Privacy Policy for Devicely

1. Data Controller

The data controller responsible for the personal data processed in connection with the installation and use of the Shopify application Devicely ("the Application" or "the App") is the software developer ErGavri (operator of the website ergavri.com).

For any questions, requests regarding the exercise of data subject rights under the General Data Protection Regulation (EU GDPR 2016/679), or inquiries concerning data security, you may contact the controller directly at: support@ergavri.com.

2. Purpose and Operation of the Application

Devicely allows Shopify merchants to build dynamic pricing and discount strategies based on the technical specifications of the visitor's device. The application inspects client-side hardware and software indicators in real time (such as screen resolution, Device Pixel Ratio, OS version, and hardware tier estimation) to assign the session to anonymous value tiers (Top, Middle, Low-Cost, Obsolete) and apply configured discount rules directly at cart and checkout.

3. Merchant Data Collected

When a merchant installs Devicely from the Shopify App Store, we collect only the information strictly necessary for service delivery and account administration:

• Store Identifier: myshopify.com domain and unique Shopify store ID.
• Merchant Contact Information: Name and email address associated with the store owner account (used for operational notices, critical updates, and technical support).
• App Configuration Preferences: Settings, templates, discount rules, and metadata saved by the merchant.
• Subscription Status: Chosen plan tier handled via Shopify Billing APIs (no credit card or billing details ever touch our servers; billing is managed entirely by Shopify Inc.).

4. Store Visitor and Customer Data (Zero PII Policy)

5. Shopify Access Scopes & API Security

The application requests only the minimum Shopify Access Scopes strictly required for operational functions:

• read_discounts and write_discounts: to generate and synchronize dynamic discount rules.
• read_products: to allow applying or excluding discounts on specific products or collections.
• read_themes and write_themes: to enable the App Embed and dynamic badge loader.
• read_orders and read_checkouts: strictly to aggregate anonymized conversion statistics for applied discounts.

6. Mandatory Shopify GDPR Webhooks

In full compliance with Shopify Partner guidelines, Devicely implements and immediately responds to all three mandatory data protection webhook endpoints:

7. Data Sharing and Third Parties

We never sell, rent, or trade merchant or store data to data brokers, advertising networks, or third-party entities.

Technical data is processed exclusively by certified cloud infrastructure providers compliant with international security standards (secure hosting and databases with SSL/TLS encryption in transit and AES encryption at rest), bound by strict Data Processing Agreements (DPA).

8. Data Retention and Uninstallation (Zero Residual Code)

Application configuration data is retained for the duration of the active subscription.

When a merchant uninstalls the application from their Shopify Admin, synchronization ceases immediately. The application leaves no orphan files, intrusive scripts, or residual code in your Liquid theme. Pursuant to the shop/redact webhook, all store access tokens and settings are permanently erased.

9. Rights of the Data Subject (GDPR EU 2016/679)

In accordance with European Union GDPR regulations, merchants and data subjects hold the following rights:

• Request confirmation of whether personal data is being processed and obtain access;
• Request rectification, updating, or completion of inaccurate data;
• Request prompt erasure ("right to be forgotten") of processed data;
• Request restriction of processing or object to processing on legitimate grounds;
• Request portability of personal data in a structured, machine-readable format;
• Lodge a complaint with a competent Data Protection Authority.

To exercise any of these rights, simply email support@ergavri.com. Requests are fulfilled within 30 days of receipt.