Privacy and data

Last revision: 6 October 2026 · Italiano

This is the privacy policy of the IFG Reviews app (“the app”, IFG Recensioni in Italian), published by IFG eCommerce, a sole proprietorship of Francesco Guiducci, Via Giacinto Pullino 72, 00154 Rome, Italy, VAT IT16879681001 (“we”, “us”).

It covers two groups of people:

• merchants who install the app, and the people who use it for them;
• customers of those merchants (“shoppers”), whose orders and reviews the app handles on the merchant’s behalf.

Who is responsible

Shoppers who want to exercise their rights should write to the merchant they bought from, who is the controller of their data. We help the merchant answer, as described in “Your rights” below. Our Data Processing Addendum forms part of the terms of the app and applies to every merchant automatically, with nothing to sign.

Shopper data (on behalf of the merchant)

The app asks Shopify for the name and email address of the customer on an order and nothing else about them: no phone number, no postal address, no payment data. This is what it handles:

• For a review request: the customer’s first name and email address, the order and product references, the fulfilment date, the language of the order, and whether the order recorded marketing consent. The consent signal is recorded, not used to decide anything. The request is tied to one specific purchase. It is sent once per product in an order, a few days after fulfilment (seven by default, the merchant can change it), followed by at most one reminder when the plan includes reminders, the merchant has not switched them off and no review has arrived, and it stops waiting 45 days after its planned date.
• For a review: the rating, the title and text, the display name, and the email address (needed to link the review to the person, to confirm a verified purchase and to answer unsubscribe and deletion requests). The review is shown in the store only after the merchant publishes it, and the merchant can reply to it publicly.
• For a question on a product page: the question text, an optional display name and the email address (to stop the same person flooding a product and to answer deletion requests). It is shown in the store only after the merchant publishes it, with the merchant’s answer. It is deleted when the merchant deletes it, on a customer data request, and when the app is uninstalled and the shop’s data is erased.
• Photos, if the shopper adds them. Every photo is re-encoded, and the original file (with any location data inside) is deleted as soon as the converted versions exist. Until the merchant approves the review, the photos stay in private storage that has no public address, and a photo that is never attached to a review is discarded within a day. After approval they get a public address on the merchant’s store.
• Unsubscribe and bounce records: when a shopper unsubscribes, or an address bounces or complains, we keep a one-way fingerprint of the address (not the address) for that store, so that nobody who said no is written to again.

The emails to shoppers contain no images and no tracking pixel. They are sent on behalf of the merchant, through the email provider named below, with an unsubscribe link in the body and in the headers.

We do not sell this data, use it for advertising, profile shoppers or take automated decisions about them. The legal basis for the review request emails is the merchant’s to determine as controller; the terms they accept make them responsible for it.

Merchant account data (IFG eCommerce as controller)

• The store: its .myshopify.com domain, time zone, the language chosen in the app, the plan, the app’s settings, and the guided-setup state.
• Access credentials: the Shopify access token the app receives when you install it. It is encrypted by the app before it is stored.
• Usage counters: how many review requests were sent and how much photo storage is used in a period, to apply your plan’s limits; and a record of who did what in the app (moderation, exports, deletions), without the content itself.
• Support: if you write to us, or ask the in-app support chat to forward your question to a person, we keep your message and the contact details you gave, to answer you.
• Billing is handled by Shopify. We learn which plan you are on, never your card details.
• Your own sending domain (Grow and Unlimited plans, optional): the domain name you add is registered with our email provider (Resend, EU region) to verify it and send from it, and is removed from the provider when you remove it or uninstall the app.

We use this data to run the app, apply plan limits, keep it secure and answer you. We do not use it for advertising.

Welcome email

After a new installation we send one single welcome email to the email address of the store owner’s Shopify account, which we read from Shopify’s Admin API at install time (the public contact email of the store is never used). We also read the store name, to address you, and the country of the store’s billing address, only to choose the language of the message. The email is sent by Francesco Guiducci (IFG eCommerce), thanks you for installing the app, introduces him as its freelance developer and invites you to reply with any question. It is a service message, not a newsletter or a promotion, and nothing else is sent afterwards. It is not sent again if you uninstall and reinstall. It is delivered through Resend (United States).

