Privacy policy
Review Manager lets a Shopify merchant collect product reviews from their shoppers, ask past buyers for a review over WhatsApp, and mark a review as coming from a verified buyer. This policy explains exactly what personal data the app handles, why, for how long, and how a person can get it removed. It describes the app as it is actually built. If the app changes, this page changes with it.
1. Who is responsible for your data
The app is operated by Ali Bazlamit ("we", "us"), the sole developer and operator. You can reach us at ali.bazlamit@hotmail.com. A postal address is available on request at that email.
Roles under the GDPR and comparable laws:
- Shopper data is processed by us as a processor. The merchant whose store you shopped at is the controller. They decide that reviews are collected and what happens to them. We only act on their instructions, which are set out in our data processing addendum and in the app itself.
- Merchant staff data is processed by us as a controller. When a merchant installs the app, we store the Shopify session for their staff account so the app can call the Shopify Admin API on their behalf.
2. What we collect
2.1 Data a shopper gives us directly
When a shopper submits a review through the review form on a merchant's storefront, we store only what was typed into that form plus the identifiers needed to attach it to the right product and store:
- display name, as typed by the reviewer (optional)
- phone number, as typed by the reviewer (optional)
- email address, as typed by the reviewer (optional)
- star rating and review text
- the chosen language of the review
- the Shopify product ID being reviewed and the merchant's shop domain
- the time of submission
We do not read a shopper's Shopify account, cart, browsing history, or payment details. There is no tracking pixel, no advertising identifier, and no third party analytics in the review widget.
2.2 Data derived from a merchant's Shopify orders
When a merchant uses the Requests page to ask a past buyer for a review, we store, for that one order:
- the Shopify order ID and order name (for example
#1042) - the Shopify product ID
- a random single use review request token
- the time the request was created
We do not store the buyer's name, email address, or shipping address from the order, and we never store their phone number in readable form. A one way keyed hash of it is held in the purchase index described in 2.3. The Requests page reads the customer's display name and phone number live from Shopify each time the merchant opens the page. The name is shown to the merchant in their own admin. The phone number never leaves the server except in one case: when the merchant clicks "Send WhatsApp request" for a specific order, the server builds a wa.me link containing that number and returns it to the merchant's own browser, which opens WhatsApp. That link is not stored by us. WhatsApp then handles the message under Meta's own terms, between the merchant and their customer.
2.3 The verified buyer check
The verified buyer badge means the phone number on a review matched a real, paid, fulfilled order for that same product. There are two ways we establish that.
A purchase index built from order webhooks. When Shopify tells us an order has been fulfilled and paid, we record one row per purchased product containing: the shop domain, the Shopify product ID, the Shopify order ID, the time of fulfilment, and a one way keyed hash of the buyer's phone number. The hash is HMAC-SHA256 under a random secret unique to that store. We do not store the phone number itself, and the hash cannot be reversed back into one. Because the secret differs per store, the same phone number produces a different hash in every store, so the index cannot be used to track a person across merchants. When a reviewer submits a phone number we hash it the same way and look for a match. If the order is later cancelled, refunded, or voided, we delete its rows and the badge disappears.
A live lookup, as a fallback. For orders placed before the app was installed there is no index entry, so we ask the Shopify Admin API whether a customer of that store with that phone number has a paid, fulfilled, uncancelled order containing the product. We read back only the product IDs of the line items. The Shopify customer record read during this fallback is never stored, copied, cached, or logged by us.
The only phone number held in readable form anywhere in our database is the one the reviewer typed themselves. Everything derived from an order is either an identifier or a hash. We treat the hash as personal data regardless, because it is derived from a person, and it is covered by the same deletion and retention rules as everything else below.
2.4 Merchant staff data
For each installed store we hold a Shopify session record: session ID, shop domain, access token, granted scopes, expiry, and, where Shopify supplies it, the staff user ID, first and last name, email address, locale, and whether the account is the store owner or a collaborator. This is what authenticates the app to Shopify. It is not shopper data and is never shown to shoppers.
2.5 Logs
- Access log for personal data. Whenever a merchant opens a page in the app admin that displays shopper data, we write one line recording the shop domain, the Shopify staff user ID, the route, how many records were shown, and the timestamp. Reviewer names, phone numbers, email addresses, and review text are never written to this log.
- HTTP access log. Our web server records the time, method, path, status code, response size, and user agent of each request. IP addresses are truncated before being written (IPv4 to the first three octets, IPv6 to the first 32 bits). Cookie and Authorization headers are dropped, and the values of secret query parameters, including the review request token, are replaced with
REDACTED. - Error logs. If a verification lookup fails, we log the shop, the product, and a masked phone number showing only the last four digits. Full numbers are never logged.
