Integritetspolicy

Last updated: 24/Sep/2026

Releasit is operated by Shop Circle Ltd, One Kingdom Street, Paddington Central, London W2 6BD, United Kingdom ("Releasit", "we", "us"). This policy applies to releas.it, store.releas.it, any online store we operate on Shopify, and the Releasit apps on Shopify and Tiendanube: COD Form & Upsells, Cash On Delivery (COD Fee) and Bundles & Upsells. Where it conflicts with our Terms of Service on the handling of personal information, this policy controls.

We handle two kinds of data. Merchant data is about you and your store, or about you as a customer of a store we operate; we are the controller. Customer Data is about your customers and passes through our apps when they order; you are the controller and we are your processor under our Data Processing Addendum (DPA), which governs where it differs from this policy.

1. Merchant data

What we collect. Name, email, phone, store name and URL, billing and payout details, your messages to support, and — automatically — IP address, approximate location, browser, device, pages and actions in the app, and error logs.

Why. To provide, bill and support the apps; to send service and security notices; to send product news you can opt out of; to run the affiliate programme; to improve and secure the apps; to prevent fraud; to meet legal obligations.

We may aggregate or de-identify merchant data so it no longer identifies you or your store and use the result to improve our products and report on our business.

2. What we access from your store platform

Shopify. On install, Shopify shares the data covered by the permissions you approve: store details, products, orders, customers, checkouts, translations and Markets settings, and checkout configuration where the app runs inside checkout. We act on Shopify's data-request and erasure requests on your behalf.

Tiendanube. On install, Tiendanube shares the store, product, order and customer data covered by the permissions you approve. We support your obligations under the data-protection laws of your market, including Brazil's LGPD.

3. Customer Data

Depending on the features you enable, we process your customers' name, delivery address, phone number, email, order contents and value, IP address and location, one-time verification codes, and abandoned-checkout details. We use this only to create orders, apply COD fees and partial payments, run OTP verification and abandoned-checkout messages by SMS or WhatsApp, apply the delivery-coverage and blocking rules you configure, and report results to you.

We do not sell Customer Data, use it to market to your customers, or share it except with the providers in section 6 and where the law requires. Coverage and blocking rules are set by you and involve no profiling by Releasit. You are responsible for your own privacy notice and lawful basis toward your customers, and for the channels, rules and marketing pixels you choose to enable.

4. Google Sheets

If you enable the export, we request read-only access to Google Drive to let you pick a spreadsheet and read/write access to Google Sheets to write your orders into it. We store only the file ID and sheet name. Our use of Google API data complies with the Google API Services User Data Policy, including its Limited Use requirements.

5. Online stores we operate

If you visit or buy from a store we operate on Shopify, we also collect your contact and shipping details, payment and transaction information, account credentials, items viewed or purchased, and your communications with us. We use this to fulfil orders, process payments, manage your account, provide support, prevent fraud, and — where permitted — send marketing you can opt out of.

The store is hosted by Shopify, which processes personal information to provide and improve the service, and we use Shopify enhanced features that draw on your interactions with our store, other merchants and Shopify. For that processing Shopify is the responsible party; its practices and your rights are described in the Shopify Consumer Privacy Policy.

6. Who we share data with

• Service providers acting on our instructions: hosting, SMS and WhatsApp messaging, support desk, email delivery, payment processing, analytics, fulfilment and shipping, and the store-builder provider behind store.releas.it.
• Your store platform (Shopify or Tiendanube).
• Shop Circle group companies, for administration, security and analytics under this policy.
• A buyer or successor if Releasit or Shop Circle is sold, merged or reorganised.
• Authorities, where required by law or to protect our rights, our users or the public.

We do not sell personal data. Where advertising partners are used on a store we operate, you can opt out as described in section 10.

7. Legal bases and international transfers

Where the UK or EU GDPR applies, we process merchant data to perform our contract with you, for our legitimate interests (improving and securing the apps, preventing fraud, running our business), with your consent (marketing, non-essential cookies, optional integrations), and to meet legal obligations. Customer Data is processed on your instructions under the DPA.

Data may be processed outside the country you live in, including in the United States, by us and our providers. Where it leaves the UK or EEA, we rely on the UK International Data Transfer Addendum, EU Standard Contractual Clauses or an adequacy decision.

8. Retention

Merchant and store data is kept while the app is installed and deleted 48 hours after uninstall. Order, checkout and verification records are kept for up to 30 days unless you delete them sooner. Otherwise we keep personal information only as long as needed to provide the services, maintain your account, comply with law, resolve disputes and enforce our agreements. Billing and payout records are kept as long as tax and accounting law requires. Backups may persist for a limited period after deletion. Aggregated or de-identified data may be kept indefinitely.

9. Security and incidents

We protect data with encryption in transit and at rest, access controls, monitoring and independent security testing. No system is perfectly secure and we cannot guarantee against every unauthorised access; do not send sensitive information over unsecured channels. If a personal-data breach affects your data, we will notify you without undue delay, within the period the DPA and applicable law require, and support your own notifications.

10. Your rights

Depending on your location, you may access, correct, delete, restrict, object to or port your personal data, withdraw consent, and complain to your data-protection authority (in the UK, the ICO). Where applicable law gives you the right to opt out of the "sale" or "sharing" of personal information or its use for targeted advertising, you can do so by contacting us; we treat a Global Privacy Control signal from your browser as an opt-out request for that browser and device. We do not recognise other "Do Not Track" signals. You may appoint an authorised agent to act for you, subject to proof of authority. We will not discriminate against you for exercising any right, and where local law provides it you may appeal a decision we make on your request.

Shoppers whose data reached us through a merchant's use of our apps should contact that merchant first; we act on the merchant's instructions and will assist.

To exercise any right, email legal@releas.it or shruti@shopcircle.co, or write to the address above. We may verify your identity and will respond within one month or the shorter period your local law requires. For the purposes of applicable data-protection law, Shop Circle Ltd is the data controller of merchant data.

11. Cookies, children and changes

Our website, app admin and any store we operate use cookies for sign-in, preferences, security, analytics and — on a store — advertising (Google Analytics on releas.it; opt out via Google's browser add-on or your browser settings). Emails we send may include open and click tracking; you can unsubscribe from marketing at any time and will still receive account and order notices.

Our services are for businesses and not directed at anyone under 18. We do not knowingly collect children's data; a parent or guardian may contact us to have it deleted. We do not have actual knowledge that we sell or share personal information of anyone under 16.

We will post changes here, update the date above and give notice as applicable law requires; material changes to how we handle merchant data will be announced in the app or by email before they take effect. Questions: legal@releas.it.