ShopiDeck Privacy Policy
The common privacy framework for shopideck.com and the ShopiDeck suite. Each app has its own addendum describing its data, permissions, providers, retention, and deletion. Using one app does not authorize processing by every other app.
1. Scope and app-specific addenda
This policy covers the public marketing website, contact and early-access requests, merchant administration, and common privacy practices. App functionality runs on each product's own surface; this website does not itself connect accounts, audit Klaviyo profiles, generate campaigns, or publish social content.
Read this policy with the addendum for each app you actually use. Specific addendum rules prevail for that app only; the Data Processing Addendum (DPA) governs processor obligations and mandatory law always prevails. An app's addendum cannot reduce another app's protections or authorize new purposes or data access there.
The addenda below are the current product documents. Upcoming products, including SEO That Sells, do not inherit another app's permissions or operating rules. Before a new app processes data, its own disclosures must be published and any necessary authorization obtained. Publishing an addendum does not guarantee that a product or every integration is already available.
2. Operator and privacy contact
ShopiDeck is a trade name of BONILLA CARRENO ANDRES CAMILO, a natural person (individual), Bogotá, Colombia. Contact for privacy, support, legal matters, and security incidents: team@shopideck.com.
The operator is the internal privacy contact, not a formally appointed DPO. ShopiDeck is not established in the EU or UK and has not identified a formally appointed representative there in these documents. No appointment or exemption from a legal requirement is asserted.
3. Roles and separation between apps
ShopiDeck is controller for its website, merchant relationship, billing administration, support, security, abuse prevention, and legal duties. It is processor when handling personal data on a merchant's documented instructions to provide an app. The merchant generally controls customer data and business materials it supplies. Each app addendum and processing schedule specifies the relevant operations and people.
Installing an app grants only that app's disclosed permissions. Data, OAuth credentials, customer lists, campaign materials, and usage rights are not automatically shared with, combined for, or repurposed by another ShopiDeck app. Optional cross-app features require a disclosed purpose, a lawful basis, and any necessary separate authorization. A common brand or shared provider does not itself grant access.
Requests are scoped to the identified apps, accounts, stores, and data. A valid request expressly covering several apps is handled across that scope; a no-data response from one app does not mean the entire suite has no data. Common legal, billing, or security records are processed only to the extent necessary and lawful.
4. Website, support, and early-access data
- Website requests may involve IP address, browser/device details, requested pages, timestamps, and limited technical/security logs needed to deliver and protect the site.
- The support form asks for name, email, store domain, selected app, subject, and message; it sends the request through Resend to team@shopideck.com. Do not submit passwords, API keys, tokens, or full customer lists.
- Early-access forms on the Less Time Marketing page are hosted by Tally. When its widget loads or you open the external form, Tally can receive technical information; it receives submitted information under its own privacy notice. A request does not install an app, connect a platform account, or guarantee access.
- App addenda separately describe Shopify account, catalog, Klaviyo profile, social-connection, AI input/output, or credit data. A category listed for one app is not collected by all apps.
5. Purposes and legal bases
We process only data needed for the disclosed purpose. Under Colombian law, authorization is obtained where required, subject to applicable exceptions. GDPR/UK GDPR bases below apply only where those laws govern the processing. The merchant determines the legal basis for data handled on its behalf.
| Purpose | Applicable basis |
|---|---|
| Requested support, early access, installed-app service, and necessary notices | Contract or steps at your request before a contract, where applicable. |
| Billing, administration, and statutory records | Contract and applicable legal duties. |
| Security and abuse prevention | Legitimate interests where permitted and applicable legal duties. |
| Privacy requests | Applicable legal duties. |
| Optional marketing or non-essential tracking | Consent where required or another lawful basis disclosed at collection; withdrawal or objection is available as applicable. |
| App-specific customer data, AI generation, and publishing | Lawful documented merchant instructions and the app's disclosed purpose; platform permissions do not replace a legal basis. |
6. Use restrictions, advertising, and AI
ShopiDeck does not sell personal data, share it for cross-context behavioral advertising, use merchant customer profiles for its own advertising, or use app data to train its own AI models. Generating marketing content at the merchant's request is a Less Time Marketing service function, separate from ShopiDeck advertising.