3. Why we process it, and on what legal basis
| Purpose | Data | Basis |
|---|---|---|
| Publishing a product review the shopper chose to submit | Name, rating, review text, product | The merchant's legitimate interest in showing genuine reviews, and the shopper's own act of submitting the review. Where the merchant relies on consent, the merchant collects it. |
| Checking whether a reviewer really bought the product | Reviewer phone number, and the purchase index described in 2.3: a keyed hash of the order phone number, product ID, order ID and fulfilment time | Legitimate interest in preventing fake reviews |
| Contacting the merchant's own past buyer to ask for a review | Order ID and name, customer phone read live from Shopify | The merchant's legitimate interest in post purchase follow up. The merchant is responsible for having a lawful basis to message their own customer. |
| Letting the merchant moderate and reply to reviews | Everything on the review record | Performance of our contract with the merchant |
| Security, abuse prevention, and debugging | Logs described in section 2.5 | Legitimate interest in keeping the service secure |
We do not sell personal data. We do not use it for advertising, profiling, scoring, automated decision making, or training machine learning models. We never mix one merchant's data with another's: every query in the app is scoped to a single shop domain.
4. How long we keep it
| Data | Retention |
|---|---|
| Reviews and shop settings | Kept while the app is installed. When the merchant uninstalls, they are deleted after a 30 day grace period, so that reinstalling within 30 days keeps the store's reviews. A scheduled job on our server carries this out automatically and will not delete data for a store that still has a live session. |
| Review requests (order ID, order name, token) | Deleted immediately when the app is uninstalled. |
| Purchase index (hashed phone, product ID, order ID, fulfilment time) | Kept while the app is installed, then deleted on the same 30 day grace period as reviews. A row is deleted sooner if its order is cancelled, refunded, or voided. |
| Merchant staff sessions | Deleted immediately when the app is uninstalled. Sessions that have expired and can no longer be refreshed are pruned automatically, at least every six hours. |
| Encrypted database backups | 14 days, then deleted. |
| Access logs and HTTP logs | 90 days, then deleted. |
We also honour Shopify's mandatory compliance webhooks. On customers/redact we null out the reviewer's name, phone number, and email address on every matching review for that shop, keeping only the anonymous rating and text, and we delete that customer's rows from the purchase index. On shop/redact we delete every review, review request, purchase index row, and setting belonging to that shop. On customers/data_request we identify the matching review records so the merchant can respond to the request.
5. Where it is stored, and who else touches it
All application data lives on a single dedicated server in Frankfurt, Germany. The database is not reachable from the internet: it runs on a private container network with no published port. Traffic to the app is encrypted in transit with TLS certificates from Let's Encrypt.
Our sub-processors are:
| Sub-processor | Role | Location |
|---|---|---|
| DigitalOcean, LLC | Hosting of the server that runs the app, its database, and its backups | Frankfurt, Germany (FRA1) |
| Shopify Inc. | Source platform. It is where the storefront, the orders, and the customer records live. Shopify's own privacy terms govern that data. | Per Shopify |
Nobody else receives shopper data. We use no analytics provider, no email provider, no customer data platform, and no AI vendor. Container images are stored in GitHub Container Registry, which holds application code only and no personal data.
International transfers
Data is processed inside the European Economic Area. If a shopper or merchant is outside the EEA, submitting a review transfers their data into the EEA, which the EEA does not restrict. If personal data is ever transferred out of the EEA, we will rely on the European Commission's standard contractual clauses or another lawful transfer mechanism and will update this page before doing so.
6. Your rights
Depending on where you live, you may have the right to access your data, correct it, delete it, restrict or object to its processing, receive it in a portable format, and complain to a data protection authority.
If you are a shopper, the merchant you bought from is the controller of your review, so the fastest route is to ask that store directly. They can delete or anonymise your review from their admin, and Shopify gives them a built in way to send us an erasure request that we act on automatically. You can also write to us at ali.bazlamit@hotmail.com with the shop domain and the phone number or email address you used. We will forward the request to the merchant, act on it as their processor, and respond within 30 days.
If you are a merchant, uninstalling the app deletes your sessions and review requests at once and your reviews 30 days later. Write to us at the same address if you want everything deleted immediately instead of waiting out the grace period.
7. Security
Traffic is served only over HTTPS. The database is not exposed to the internet. Server access is by SSH key only, with password authentication and interactive root login disabled. Backups are compressed and encrypted with a public key whose private half is not kept on the server. Application access to shopper data is logged. We commit to notifying affected merchants without undue delay and within 72 hours of becoming aware of a personal data breach. Our security policy, including how to report a vulnerability and how we respond to an incident, is published in full. Reports go to ali.bazlamit@hotmail.com.
No system is perfectly secure, and we make no certification claims. We are not ISO 27001 or SOC 2 certified and do not represent otherwise.
8. Children
The app is not directed at children and we do not knowingly collect data from anyone under 16. If you believe a child has submitted a review, contact us and we will remove it.
9. Changes
If we change what we collect or how we use it, we will update this page and change the effective date at the top. Material changes affecting merchants will also be notified by email to the address on the store's Shopify account.
10. Contact
Ali Bazlamit, operator of Review Manager.
Email: ali.bazlamit@hotmail.com
Postal address available on request.