Privacy Policy

1. About this policy

This Privacy Policy explains how Frostleaf LLP (“we”, “us”, “our”) handles personal data in connection with Zonify, our Shopify app, and this website (together, the “Service”). It is written to meet the Information Technology Act, 2000 and the rules made under it, the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and its rules as they come into force, and Shopify’s requirements for apps.

We handle personal data in two different roles:

As a Data Processor for merchants. When a Shopify merchant (“Merchant”) uses Zonify, we process data about the people who visit the Merchant’s storefront (“Visitors”) only on the Merchant’s behalf and instructions. The Merchant is the Data Fiduciary (the controller) for that data. Our commitments to Merchants are set out in the Data Processing Agreement.
As a Data Fiduciary. For the personal data of Merchants and their staff, and of visitors to this website, we decide how and why it is processed.

If you visited a store that uses Zonify, that store is responsible for your data. Please contact the store first. See section 9.

2. The data we handle

2.1 Merchants

Store details: the store’s myshopify.com domain and name, when the app was installed or uninstalled, and the access token Shopify issues so the app can work with your store.
Your rules and settings: the countries and IP addresses you add, the notes you write on them, your redirect addresses and messages, and your content protection settings.
Account details: where Shopify provides them, the name and email of the staff member using the app.
Support: messages you send us and our replies.
Technical data: server logs of how the app runs, such as request times, errors and the store they relate to, kept for security and troubleshooting.

Zonify asks Shopify for no access to your orders, products or customers, only read access to your theme (to see whether its app embed is on), and does not collect them.

2.2 Visitors to a Merchant’s storefront (processed for the Merchant)

When the Zonify app embed is switched on, a small script checks each page load. To apply the Merchant’s rules and show the Merchant what happened, we record for each visit:

the Visitor’s IP address, as forwarded by Shopify;
the country we work out from the browser’s time zone and language, and that time zone and language;
the browser’s user agent, and the device type, browser name and version we read from it;
the page visited and the page that linked to it;
how long the visit lasted and how many pages it covered;
whether the Visitor was blocked, and the reason;
whether the browser reports that it is controlled by a program, and, for a visit that looks like a bot, the kind of bot we judge it to be and whether its claimed identity could be confirmed; and
a random visit identifier created in the browser, and, where the browser reports them, screen size and page load timings.

We do not collect Visitors’ names, email addresses, phone numbers, postal addresses, orders or payment details, and the script does not call any outside service to look Visitors up. The browser storage the script uses is listed in our Cookie Policy.

To tell real search engines from programs pretending to be them, when a visit says it is a known bot, our server checks its IP address against lists that the bot’s operator publishes, and may look the address up in the public Domain Name System (a reverse DNS lookup), which passes the IP address to a DNS server. For visits we judge to be bots, we work out the country from the IP address using a copy of the DB-IP country database kept on our own servers; the address is not sent to DB-IP.

If the Merchant switches on content protection, a second script is loaded for allowed Visitors. It records nothing and sends nothing.

2.3 Visitors to this website

Analytics: if analytics is switched on for our live website, pages viewed, referring site, device and browser type, and approximate location, collected with Google Analytics. See our Cookie Policy.
Contact: your name, email and anything you tell us when you email us.

3. Why we use it

Merchants’ data, to:

install, run and secure the app for your store;
apply your rules and settings on your storefront;
provide support and send service messages; and
meet legal, tax and regulatory obligations.

We process this data to perform our contract with you, to comply with law, and for legitimate uses permitted under the DPDP Act. If we ever want to send you marketing emails, we will ask first, and you can opt out at any time.

Visitors’ data, only to:

decide, on each page load, whether the Visitor may use the storefront, under the Merchant’s rules;
show the Merchant visits, blocks, countries and addresses in the app, and let them export that record as a CSV file; and
investigate faults the Merchant reports to us.

We do not sell this data, share it with advertisers, or use it to build profiles of Visitors across stores.

Website visitors’ data, to:

understand how the website is used and improve it; and
reply to your messages.

4. Automated decisions

Whether a Visitor is blocked is decided automatically, by rules the Merchant sets. We do not decide who to block. A Visitor who believes they were blocked by mistake should contact the store, which can review and change its rules.

We do not sell personal data. We share it only with:

Shopify, which carries every request between a storefront and the app, and through which Merchants install and uninstall Zonify.
Service providers who help us run the Service, under contracts that require them to protect the data and use it only to provide their services to us: cloud hosting, a managed database, email and website analytics. Merchants can ask us for the current list.
Authorities, where required by law or a valid legal order, or to protect the rights, safety and security of Visitors, Merchants, the public or us.
A successor business, if all or part of our business is merged, acquired or reorganised, under the same protections as this policy.

6. Where data is processed

Data is stored and processed in India and in the United States, where our hosting providers operate, and may be processed in other countries where our service providers operate. When data is processed outside India, we do so only as permitted by Indian law, including any restrictions notified by the Government of India, and with safeguards in our contracts.

7. How long we keep data

Visit records: deleted 90 days after the visit, by a clean-up that runs every day.
When a Merchant uninstalls: the store’s visit records are deleted straight away. Its rules and settings are kept for 48 hours, so a reinstall brings them back, and are then erased with everything else we hold for that store. We also act on Shopify’s privacy requests for a store’s data.
Rules and settings: kept while the app is installed, until the Merchant changes or removes them.
Support messages: kept for as long as we need them to help you and to keep a record of what was agreed.
Server logs: kept only as long as needed for security and troubleshooting, or as long as the law requires.
Backups: deleted data may remain in backups for a short period until those backups are replaced.

8. How we protect data

We use reasonable security practices and procedures to protect personal data, including:

encryption of data in transit, and at rest in our database;
verification of every request from a storefront against Shopify’s signature, so a request that did not come through Shopify for that store is refused;
verification of every webhook Shopify sends us;
access limited to staff who need it, with strong authentication; and
an incident response process.

No system is completely secure. If a personal data breach affects you, we will tell you without undue delay and report it to the authorities as the law requires. When we process data for a Merchant, we notify the Merchant so they can meet their obligations.

9. Your rights

If you visited a store that uses Zonify

The store you visited controls your data. You can ask the store for information about it, or to delete it. Because visit records hold no names or emails, the store will need your IP address and the approximate time of your visit to find them. Stores can send those requests to us, and we act on them within the time the law requires. If you cannot reach the store, you can contact our Grievance Officer and we will pass on your request and help where we can.

If you are a Merchant or a website visitor

Under Indian law, you can:

ask what personal data we hold about you and how we use it;
ask us to correct, complete or update it;
ask us to delete it, unless we must keep it by law;
withdraw any consent you have given, for the future;
nominate someone to exercise your rights if you die or become unable to; and
raise a grievance with us, as described below.

10. Grievance Officer

If you have a question or complaint about how we handle personal data, contact our Grievance Officer using the details below. We will acknowledge your complaint promptly and resolve it within the time required by law, and in any case within 30 days.

Frostleaf LLP
Email: business@frostleaf.co

If you are not satisfied with our response, you may complain to the Data Protection Board of India once it is able to receive complaints.

11. Children

The Service is for businesses and is not directed at anyone under 18. We do not knowingly collect personal data from children as Merchants or website visitors.

12. Changes to this policy

We will update this policy when the Service or the law changes, and change the date at the top. We will tell Merchants about material changes by email or in the app before they take effect.