Privacy policy

Data from merchants

• Store identity and access token. When you install the app, Shopify issues an access token scoped to write_products. We store your myshopify domain, the token, its scopes and expiry so the app can read and write product fitment on your behalf. Tokens are stored in our application database and are never shared with third parties.
• Product data. The app reads product titles, handles, status, featured images and its own fitment metafields to render the fitment editor, and writes those metafields when you save. Product data is fetched on demand and is not copied into our database.
• Support requests. If you email us, we keep the correspondence to resolve your request.

Data from shoppers

• The storefront blocks run entirely in the shopper’s browser using data already rendered by Shopify. They make no requests to our servers.
• When a shopper selects a vehicle, the choice is saved in that browser’s local storage under the key 3dcarparts:vehicle so it can be reused on other pages. It contains only the selected year, make, model and submodel, is never transmitted to us, and is removed when the shopper chooses “Forget vehicle” or clears site data.
• We do not collect names, emails, addresses, order details or payment information from shoppers.

How we use data

We use merchant data only to operate the app: authenticating your admin session, reading and updating fitment metafields, and responding to support requests. We do not sell data, use it for advertising, or build profiles.

Sharing and processors

• Shopify. All product data is exchanged with Shopify’s Admin API under Shopify’s terms.
• Hosting. The app runs on managed cloud infrastructure in the United States. Our hosting and database providers process data on our behalf under their own security commitments.
• Legal requirements. We may disclose information when required by law.

Retention and deletion

• When you uninstall the app, Shopify revokes the access token and notifies us; we delete every stored session for your store at that time.
• Fitment values remain in your Shopify product metafields so you keep your data. Shopify removes the app’s metafield definitions after uninstall according to its own retention rules.
• We honor Shopify’s mandatory privacy webhooks. Customer data requests and redaction requests are acknowledged immediately because the app stores no customer data; shop redaction requests remove any remaining store sessions within 30 days.

Security

Access tokens are stored server-side, transmitted only over HTTPS, and are never exposed to the browser. Admin requests are authenticated with Shopify session tokens on every request.

Your rights

Merchants can request a copy of the data we hold about their store, or its deletion, by emailing legal@3dcarparts.org. Shoppers should contact the store they purchased from; the app does not hold shopper data.

Changes

We will update this page when the app’s data practices change and note the new effective date above.