Order Reviews: Google Ratings (“the App”) is provided by Dragon Apps (“Dragon Apps”, “we”, “us”). This policy explains what personal data the App collects, how we use and share it, and your choices. It covers the Order Reviews: Google Ratings Shopify app and its related services.
The App helps Shopify merchants collect more reviews. After an order is paid or fulfilled, the App sends the customer a review-request email and follow-ups, routes happy customers to leave a public Google review and unhappy customers to a private feedback form, and imports the merchant's existing Google reviews to display on the storefront.
Our role
For personal data about a store's customers, the merchant is the data controller and Dragon Apps is a data processor acting on the merchant's instructions. For data about the merchant's own account and use of the App, we act as a controller. Store customers should direct privacy requests to the merchant; we assist merchants in responding.
Information we collect
Merchant and store information
- Your Shopify store domain and store name.
- Shopify OAuth access tokens, used to call the Shopify Admin API on your store's behalf.
- App configuration you set, including review-request timing, email content and branding, the Google business you connect, and widget display settings.
- Subscription and billing status. Billing is handled through Shopify; we do not receive or store payment card details.
Customer personal data (Protected Customer Data, received from Shopify)
- When an order is paid or fulfilled on your store, Shopify sends us order details through the
orders/paidandorders/fulfilledwebhooks. We collect only the data needed to send and track a review request: the customer's name, email address, and order identifier. - This data is used solely to send the post-order review-request email and any configured follow-up emails, and to record whether a request was sent. We do not use it for advertising, and we minimize it to name, email, and order ID.
- We do not collect payment card numbers, and we do not track customer browsing behavior.
Feedback and ratings
- When a customer responds to a review request, we store the rating they give and any private feedback message they submit, and optionally their email address if provided.
- High ratings route the customer to leave a public review on Google; lower ratings route them to a private feedback form so the merchant can follow up directly.
Imported Google reviews
- To display reviews on your storefront, we import your business's public Google reviews. This includes the reviewer's name, profile photo, review text, and star rating, all of which are publicly available on Google.
How we use information
- Send post-order review-request emails and configured follow-up emails.
- Route customers to a public Google review or to a private feedback form based on their rating.
- Import and display your Google reviews in the storefront widget.
- Provide billing, support, security, and to operate and improve the App.
- We do not sell personal data and do not use it for advertising.
How we share information
We do not sell personal data. We share data only to provide the App, with the following categories of service providers (subprocessors):
- Shopify — the platform and APIs the App runs on, and the source of order data.
- Google (Places API) — searching for and identifying your business so we can import its reviews.
- Apify — importing Google review data on your behalf (compass/crawler-google-places).
- Amazon Web Services — sending review-request and follow-up emails (SES), and application hosting and PostgreSQL database storage. Emails contain the customer's name and order details.
We may also disclose information if required by law or to protect our rights and users.
Where data is stored and how long
- Data is stored in our PostgreSQL database hosted on Amazon Web Services in the United States.
- We retain review requests, ratings, and feedback while the App is installed so the dashboard and review history work, and for up to 12 months after they are created, after which they are automatically deleted.
- We honor Shopify's mandatory privacy webhooks. On a customer redaction request we delete or anonymize that customer's personal data; on a shop redaction request we delete the store's data; we respond to customer data requests.
- When you uninstall the App, we stop processing. Shopify then sends a shop redaction request (typically about 48 days later), at which point we delete your store's data.
- You may also request deletion by contacting us at [email protected].
Your rights
Depending on your location (for example, under the EU/UK GDPR or California's CCPA/CPRA), you may have rights to access, correct, delete, or restrict the use of your personal data, and to object to certain processing. Store customers should contact the merchant they shopped with. Merchants and individuals can contact us at [email protected] and we will assist or respond as required by law.
Security
We use reasonable technical and organizational measures to protect personal data, including encryption in transit (TLS), restricted access controls, and secure storage of access tokens. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
International data transfers
We and our subprocessors may process data in the United States and other countries. Where required, we rely on appropriate safeguards for international transfers.
Children
The App is not directed to children and we do not knowingly collect personal data from children under 16.
Changes to this policy
We may update this policy from time to time. We will post the updated version with a new “Last updated” date.
Contact
Company: Dragon Apps
Email: [email protected]
Website: https://dragonapps.io
For full contact details, visit our contact page.