Weathercop app privacy policy

Weathercop is operated by Zanar s. r. o., Sklenárska 6, 811 02 Bratislava – Staré Mesto, Slovakia, company registration number (IČO) 54063094. You can contact us about privacy at hello@weathercop.io.

This policy explains how we handle personal data in the Weathercop Shopify app and related merchant support and privacy requests. It does not replace the privacy policies of a merchant's store, Shopify or the merchant's email platform. It does not describe unrelated browsing or advertising on our marketing website.

Weathercop checks forecasts for supported cities and compares them with weather rules selected by a merchant. When a rule matches, it sends an event with the merchant's selected products to their connected marketing account. That platform's flow, settings and suppression rules determine whether an email is sent.

Store customers. We process the merchant's customer data on the merchant's instructions to provide Weathercop. The merchant controls its customer relationship, chooses its campaigns and marketing platform, and is responsible for its lawful basis and any consent required for marketing. We do not sell merchant customer data, share it for third-party advertising, use it for our own marketing or use one merchant's customer data to build audiences for another merchant.

Merchants and their staff. We are responsible for our own use of merchant account, service, support and privacy-request information. We use it to provide and administer the service, communicate with merchants, maintain security and reliability, and meet legal obligations.

We receive store data through Shopify permissions authorised by the merchant. The app requests read access to customers, products, orders, inventory and locations. We also receive connection details and settings entered by the merchant and generate records as the app operates.

Store and session information: store domain, identifiers, name, contact email, timezone, currency, authorisation credentials and staff session details where supplied by Shopify

Shopify supplies this information so we can authenticate app access, call its APIs, associate settings with the correct store and support the merchant.

Customer information: identifiers, names, email addresses, phone numbers, tags, consent status and associated timestamps

Received from Shopify and synchronised for the app. Email, names and identifiers support event delivery; consent information is used to check marketing eligibility. Phone numbers and tags are also synchronised even though they are not included in the weather event sent to Klaviyo.

Default customer address: street lines, city, region, postcode, country and address phone number

Received from Shopify and synchronised by the app. City and country are matched to an active supported city for forecast selection. The synchronised record includes the full default address, even though street, postcode and phone are not needed in the event sent to Klaviyo.

Products, inventory and store locations

Shopify supplies catalogue details, images, links and inventory/location information so merchants can choose products for a weather rule and apply stock conditions.

Orders and line items: identifiers, dates, totals, customer identifiers, landing/referring URLs and attribution parameters, product/variant identifiers, titles, quantities, SKUs and prices

Received from Shopify to connect orders to weather campaigns and calculate attribution reports.

Marketing connection and app configuration: provider credentials, event names, weather rules, forecast days, cooldowns, product selections and stock settings

Entered by the merchant to configure and operate their automation.

Event, delivery and operational records

Generated by the app to dispatch events, record attempts and errors, apply cooldowns, measure usage, show activity and attribution, and investigate problems. Event history can include customer names, email addresses, identifiers, matched-city information, forecasts and selected products.

Support and privacy-request information

Supplied by the person contacting us, the merchant or Shopify, and used to answer the enquiry, verify authority and fulfil the request. We also keep the operational records needed to document its handling.

Weathercop uses a customer's supported-city forecast rather than a precise GPS position. It does not ask store customers to provide data directly to the app. Marketing eligibility is checked using synchronised Shopify consent information; merchants should also maintain the appropriate consent and suppression settings in their marketing platform.

We disclose information to the parties needed to provide the service, fulfil merchant instructions, handle support and privacy requests, comply with law or protect legal rights.

• The merchant's connected marketing platform. Klaviyo receives the customer's email address, first and last name, event and customer identifiers, matched city/region/country, forecast and rule details, selected products and tracked product links. The event can create or update a profile. A merchant-initiated test event also uses the address entered for that test. If a merchant selects an available Bloomreach connection, the customer's email is used as a customer identifier and the weather-event properties are sent to that account. The merchant controls these accounts and their email flows. Street addresses, postcodes, phone numbers, tags and order records are not included in the weather-event payload sent to Klaviyo.
• Shopify. We use Shopify's authentication, APIs and privacy webhooks to operate the installed app and handle store/customer requests.
• Infrastructure providers. Render hosts the app, Supabase hosts its transactional database, and Google Cloud provides background processing, scheduling, the data warehouse and operational logging. They process the app data needed for these functions, including personal data.
• Monitoring and operational support. Sentry is used for error monitoring when configured; operational alerts may use Slack and cloud logging. Diagnostics can contain store identifiers, request or event references and error information. The app's monitoring controls restrict default personal-data collection and scrub sensitive request information; we do not treat diagnostic records as a place to collect customer contact details.
• OpenWeather. Forecast requests contain supported-city coordinates and our provider credential, without customer identifiers, names, email addresses or addresses.
• Authorities and professional advisers. We may disclose information where required by law or necessary to establish, exercise or defend legal rights. We limit such disclosures to the relevant information.

