Privacy Policy
Last updated: 31 October 2026. This page is available in English only.
Working draft. This document is provided for transparency. It is not legal advice and has not yet been reviewed by counsel. SMALLROCKS STUDIO LTD will update it before relying on it for compliance purposes.
This Privacy Policy explains how SMALLROCKS STUDIO LTD ("we", "us") handles personal data in connection with the OmniBuzz application for Shopify (the "App") and this website (the "Site"). It is written for the UK GDPR, the EU GDPR and the Shopify App Store requirements.
1. Who we are
SMALLROCKS STUDIO LTDRegistered in England & Wales, company no. 17261473
128 City Road, London, EC1V 2NX, United Kingdom
Data protection contact: privacy@smallrocks.studio
2. What the App does with data
OmniBuzz reads the prices of your products from your Shopify store, keeps a price history for each variant and market, and writes a result back to Shopify as a metafield so your theme can show the lowest price of the last 30 days. It is built so that it does not need personal data about your customers.
3. What we collect and why
Merchant data (we are the controller)
| Data | Purpose | Lawful basis |
|---|---|---|
| Shop domain, shop time zone and currency | Identify your store and schedule nightly price reads at local midnight | Contract |
| Shopify access tokens and sessions. Sessions for a logged-in staff member can include name, email address, locale and Shopify user id as Shopify provides them. | Connect the App to your store through the Shopify Admin API and show the App in your admin | Contract |
| Product and variant identifiers, prices, compare-at prices and the history of changes, per market and currency | Compute the prior price and discount shown on your storefront | Contract |
| Markets, their countries and your on/off choice for each | Decide where labels are shown | Contract |
| Label wording you enter and your exchange-rate tolerance | Show your wording on the storefront | Contract |
| Subscription plan and plan status read from Shopify | Apply plan limits | Contract |
| Support correspondence | Answer your requests | Legitimate interests |
Your customers' data
The App does not store personal data about your customers or shoppers. It never reads customer or
order records. Shopify's mandatory privacy requests customers/data_request and
customers/redact are received and answered with the fact that nothing is stored.
Site visitors
- This Site sets no cookies and uses no analytics, advertising or cross-site trackers.
- Typefaces are served from this Site. No third-party font service is contacted.
- Our servers may process technical request data (IP address, requested page, time) to deliver pages and protect the service. We do not use it to profile visitors.
The App runs inside the Shopify admin. Any cookies or storage set by the Shopify admin itself are governed by Shopify's own policies.
4. Who we share data with
We do not sell personal data. Shopify International Ltd and Shopify Inc. (Ireland, Canada) provide the platform the App extends and the source of the data it reads. Shopify is an independent controller of its own data and is not our sub-processor. We use these sub-processors to run the service:
| Provider | Role | Location |
|---|---|---|
| netcup GmbH | Application server and database hosting | Germany (EU) |
| Object storage provider for database backups | Off-site copy of database backups | Region to be confirmed by us before launch |
5. International transfers
The application and database are hosted in the EU. Where data goes outside the UK or the EEA, for example to Shopify in Canada, the transfer relies on an adequacy decision or on Standard Contractual Clauses and the UK International Data Transfer Addendum.
6. How long we keep data
- Price history: price changes older than 180 days (730 days on the Plus plan) are deleted, except the last known price of each variant and market. After you leave Plus, the longer history is kept for 30 more days. Older changes are not needed for the 30-day rule.
- Sessions are deleted when you uninstall the App.
- Store data (settings, markets, price history, labels) is kept while the App is installed. About 48 hours after you uninstall, Shopify sends a
shop/redactrequest and we purge the shop's data. The pre-rendered label values (variant metafieldomnibuzz.label) live in your store, not on our servers. They remain there after uninstall until you delete the "OmniBuzz label" definition and its values in Settings > Custom data. - Backups: local database backups rotate 7 daily, 4 weekly and 6 monthly copies (about six months), and the off-site copy mirrors that rotation. Data purged from the live database leaves the backups when those backups expire.
- Support emails are kept for as long as needed to handle your request and for a reasonable period afterwards.
7. Your rights
Under the UK and EU GDPR you can ask for access to, correction, deletion, restriction or portability of your personal data, object to processing, and complain to a supervisory authority. In the UK that is the Information Commissioner's Office (ico.org.uk). Write to privacy@smallrocks.studio.
8. Security
The service runs on EU-hosted infrastructure over TLS. Containers run with reduced privileges and access to production systems is restricted. No system is perfectly secure, and we apply measures that suit the risk.
9. Changes
We may update this policy as the App changes. The "Last updated" date above shows the latest version.
10. Contact
Questions about this policy: privacy@smallrocks.studio.