Wishlist Power Privacy Policy

This Privacy Policy explains how Maestrooo SAS ("Maestrooo," "we," "us" or "our") handles personal data in connection with the Wishlist Power Shopify application and its documentation and support services (the "Services").

Maestrooo SAS
11 rue René Goscinny
75013 Paris, France
Email: app-wishlist-power@maestrooo.com

1. Our roles

Maestrooo acts as a controller for personal data relating to Shopify merchants, their authorised users, our business relationship, support, product analytics and the security of the Services.

For personal data relating to a merchant’s shoppers and wishlists, the Shopify merchant is normally the controller and Maestrooo acts as its processor. That processing is governed by our Data Processing Addendum ("DPA"). Shoppers should generally direct privacy requests to the Shopify merchant whose store they used.

2. Personal data we process

Merchant and authorised-user information

• Shopify shop domain, store information, Shopify merchant or staff identifiers and contact details made available through Shopify;
• installation, authentication and access-scope information, including credentials and tokens needed to connect the Services to Shopify;
• plan, subscription, entitlement, feature configuration and aggregate usage information;
• theme, integration and application settings;
• support messages, contact details and information supplied when requesting support; and
• application usage, locale, device information, session and diagnostic information.

Shopper and wishlist information processed for merchants

• Shopify customer ID or a pseudonymous guest wishlist identifier;
• wishlist name and public/private sharing status;
• wishlist product and variant identifiers, contents, timestamps, additions and removals;
• customer first and last name, which may be retrieved from Shopify and displayed to authorised merchant users but is not stored in Wishlist Power’s primary database;
• customer email address, which may be retrieved for merchant-enabled Klaviyo functionality or stored temporarily in merchant-initiated wishlist import and result files;
• customer identifiers, email address and phone number contained in Shopify privacy-request payloads; and
• limited IP address, browser user-agent, request path and error context used for security, diagnostics and operational monitoring.

Wishlist Power is not intended to process special-category or similarly sensitive personal data. Merchants should not submit such data through the Services.

3. How we obtain personal data

We obtain information from Shopify and its APIs, directly from merchants and authorised users, from shopper interactions with wishlist functionality, from merchant-configured integrations, and automatically from the operation and security monitoring of the Services.

4. Why we use personal data

Purpose	Typical legal basis when Maestrooo is controller
Provide, authenticate, bill, maintain and support the Services	Performance of our contract with the merchant
Secure the Services, prevent abuse, diagnose errors and maintain reliability	Our legitimate interests in protecting and operating the Services
Understand merchant use and improve product functionality	Our legitimate interests in improving the Services
Manage support and business communications	Performance of a contract and our legitimate interests in customer support
Comply with legal, tax, accounting and regulatory obligations	Compliance with legal obligations

When Maestrooo acts as processor for shopper data, we process it only on the merchant’s documented instructions, including the merchant’s installation, configuration and use of Wishlist Power, as described in the DPA.

5. Wishlist functionality and merchant-directed integrations

Wishlist product identifiers and item counts for registered shoppers may be written to Shopify customer metafields. Customer and product identifiers may also be sent to Shopify Flow when enabled by the merchant.

If a merchant enables Klaviyo, Google Analytics 4, Meta Pixel or TikTok Pixel, relevant customer, wishlist, product or event information may be transmitted to the merchant’s own account with that provider. Those integrations are selected and controlled by the merchant and are subject to the merchant’s agreements and privacy disclosures.

6. Local storage, session storage and cookies

Wishlist Power uses browser storage needed to provide the requested functionality. This can include a persistent pseudonymous guest wishlist identifier, cached wishlist contents and temporary session information used to transfer wishlist events or merge a guest wishlist after sign-in. Visitors can clear this information through their browser settings, although doing so may reset or remove access to a guest wishlist.

The embedded merchant application may use essential Shopify authentication cookies or similar technologies. Merchant-enabled analytics or marketing integrations may set their own cookies or identifiers under the merchant’s configuration and privacy policy. Maestrooo does not use shopper data for its own targeted advertising.

