Skip to content
PopWeaver
EN
Contact

Privacy policy

Last updated: November 4, 2026

PopWeaver ("the App") is a Shopify app that displays contextual campaigns (announcements, banners, embedded blocks, forms, quizzes) on Shopify online stores. It is published by Morgan Vincent, sole proprietorship (micro-entreprise, EI), SIRET 99094166800016, 1, rue Gabrielle d'Estrées, 92170 Vanves, France ("we", "us"). Contact: popweaver@fluidifia.com.

Roles. For data about merchants and their staff, we act as data controller. For data that shoppers submit through PopWeaver forms on a merchant's store, the merchant is the controller and we process it on the merchant's behalf and instructions only (processor). Section "Data processing terms" below applies between us and each merchant.

1. Data we process

About merchants (when you install and use the App):

  • Store information: shop domain, store name, time zone and language, plan status.
  • Shopify access credentials issued for the App, stored encrypted.
  • Staff: the Shopify user identifier and the role used to control access. The name, email and language that Shopify provides for the logged-in staff member are kept only inside the encrypted login session.
  • Content you create: campaigns, settings, uploaded images, and an audit log of sensitive actions (publication, export, deletion, settings changes).
  • AI assistant: your messages and the proposals returned, and the number of AI tokens used.
  • Public store content read to power suggestions: product and collection titles and descriptions, published pages.

About shoppers (only when a merchant publishes a form and a shopper submits it):

  • The answers the shopper enters (for example name, email, company, quantity, message), with the product and variant of the page. Stored encrypted.
  • Newsletter sign-up: the email address, proof of consent (text shown, language, time) and a confirmation link (double opt-in). After confirmation, the subscription is recorded in the merchant's Shopify customer list.
  • For a shopper logged in to the store: whether they are already subscribed to email marketing, read from Shopify, so that the sign-up form is not shown to them again.

What we do not collect: no advertising or analytics trackers, no cross-site tracking, no IP address stored (the IP address forwarded by Shopify is used in memory only to limit abuse), no payment data. The App remembers which campaign a visitor has already seen or closed only in the visitor's own browser, and only if they accepted preference cookies.

2. Why we use it

  • To provide the App to the merchant (contract): display campaigns, receive and deliver form submissions, send the confirmation email of a newsletter sign-up and the notification email to the merchant.
  • To keep the service secure and prevent abuse (legitimate interest).
  • To comply with legal obligations and with Shopify privacy requests.

We do not sell personal data and do not share it for advertising.

3. AI assistant

When a merchant uses the assistant, we send to OpenAI: the merchant's messages, the public content of their catalog and published pages, and the campaign being edited. We never send form submissions or shoppers' personal data. The assistant only prepares proposals; nothing is applied or published without the merchant's click. Merchants can turn the assistant off in Settings. OpenAI processes this data under its API data usage policies.

4. Service providers (sub-processors)

  • OVH — hosting of the App and its database (France).
  • OpenAI — AI assistant (merchant content only, see section 3), United States.
  • OVH — sending of confirmation and notification emails (France).
  • Shopify — the platform on which the App runs.

Transfers outside the European Economic Area (to OpenAI) rely on the European Commission's standard contractual clauses, included in OpenAI's data processing addendum.

5. Retention

  • Contact and quote requests: 180 days, then deleted automatically. Merchants can delete them earlier.
  • Newsletter sign-ups never confirmed: 7 days. Confirmation links expire after 24 hours.
  • Form anti-abuse tokens: 24 hours.
  • AI assistant messages and proposals: 30 days. AI usage counters (no message content): about 13 months.
  • Technical job records: 30 days.
  • Backups: 30 days, encrypted; deletions are re-applied if a backup is ever restored.
  • Uninstall: campaigns stop and data collection ends immediately. All of the store's data is deleted when Shopify sends the store deletion request (usually 48 hours after uninstall).

6. Security

All traffic uses HTTPS. Form submissions and Shopify sessions are encrypted with AES-256-GCM using keys kept separately from the database. Access to submissions in the App is limited to the store owner and administrators. Server access is restricted to the publisher. Sensitive data is excluded from logs.

7. Your rights

Shoppers: to access, correct or delete data you submitted through a store, contact the store; the merchant can export or delete it from PopWeaver, and we process the access and deletion requests that Shopify forwards to us. Merchants and anyone else: write to popweaver@fluidifia.com. You may also lodge a complaint with your data protection authority (in France: the CNIL, www.cnil.fr).

8. Data processing terms (merchants)

By installing the App, the merchant instructs us to process shopper data only to provide the App. We: process it only on the merchant's documented instructions (the App's settings and features); ensure that people authorised to access it are bound by confidentiality; apply the security measures of section 6; use only the sub-processors of section 4 and inform merchants of changes; help the merchant answer data subject requests (export and deletion in the App, Shopify privacy webhooks); notify the merchant without undue delay of a personal data breach affecting their data; delete the data at the end of the service (section 5); and provide the information needed to demonstrate compliance on request.

9. Changes

We will update this page and its date when our practices change, and inform merchants in the App of significant changes.

This website

This page is hosted on fluidifia.com. It has no contact form and sets no advertising or audience-measurement cookie: only two technical cookies, one for your browsing session and one that remembers your language for a year. Its fonts are loaded from Bunny Fonts (bunny.net). Connecting to the website transmits your IP address to the hosting servers so they can deliver the page.