Effective date: 15 October 2026
Preorra ("the App") is a Shopify app for preorders, back-in-stock alerts and coming-soon pages. It is provided by Bizau Robert, an individual based in Romania ("we", "us"). Contact: contact@bizustudio.com. This policy explains what personal data the App processes when a merchant installs it on a Shopify store, and for the merchant's customers who interact with it.
For data about a merchant's customers, the merchant is the controller and we act as a processor on the merchant's behalf. For data about the merchant account itself (store details, billing status, support messages), we are the controller.
| Category | Data | Source | Purpose |
|---|---|---|---|
| Store data | Shop domain, store name, store email, currency, locale, timezone, plan and billing status | Shopify API at install | Run the App, apply plan limits, support |
| Access tokens | Shopify session and access token; merchant SMTP password if configured (encrypted) | Shopify OAuth | Call the Shopify API for the merchant |
| Products and inventory | Product and variant IDs, titles, SKUs, prices, inventory levels and policy, locations | Shopify API and webhooks | Show preorder and stock states, manage purchase options |
| Preorder orders | Order ID and number, customer name and email, line items, amounts, deposit and balance, payment and fulfillment status, refunds | Order and refund webhooks | Track preorders, deposits and balances, reports for the merchant |
| Alert subscribers | Email, optional phone and name, language, product and variant, subscription status, confirmation and unsubscribe tokens | Customer submits the store's Notify me form | Send back-in-stock and launch notifications the customer asked for |
| Notifications | Recipient, template, send status and timestamps | Created by the App | Deliver and audit emails, enforce plan quotas |
| Storefront events | Anonymous widget events (views, clicks, add to cart) without names or emails | Storefront script | Merchant analytics |
| Security logs | IP address for rate limiting of administrative login and public forms | HTTP requests | Prevent abuse |
The App does not request the read_customers scope, does not store payment card data, and does not sell personal data or use it for advertising.
We process merchant account data to perform our contract with the merchant (Art. 6(1)(b)) and for our legitimate interest in security and fraud prevention (Art. 6(1)(f)). Customer data is processed on the merchant's instructions. Merchants are responsible for their own legal basis towards their customers. For alert subscriptions this is normally the customer's request or consent at sign-up.
Transactional emails (preorder confirmation, shipping updates, balance due, alert confirmations, back-in-stock and launch notices) are sent through our email provider (Resend) or through the merchant's own SMTP server, if the merchant configures one. Every alert email includes an unsubscribe link.
| Subprocessor | Purpose | Location |
|---|---|---|
| Shopify Inc. / Shopify International Ltd. | Platform the App runs on; billing; webhooks | Canada, Ireland, United States |
| Supabase Inc. (on AWS) | Database and job queue, encrypted backups | EU (Ireland) |
| Hostinger International Ltd. | Application hosting, scheduled backups | EU |
| Resend Inc. | Sending transactional and alert emails | United States |
Where a provider processes data outside the EEA, we rely on the EU–US Data Privacy Framework or Standard Contractual Clauses. If a merchant configures their own SMTP server, that provider is the merchant's own processor.
shop/redact request (about 48 hours after uninstall), when we delete the store's data.customers/redact request we delete or anonymise that customer's personal data and pending jobs, keeping only order amounts the merchant needs for accounting.customers/data_request request we record what we hold about that customer and provide it to the merchant on request within 30 days.Data is encrypted in transit (TLS), and database storage is encrypted at rest by our database host. Merchant SMTP passwords are additionally encrypted by the App. Each store's data is isolated by store ID. Administrative access is password-protected with rate limiting, and the database is not exposed through a public API.
Customers of a store should contact that store first; we will help the merchant answer. Merchants and other data subjects can request access, correction, deletion, restriction or portability, and can object to processing, by writing to contact@bizustudio.com. You may also complain to your data protection authority. In Romania this is ANSPDCP (dataprotection.ro).
We will post changes here and update the effective date. Material changes are notified to merchants in the App or by email. Contact: Bizau Robert, contact@bizustudio.com.