Feedpack privacy policy

This policy explains how Vestrivo (“we”, “us”) handles personal information in Feedpack, our Shopify app for collecting and showing product reviews. Vestrivo is responsible for the personal information described in this policy. Our website is covered by a separate website privacy notice.

Feedpack is used by Shopify merchants (“you”) to collect and show reviews from their customers (“shoppers”). For shopper information, the merchant decides why it is collected and how it is used, and we process it on the merchant’s behalf and instructions. For information about the merchant’s own account, we decide how it is used.

If you’re a shopper with a question about a store’s reviews, the store is usually the best first contact. You can also contact us.

• Store details. Your store’s Shopify domain, name, main language and public web address, and the access credentials Shopify issues to the app.
• Products. Product IDs, titles, handles, images, status, tags, vendor, SKUs and barcodes, used to match reviews to products and to identify products for Google.
• Orders. Order number, items, fulfilment and delivery dates, cancellation status, and the customer’s name, email and language. We read orders to confirm purchases and to schedule review requests.
• What you create in Feedpack. Your settings, replies to reviews, feeds, and the review files you import.

• Reviews. The reviewer’s name as they give it, email address, rating, title, text, photos and videos, the product and variant, language, date, whether the review received an incentive, and a link to the order. Reviews imported from another app may also include a location.
• Review requests. Name, email address, language, order number and items, and when a request is due, sent or completed.
• Technical data. When a shopper submits a review, their IP address is used briefly to prevent abuse. It isn’t stored with the review.

Published reviews show the reviewer’s name, rating, text, photos or videos, date, product and badges such as “verified buyer”. Email addresses and order numbers are never shown.

• To show published reviews in the merchant’s store and in the Feedpack admin.
• To mark a reviewer as a verified buyer only when the Shopify order exists, wasn’t cancelled and contains the reviewed product.
• To send review requests and at most one reminder on the merchant’s behalf, when the merchant turns collection on.
• To keep each product’s average rating and review count in Shopify’s standard rating fields, when the merchant turns this on. These fields contain no personal information.
• To publish a product reviews file for Google Shopping at the merchant’s store address. It contains published reviews with the reviewer’s first name and last initial, and Google reads it only if the merchant submits it.
• To provide support, keep the service secure and meet our legal obligations.

We don’t sell personal information, use it for advertising, or combine shopper information across different stores.

Where data protection laws such as the GDPR apply, we process merchant information to provide the service you signed up for (contract), to keep it secure and improve it (legitimate interests), and to meet legal obligations. We process shopper information on the merchant’s instructions; the merchant is responsible for having a legal basis, such as consent or legitimate interests, for asking customers for reviews and publishing them.

We use these service providers, acting on our instructions:

• Shopify — the platform Feedpack runs on.
• Railway — hosting for the Feedpack application and its database.
• Railway object storage (Amsterdam, Netherlands) — copies of review photos and videos.
• Resend — delivery of review-request emails, once sending is available.

Published reviews are public on the merchant’s store. Google receives the reviews file only if the merchant submits it to Google Merchant Center. We may also disclose information when the law requires it, or to a successor if our business is transferred, under the same protections.

• Reviews, their photos and videos, and review-request records are kept while the merchant uses Feedpack. Merchants can hide or delete any review at any time; deleting a review also deletes its photos and videos.
• Import records are kept so the merchant can check an import and undo it. The rows of an imported file are deleted 30 days after the import.
• When a merchant uninstalls Feedpack, Shopify sends us a deletion request 48 hours later, and we then delete that store’s data: reviews with their photos and videos, review requests, products, imports, settings and credentials.
• We keep a short record of each privacy request — the store, the type of request, when it arrived and when it was handled, and for data requests the Shopify customer ID — to show it was dealt with.

Depending on where you live, you may have the right to access, correct or delete your personal information, to object to or restrict its use, and to receive a copy. Shopify forwards shoppers’ requests to us automatically:

• Data requests. We prepare the information we hold about that customer so the merchant can respond.
• Erasure requests. We remove the customer’s name, email address, location, order link and purchase details from their reviews and delete their review requests. The rating, text and any photos may remain, without the customer’s name or contact details.

Merchants can download every review as a CSV file at any time. To make a request yourself, use the contact form (choose “Privacy request”) or email support@ampersand.co.il. You can also complain to your local data protection authority.

Feedpack is served over HTTPS, and only people who need access to run the service can reach its systems. Feedpack asks Shopify only for the permissions it uses:

• Read products — to match reviews to products.
• Write products — to update Shopify’s standard product rating fields.
• Read orders, including older orders — to confirm purchases and schedule review requests.
• App proxy — to serve reviews at an address on the merchant’s own store.

Our service providers may process information outside your country. Where the law requires it, we use appropriate safeguards for these transfers.

Feedpack is a business tool for merchants and isn’t directed at children.

We’ll update this page when our practices change and revise the date at the top. We’ll tell merchants about significant changes in the app or by email.

Questions about this policy or a privacy request: email support@ampersand.co.il or visit our support page.