Smart Breadcrumbs by Tiwaa

Privacy Policy

Last updated: April 22, 2026

This Privacy Policy explains how Tiwaa ("we", "us", "our") collects, uses, and protects data when you install and use Smart Breadcrumbs (the "App") on your Shopify store.

1. Data We Collect

We collect only the minimum data needed to operate the App:

• Shop domain — to identify your store and namespace your settings.
• Shopify session token — to authenticate API requests from your browser to our backend. Tokens are short-lived and never persisted beyond the session.
• Offline access token — stored encrypted at rest in our database, used for background tasks such as webhook processing and theme extension deployment.
• App settings — breadcrumb style preferences (colors, separator, font size) you configure in the App.
• Installation timestamp (installed_at) — used solely to calculate your free-trial remaining days.
• Active plan — the plan tier you have selected (Free, Basic, or Pro).

We do not collect, store, or process any customer PII (names, emails, addresses, order history) from your Shopify store.

2. How We Use Your Data

• Authenticate and authorize your use of the App.
• Render and serve the breadcrumb block on your storefront.
• Process billing through the Shopify Billing API.
• Respond to GDPR and CCPA data subject requests.
• Send transactional emails (e.g., trial expiry reminders) to the store owner email address on file in Shopify — never marketing emails without explicit consent.

3. Data Sharing

We do not sell, rent, or trade your data. Data is shared only with:

• Shopify — as required to operate an embedded Shopify app (authentication, billing, webhooks).
• Cloudflare — our infrastructure provider. Data is processed and stored on Cloudflare Workers and D1 databases in the US. Cloudflare is a GDPR-compliant data processor.

4. Data Retention

• Shop settings and session data are retained while your store has the App installed.
• Upon receiving an app/uninstalled webhook, all shop data (settings, sessions, plan info) is deleted within 48 hours.
• Upon receiving a shop/redact webhook (typically 48 hours after uninstall), any remaining shop data is permanently deleted within 30 days.
• Customer data subject requests (customers/data_request, customers/redact) are processed within 30 days. Because we do not store customer PII, these requests will typically result in a confirmation that no data is held.

5. Your Rights

You may request access to, correction of, or deletion of your shop's data at any time by emailing support@tiwaa.io. We will respond within 30 days.

If you are located in the European Economic Area, you have additional rights under the GDPR including the right to data portability and the right to lodge a complaint with a supervisory authority.

6. Security

All data is transmitted over TLS 1.2+. Offline access tokens are encrypted at rest. We conduct periodic dependency audits and apply security patches promptly.

7. Changes to This Policy

We will update this page and revise the "Last updated" date for any material change to data handling practices. Continued use of the App after a material change constitutes acceptance of the updated policy.

8. Contact

Questions about this policy? Email us at support@tiwaa.io.