7. Service providers and recipients

We use providers that support the operation of Wishlist Power, including:

• Amazon Web Services for application hosting, database, object storage, queues, backups, logging and secret management in the AWS Europe (Paris) region;
• Mixpanel for merchant application analytics and experience monitoring, using EU data residency in production and configured so shopper personal and sensitive information is not captured in session replay;
• Mantle for merchant subscription, entitlement, usage and business analytics;
• Help Scout for documentation and merchant support;
• Slack for restricted operational, privacy-webhook and security notifications; and
• Twenty CRM, operated by Maestrooo in France, for merchant relationship and entitlement management.

We may also disclose information where required by law, to protect legal rights or security, or as part of a merger, financing, acquisition or sale of assets subject to appropriate safeguards. We do not sell personal data and do not share personal data for Maestrooo’s own cross-context behavioural advertising.

The current subprocessor details, processing locations and transfer safeguards are provided in the DPA.

8. International transfers

The primary Wishlist Power production infrastructure and database are hosted in France in AWS Europe (Paris). Some supporting providers may process limited information outside the European Economic Area. Where required, we rely on an adequacy decision, the EU–US Data Privacy Framework for eligible certified recipients, or the European Commission’s Standard Contractual Clauses together with supplementary measures where appropriate.

9. Retention

• Live customer and guest wishlist records are retained while Wishlist Power remains installed and active.
• After uninstall, store and shopper data is retained for a 30-day reinstall grace period. Reinstallation during that period cancels the scheduled deletion; otherwise deletion begins promptly after the grace period.
• Valid individual customer-deletion requests are processed without undue delay.
• Database backups expire within 30 days; API Gateway access logs are retained for seven days; and failed background-job messages are retained for up to 14 days.
• Partial wishlist import files are removed as the workflow completes. Completed import result files are automatically deleted after 30 days.
• Slack operational and security notifications are retained for up to 30 days unless longer retention is required for a security investigation or by law.
• Mixpanel and Mantle analytics are retained for two years.
• Help Scout support conversations are retained indefinitely, except where deletion is required by applicable data protection law or through a verified privacy request. Merchants should not submit unnecessary shopper personal data in support conversations.
• Merchant account, contractual and business records are retained for the relationship and any additional period required to comply with legal obligations, resolve disputes and enforce agreements.

10. Security

We use technical and organisational safeguards appropriate to the risks of the processing. These include encryption at rest for the production database, Amazon S3 and backups; HTTPS/TLS externally and encrypted production database connections; multi-factor authentication for production administration; least-privilege access; separated development, staging and production environments; confidentiality obligations; security logging and monitoring; and regular dependency and security updates.

No method of transmission or storage is completely secure, but we work to protect personal data against accidental or unlawful loss, alteration, disclosure and access.

11. Your privacy rights

Depending on applicable law, individuals may have rights to access, correct, delete or restrict personal data, object to certain processing, receive portable data, withdraw consent and lodge a complaint with a supervisory authority.

Merchants and authorised users may submit requests to app-wishlist-power@maestrooo.com. We may request information needed to verify the requester and protect the account.

For shopper wishlist data, the relevant Shopify merchant is the controller and should normally receive the request first. When we receive a shopper request concerning merchant-controlled data, we may refer it to the merchant or assist the merchant in responding. Individuals in France may also contact the CNIL.

12. Children

Wishlist Power is provided to Shopify merchants and is not directed to children. Merchants are responsible for ensuring that their storefront use of Wishlist Power and any collection of shopper information comply with laws applicable to children and minors.

13. Changes to this policy

We may update this Privacy Policy to reflect changes to the Services, our practices or applicable law. We will post the revised version here and update the date above. Where required, we will provide additional notice.

14. Contact

Questions or privacy requests may be sent to:

Maestrooo SAS
11 rue René Goscinny
75013 Paris, France
app-wishlist-power@maestrooo.com