Privacy Policy
This draft reference explains the privacy topics the final operating notice must cover. It is not yet the effective privacy policy for an operating storefront.
Final publication requires a verified data map, working privacy controls, complete business details, and legal approval.
At a glance
-
Draft reference
This page is staged for review and is not an effective privacy notice.
-
Data map required
The final notice must match the services and data flows actually enabled at launch.
-
Controls must work
Consent, access, deletion, opt-out, and appeal methods must match the live configuration.
-
Sensitive details limited
Support and safety reports should collect only information reasonably needed for review.
Reference status
This draft is not effective. Before customer data is collected on an operating storefront, REVESYN will publish a dated policy that identifies the operating legal entity and accurately reflects the Shopify, app, payment, fulfillment, analytics, advertising, messaging, support, subscription, and product-safety data flows then in use.
The existing native Shopify Privacy Policy remains a separate global resource and is not changed by this draft.
Scope and information categories
The effective policy will explain how personal information is handled when a person visits the store, places an order, uses an account, contacts support, submits a product-safety concern, manages a subscription, or interacts with another service that links to the policy.
Depending on the verified launch configuration, categories may include identifiers and contact details, order and transaction data, account data, communications, device and usage data, approximate location derived from an IP address, preferences, and information voluntarily supplied for support or product-safety review.
Purposes and sources
The final notice will identify only purposes that actually apply. These may include operating the storefront, processing payments and orders, fulfillment and delivery, subscription administration, customer support, safety and quality handling, security and fraud prevention, legal compliance, analytics, service improvement, and marketing where permitted.
Verified sources may include the customer, browser or device, Shopify, payment and fulfillment providers, enabled apps, analytics or advertising services, and other parties documented in the production data map.
Recipients and third-party services
The effective policy will identify the categories of recipients, their documented roles, and the purposes that actually apply. These may include platform hosting, payments, fulfillment, delivery, subscriptions, support, security, analytics, legal compliance, and advertising where enabled and permitted.
It will also explain any sale, sharing, or targeted-advertising treatment required by applicable law. REVESYN will not describe a service provider, processor, or legal obligation more broadly than the verified production configuration supports.
Cookies, consent, and advertising choices
The final policy and customer controls must match the live Shopify Customer Privacy settings and every enabled app. The notice will describe applicable cookie categories, consent behavior, Global Privacy Control handling, and opt-out methods only after those controls are configured and tested.
No unverified promise is made in this draft about recognizing a signal, disabling a vendor, or preventing every form of data transfer.
Choices and privacy rights
The effective policy will provide the methods and verification rules for any applicable access, correction, deletion, portability, appeal, sale or sharing opt-out, and targeted-advertising opt-out rights. The scope of a right depends on the applicable law and verified request workflow.
Health-related information submitted for product-safety review will not be used for targeted advertising. REVESYN will not ask customers to send passwords, full payment-card details, or unnecessary identity or medical documents through a general contact form.
Safety information, retention, and security
Product-safety reports may contain health-related details. Collection will be limited to information reasonably needed for review, follow-up, recordkeeping, and legally required reporting. Emergency care never depends on submitting a REVESYN web form.
The effective policy will state the retention criteria, security practices, intended audience and children’s-data position, and international-processing safeguards that actually apply. REVESYN will not promise that any system is completely secure.
Contact and finalization
Before this draft becomes effective, REVESYN will add the operating legal entity, effective date, mailing address, privacy contact method, verified request method, opt-out method, appeal method, and applicable retention criteria.
For current questions, use Contact Us and select the privacy route. Do not include passwords, full payment-card details, identity documents, or unnecessary medical information.
