the app are verified before they are trusted, every database query is limited to one shop, and access to our internal console is restricted to our own staff behind a login. If a breach affects your data, we will tell you without undue delay, and tell you what happened and what to do.
What rights do individuals have, and how are they exercised?
A merchant or a shopper can ask us for access to, correction of, or deletion of their data. Requests made through a Shopify store reach us automatically as Shopify's customer data request and customer redact notices, and we act on them within 30 days. Anyone else can write to the privacy address below. We hold no name or email for a shopper, so we locate their data by Shopify customer ID.
How do you reach us?
Write to the privacy address at the end of this page. We answer requests about this policy and about your data there.
How do we change this policy?
We update this policy when what the app does with data changes. The date at the top shows the current version. For a material change we tell merchants in the app or by email before it takes effect.
Contact
Firesio
Vietnam
privacy@firesio.app