Legal basis: performance of the contract (Art. 6(1)(b) GDPR) and, for the introduction, legitimate interest (Art. 6(1)(f) GDPR). You can object at any time by replying, using the unsubscribe link in the email, or writing to info@ifgecommerce.com.

The owner’s email address is not stored in our records. After uninstall and the erasure request (shop/redact) we keep only a minimal record: the store’s .myshopify.com domain, the sending status with dates and, for anyone who unsubscribed, the date of the objection and a keyed cryptographic fingerprint (HMAC-SHA256) of the address. The fingerprint is pseudonymised, not anonymous, and only prevents sending again and honours the objection (Art. 21 GDPR). It is deleted after 24 months.

What the app does not do

• It does not sell or share data for advertising, and it does not profile anyone.
• It does not use artificial intelligence on reviews: no review text, photo or shopper data goes to an AI provider. The only AI feature is the in-app support chat, described below.
• It does not track your store’s visitors: the storefront blocks show stars and reviews, and the public review form collects only what the shopper types into it.
• It does not write to shoppers about anything except the review requests for what they bought: at most one per purchased product, plus one reminder.

Why we process data, and on what basis

• Shopper data: to provide the review features the merchant installed the app for, on the merchant’s instructions. The merchant, as controller, chooses the legal basis. The app is built for the merchant’s legitimate interest (Art. 6(1)(f) GDPR) in asking a customer about a purchase they made: at most one request per purchased product plus one reminder, sent only after fulfilment, with no promotional content, an unsubscribe link in every email and in the List-Unsubscribe header, and an opt-out that covers all future requests from that store. A merchant selling where national law requires prior consent for such emails must collect it before turning requests on.
• Merchant account data: performance of the contract with you (Art. 6(1)(b) GDPR) for providing the app, applying plan limits and answering support; and our legitimate interest (Art. 6(1)(f) GDPR) in keeping the service secure and working, and in keeping proof that privacy requests were handled.
• The welcome email: as described in that section.

Who is involved

Google Cloud, Resend and OpenAI act as processors on our behalf. We do not share this data with anyone else. Where a provider is outside the European Union, the transfer is covered by the safeguards GDPR requires under that provider’s data processing terms: for Resend, the EU–US Data Privacy Framework and the Standard Contractual Clauses. Please do not type shoppers’ personal data into the support chat.

How long we keep data

On uninstall, the app stops sending. Shopify then sends us an erasure request for the store, typically 48 hours later. When it arrives we permanently delete the store’s reviews, requests, photos (in every storage location), counters, settings and credentials. Export your reviews before you uninstall if you want to keep them: after the erasure there is nothing left to export.

What remains after erasure: a register of the privacy requests we handled (store domain, type of request, outcome and dates, with a salted fingerprint of the person concerned, never the person’s data), kept as proof that the request was executed; and the minimal welcome email record described above.

Your rights

Under GDPR you can ask for access to your personal data, its correction or erasure, to restrict or object to the processing, and to receive your data in a portable format. You can also lodge a complaint with a data protection authority (in Italy, the Garante per la protezione dei dati personali).

• Shoppers: write to the merchant you bought from. The app supports the merchant through Shopify’s privacy requests: on a data request it prepares an encrypted copy of the shopper’s data for the merchant; on a deletion request it erases the shopper’s reviews, requests and photos, and keeps only the fingerprint needed to never write to that address again.
• Merchants and store owners: write to info@ifgecommerce.com. To object to the welcome email, use the unsubscribe link in it or reply to it.

Security

Webhooks from Shopify are verified by their signature before anything is stored. All traffic uses HTTPS/TLS. Data is encrypted at rest by the database provider, and email addresses and access tokens are additionally encrypted by the app. Every read and write is scoped to one store on the server, never on what the browser says. Our access to production data is limited and logged. No system is perfectly secure and we cannot promise otherwise; if a breach affects your data, we will tell you without undue delay.

Changes to this page

We may update this page as the app evolves. The date at the top identifies the text in force. When a change is material, we will tell you before it applies to you.

This page is published in Italian and in English. In case of any discrepancy between the two, the Italian version prevails.

Contact

Questions about this page, or about your data: info@ifgecommerce.com.