Privacy Policy

The Gist

Below is our privacy policy for Noteable ("The App"). If you have an issue, always feel free to email us at support@getnoteable.com and we'll do our best to resolve it in a fair and timely fashion.

The App provides personalized note templates and PDF generation for orders (“the Service”) to merchants who use Shopify to power their stores. This Privacy Policy describes how personal information is collected, used, and shared when you visit our website, getnoteable.com, or install or use the App in connection with your Shopify-supported store.

Personal Information the App Collects

When you install the App, we are automatically able to access certain types of information from your Shopify account:

• Using the Order API to obtain orders and the entries shoppers typed on them, such as a gift message
• Using webhooks to receive changes to order states

If you turn on order tagging in the App's settings, and only then, the App asks for permission to edit your orders and uses it only to add a tag to new orders with Noteable entries. Turning order tagging off gives that permission back.

Emails from Noteable

When you install the App, it reads two things from Shopify: your store's contact email address and the store owner's first name. We use them only to email you about Noteable: setup help while you get started, account alerts (such as when you near your monthly order limit, or your gift message fields are switched off) and occasional news. You can turn each of these off on the App's Settings page, or with the unsubscribe link at the bottom of every email. If an email to your address bounces permanently or is marked as spam, we stop sending to it.

We keep a log of the emails we send you: which email it was, the address it went to, when it was sent, whether it was delivered, bounced or marked as spam, and when a link in it was first clicked. Resend delivers the emails for us, so it receives your address and each email's content, and tells us about deliveries, bounces, spam complaints and clicks.

Your contact details and the log are deleted with the rest of your store's data when Shopify asks us to delete it, 48 hours after you uninstall the App. What we know about which of these emails to send you (the kinds you turned off or back on, and whether an email to you bounced or was marked as spam) is kept only as a one-way hash of your email address, so the emails don't start again if you reinstall the App. Each email we sent you also leaves a record of which email it was and the same hash, so the unsubscribe link in it keeps working.

Data Protection and Security

We are committed to protecting the privacy and security of the personal information we collect. We employ the following data protection mechanisms to safeguard sensitive data:

1. Encryption: All data is encrypted both in transit and at rest using industry-standard encryption protocols (e.g., TLS/SSL and AES-256 encryption). This ensures that unauthorized parties cannot access the data while it is being transmitted or stored.
2. Access Control: We implement strict access control mechanisms to ensure that only authorized personnel have access to sensitive data. This includes role-based access controls (RBAC), requiring authentication and secure login credentials.
3. Data Minimization: We limit the collection of personal information to the data that is necessary to provide our services. Sensitive information is only collected and processed to the extent required for operational and legal purposes.
4. Data Anonymization and Masking: Where possible, we anonymize or mask sensitive data (e.g., customer order details, IP addresses) to reduce the risk of misuse or accidental exposure.
5. Audit Logging: All access to sensitive data is logged and monitored to detect any unauthorized access or suspicious activity. Regular audits are conducted to ensure compliance with data protection regulations.
6. Compliance with GDPR and CCPA: We comply with all applicable data protection regulations, including the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA). Our data processing practices include ensuring that customers have access to their rights to view, correct, delete, or limit the processing of their personal information.

Sensitive Data Handling

Noteable does not collect or process sensitive personal data (such as health, financial, or government-issued identification numbers) unless required by law. If such data is collected, it is subject to enhanced security measures as outlined above.

Cookies

For more information about cookies, and how to disable cookies, visit http://www.allaboutcookies.org. "Log files" track actions occurring on the Site, and collect data including your IP address, browser type, Internet service provider, referring/exit pages, and date/time stamps. "Web beacons," "tags," and "pixels" are electronic files used to record information about how you browse the Site.

Analytics

We use Google Analytics on getnoteable.com and in the App to learn how they are used, such as which pages people visit and where visitors come from. Google Analytics uses cookies and collects information such as the pages you view, the page that referred you, your browser and device type, and your approximate location. On getnoteable.com, we ask visitors in Europe before Google Analytics sets any cookies, we don't run it when your browser sends a Global Privacy Control signal, and you can change your choice at any time under Cookie settings at the bottom of the page. Google processes this information on our behalf; see how Google uses information from sites that use its services. You can opt out with the Google Analytics opt-out browser add-on.

How Do We Use Your Personal Information?

We use the personal information we collect from you and your customers in order to provide the Service and to operate the App. Additionally, we use this personal information to: Communicate with you; Optimize or improve the App; and Provide you with information or advertising relating to our products or services.

Sharing Your Personal Information

We do not sell your personal information. We share it only with service providers that process it on our behalf, such as Google Analytics (see Analytics above) and Resend, which delivers our emails to you (see Emails from Noteable above). We may also share your Personal Information to comply with applicable laws and regulations, to respond to a subpoena, search warrant, or other lawful request for information we receive, or to otherwise protect our rights.

Your Rights

If you are a European resident, you have the right to access personal information we hold about you and to ask that your personal information be corrected, updated, or deleted. If you would like to exercise this right, please contact us.

Additionally, if you are a European resident we note that we are processing your information in order to fulfill contracts we might have with you (for example if you make an order through the merchant’s Site), or otherwise to pursue our legitimate business interests listed above. Additionally, please note that your information will be transferred outside of Europe, including to Canada and the United States.

Data Retention

We do not retain any data longer than necessary for the purposes outlined in this privacy policy. After your store's data is deleted, all that's left of your email address is a one-way hash, kept for the reasons described in Emails from Noteable above.

Changes

We may update this privacy policy from time to time in order to reflect, for example, changes to our practices or for other operational, legal or regulatory reasons.

Contact Us

For more information about our privacy practices, if you have questions, or if you would like to make a complaint, please contact us by e-mail at support@getnoteable.com.