Our providers may process information outside the European Economic Area. A restricted transfer requires an applicable legal basis and safeguards under data-protection law. For information about the processing countries and transfer safeguards relevant to your store, contact hello@weathercop.io.

We retain data for the purposes described in this policy. The criteria depend on the record, the installation's status, merchant instructions, privacy requests and any applicable legal obligations.

• Active stores: we retain synchronised customer, order, catalogue and configuration data to operate the installed app, maintain event history and cooldowns, and provide attribution and support. Active-store customer and order records do not have a fixed automatic expiry. They remain subject to verified deletion requests and are removed when no longer needed for these purposes, unless law requires retention.
• Uninstalling: we stop automation, disable triggers, cancel pending work and remove the stored Shopify session and marketing-provider credentials. Uninstalling does not itself immediately erase every customer, order or history record. Shopify's subsequent shop-deletion request initiates removal of the remaining store-scoped data from the app's databases.
• Customer deletion requests: the app removes customer/address records and weather-location mappings and redacts customer information in event and attribution records. Some order, line-item and event-history records can remain with the customer association and relevant identifying payload fields removed. This is not a promise to erase every historical transaction record.
• Operational and historical records: forecasts, completed delivery records and eligible trigger history may be removed by configured age-based cleanup. This cleanup does not impose a universal expiry on all app data. We retain support, security, privacy-request and business records only for the purpose for which they are needed, including applicable legal obligations and resolving disputes.

Deletion from Weathercop does not retract events already delivered to the merchant's marketing platform. The merchant must also handle deletion and suppression in that account. Residual copies in provider backups may remain until overwritten or deleted under the provider's backup lifecycle; where retained, they must not be restored to active use for an incompatible purpose.

We use technical and organisational measures appropriate to the personal data and the service, including Shopify authorisation, verification of Shopify webhook signatures and controls on access to service data. The app applies encryption to stored marketing-provider credentials and customer contact/address fields in its data warehouse. Event history and other operational records can also contain personal data; this statement is not a claim that every copy or field is encrypted by the application.

We restrict use of customer data to providing and supporting the service and responding to legal and privacy obligations. No system is completely secure. We investigate security incidents and provide the notifications required by applicable law.

For merchant account and support data where we act as controller, our bases are performing our contract with the merchant, our legitimate interests in administering, securing and supporting the service, and compliance with legal obligations. Where we rely on consent for a particular activity, it may be withdrawn without affecting earlier lawful processing. The merchant determines the lawful basis for processing its customers' data and sending its marketing; our processing on its behalf does not create consent to receive marketing.

Subject to applicable law, you may request access, correction, erasure, restriction or portability of your personal data, and object to processing based on legitimate interests. You may also complain to your local data-protection authority or the Slovak Office for Personal Data Protection.

Store customers: contact the merchant first because it controls your customer relationship. We assist the merchant with requests, including Shopify's customer-data and deletion requests. Data-access requests involve verification and preparation of an export for delivery through an appropriate secure process; receipt of a webhook does not automatically email an export.

Merchants, staff and people contacting us directly: write to hello@weathercop.io. Please identify the relevant store and request without including passwords, API keys or unnecessary sensitive information. We may need to verify your identity or authority before acting. We respond within the period required by applicable law and explain any lawful exception or extension.

We update this policy when our practices change and show the latest date above. We will bring material changes to merchants' attention through the app or the store contact details available to us, where appropriate.

Privacy contact: hello@weathercop.io. You can also write to Zanar s. r. o., Sklenárska 6, 811 02 Bratislava – Staré Mesto, Slovakia (IČO 54063094).