This Privacy Policy describes how Jewelry Studio Manager, operated by JMS Dev Lab ("we," "us," or "our"), collects, uses, and protects information when you use our Shopify application and associated services (the "Service").
By using the Service, you agree to the collection and use of information in accordance with this policy. If you do not agree with this policy, please do not use the Service.
1. Information We Collect
1.1 Account Information
When you create a Jewelry Studio Manager account, we collect:
- Your name and email address
- Your Shopify store domain and store information
- Business name and contact details
- Billing information (processed through Shopify's billing system)
1.2 Client Data
In the course of using the Service, you may store information about your clients, including:
- Client names, email addresses, and phone numbers
- Physical addresses
- Design preferences, ring sizes, metal and gemstone preferences
- Budget information and payment history
- Communication history and appointment records
- Commission details and project files
1.3 Shopify Data
With your authorization, we access certain data from your Shopify store:
- Customer records (names, emails, order history)
- Order and product information
- Store configuration and settings
We only access the Shopify data scopes necessary for the Service to function. You can review these scopes during the app installation process.
1.4 Automatically Collected Information
- Log data (IP address, browser type, pages visited, timestamps)
- Device information (operating system, screen resolution)
- Usage analytics (features used, session duration)
2. How We Use Your Information
We use the collected information to:
- Provide, maintain, and improve the Service
- Process and manage your commissions and client relationships
- Sync data between your Shopify store and the Service
- Send transactional emails (appointment reminders, commission updates)
- Provide customer support
- Generate aggregated, anonymized analytics to improve our product
- Comply with legal obligations
3. Data Storage and Security
We take the security of your data seriously and implement industry-standard measures:
- All data is encrypted in transit using TLS 1.2 or higher
- Sensitive data (such as Shopify access tokens) is encrypted at rest using AES-256-GCM
- Authentication tokens are stored in HttpOnly cookies only, preventing client-side JavaScript access
- We do not store passwords in plain text; all passwords are hashed using bcrypt
- Database access is restricted and monitored
- CSRF protection is implemented on all state-changing operations
4. Cookies
We use strictly necessary cookies to operate the Service:
- Authentication cookies: HttpOnly, secure cookies that maintain your session. These cannot be accessed by client-side scripts.
- Security state: Short-lived, signed CSRF tokens and browser-origin checks protect state-changing requests.
On the public website, we use Plausible Analytics and Google Tag Manager to understand aggregate traffic. Optional analytics storage remains denied until you accept the cookie banner; advertising storage and ad personalization remain disabled. We do not sell cookie data.
Pages containing videos use YouTube's privacy-enhanced embed domain. Your browser still connects to YouTube when an embedded player loads or you choose to play a video, and YouTube may process device, network, and viewing information under its own privacy terms. You can instead follow the direct YouTube link.
5. Data Sharing
We do not sell, rent, or trade your personal information. We may share data only in the following circumstances:
- Shopify: We exchange data with Shopify as necessary for app functionality and billing.
- Service providers: We use service providers for hosting, email delivery, aggregate website analytics, and embedded training video delivery. They process only the information needed to provide those services.
- Legal requirements: We may disclose information if required by law, regulation, or legal process.
- Business transfers: In the event of a merger, acquisition, or sale, user data may be transferred as part of the business assets.
6. Data Retention
We retain your data for as long as your account is active or as needed to provide the Service. Specifically:
- Account data is retained for the duration of your subscription
- Client data you store in the Service is retained until you delete it or ask us to close and erase the account
- Account closure and erasure requests are handled through support. We will confirm the applicable deletion schedule, including any backup or legal-retention period, when we process the request.
- Certain anonymized, aggregated data may be retained for analytics purposes
- We retain data as required by applicable law (e.g., billing records)
7. Your Rights (GDPR and Global Privacy)
Regardless of your location, we respect your data rights. You have the right to:
- Access: Request a copy of the personal data we hold about you
- Rectification: Request correction of inaccurate personal data
- Erasure: Request deletion of your personal data ("right to be forgotten")
- Data portability: Request your data in a machine-readable format
- Restriction: Request restriction of processing of your data
- Objection: Object to processing of your data
- Withdraw consent: Where processing is based on consent, you may withdraw it at any time
To exercise any of these rights, please contact us at [email protected]. We will respond within 30 days.
8. GDPR Compliance
For users in the European Economic Area (EEA), we process personal data under the following legal bases:
- Contract performance: Processing necessary to provide the Service you requested
- Legitimate interests: Processing necessary for our legitimate business interests (e.g., improving the Service), provided these do not override your rights
- Legal obligation: Processing necessary to comply with applicable laws
- Consent: Where you have given explicit consent for specific processing
9. Shopify GDPR Webhooks
In compliance with Shopify's requirements, we handle mandatory GDPR webhooks:
- Customer data request: We provide all stored data for a specific customer upon request
- Customer data erasure: We delete all stored data for a specific customer
- Shop data erasure: We delete all data associated with a shop when the app is uninstalled
10. Children's Privacy
The Service is not directed at individuals under the age of 16. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child, we will take steps to delete that information promptly.
11. International Data Transfers
Your data may be processed in countries other than your country of residence. When we transfer data internationally, we implement appropriate safeguards including standard contractual clauses and ensure an adequate level of data protection.
12. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on our website and, where appropriate, by email. The "Effective date" at the top of this page indicates when the policy was last revised.
13. Contact Us
If you have questions about this Privacy Policy or our data practices, please contact us:
For GDPR-related inquiries, you may also contact your local data protection authority.