Third-party AI use, data, providers, and verified limits are app-specific. ShopiDeck's own no-training commitment is not a guarantee about every vendor's retention or training terms. Bot Cleaner profiles are not authorized inputs for Less Time Marketing's generation providers. Automated action and human-review requirements are defined per app, not universally.
Apps are for business users aged 18 or older, not children. Do not supply sensitive or children's data incompatibly with law or outside the relevant app's disclosed scope.
7. Recipients and international transfers
Only providers needed for the website function or installed app receive relevant data. The register identifies scope, role, data, and location information. Connected platforms may be independent controllers rather than subprocessors for their own operations. Software libraries such as Prisma are not separate recipients.
Disclosure may also be necessary for legal duties, legal claims, advisers bound by appropriate duties, or a business transfer subject to continuing privacy obligations and required notice. These situations do not authorize unrelated app use or advertising sales.
The operator is in Colombia; providers may process abroad. Where required, an applicable lawful transfer mechanism must exist, such as contractual safeguards, applicable standard clauses, or a valid adequacy mechanism. This notice does not execute standard clauses or assert provider certification. Ask team@shopideck.com about locations, recipients, and safeguards.
8. Retention and deletion
Each app addendum specifies its own periods and triggers; there is no suite-wide scan-history period or universal 48-hour deletion promise. Website inquiries and support records are kept while needed to respond, manage the relationship, resolve disputes, and meet legal duties, then deleted or irreversibly anonymized. Technical records are limited to operational and security needs. Ask for applicable periods or deletion at the contact below.
Disconnection, subscription cancellation, uninstall, and deletion are different actions. Revocation stops new authorized access; local deletion follows the relevant app's flow and legal duties. Backups, statutory records, and minimum privacy/security evidence may need restricted retention and are not reused for unrelated purposes. Linkable pseudonymous hashes remain personal data.
Independent platforms may retain their own records. Shopify Files and already-published social content may remain after uninstall and must be managed there. Deleting one app's data does not itself cancel or delete another app unless the verified request also covers it.
10. Rights and requests
Depending on law you may know about use, access, correct, delete, restrict, or port data; withdraw consent/authorization; object; request proof of authorization or review of automated processing; and complain to the competent authority. Rights are free except lawful charges and subject to legal conditions and exceptions.
Write to team@shopideck.com with your name, relevant app(s), store/account identifier, relationship to it, right requested, and description. Identity and authority are verified proportionately. Do not send passwords, tokens, API keys, full customer lists, or unnecessary identity documents. Identify all apps if the request covers several. Store customers should contact the merchant as controller; ShopiDeck assists for data handled on its behalf.
Where EU/EEA or UK law applies, rights include access, rectification, erasure, restriction, portability, objection, and complaint to the local supervisory authority. GDPR requests are normally answered within one month, with notice and reasons within that period for any lawful extension. We aim to answer other requests within 30 days unless a different or shorter statutory period applies.
Where California or other US state law applies, rights may include knowing/accessing, correcting, deleting, portability, using an authorized agent, and non-discrimination. ShopiDeck does not sell personal information or share it for cross-context behavioral advertising. Statutory procedures and deadlines take precedence over our general response target.
11. Colombia: inquiries, complaints, and authority
Under Law 1581 of 2012 you may know, update, rectify and access data free of charge, request proof of authorization and information on use, seek deletion or revoke authorization where available, and complain to the Superintendencia de Industria y Comercio (SIC). A legal/contractual retention duty may limit deletion or revocation.
Inquiries are answered within 10 business days of receipt, with a justified extension of up to 5 additional business days communicated with reasons and a new date where permitted. Complete complaints are answered within 15 business days counted from the day after receipt, with a justified extension of up to 8 additional business days where permitted. Incomplete complaints follow the statutory correction process. Complete the direct inquiry/complaint process before approaching SIC where required.
12. Changes and language
The dates identify this version. Material changes are notified through the website, app, or email as appropriate. New consent/authorization required is obtained before changed processing; continued use is not consent where express consent is required. Adding an app addendum changes only that app, unless a separately notified common change applies to others. Spanish prevails over the English translation where legally permitted, preserving mandatory rights. Ask the privacy contact for the version applicable to an earlier period.