Ratevo — Privacy Policy

Ratevo ("the App") provides product reviews for Shopify stores. This policy describes what data the App collects, why, and how it is handled.

Data we collect

• Review content submitted by shoppers: rating, review text, optional name, optional email, optional size/fit details, and uploaded photos/videos.
• Order lookups: when a shopper submits a review with an email, the App queries the store's orders solely to determine whether the shopper purchased the reviewed product ("verified purchase" badge). Order data is not stored by the App beyond a short-lived cache.
• Store data: store domain, app settings, and aggregated review statistics.

How data is used

Data is used only to operate review features for the store that installed the App: displaying reviews on the storefront, moderation in the admin, verified-purchase badges, and review statistics. Data is never sold or shared with third parties for advertising.

Storage

Review data is stored in the App's database. Uploaded media is stored in private object storage. Data is retained while the App is installed.

Data subject rights (GDPR)

• Data access: shoppers can request their data through the store; the App fulfils Shopify's customers/data_request webhook.
• Erasure: on customers/redact, the App anonymizes the shopper's personal information (name, email, body measurements) in their reviews.
• Store deletion: 48 hours after the App is uninstalled, all of the store's data is deleted on shop/redact.

Data Processing Terms

These terms form the data processing agreement between the merchant and the App provider. By installing the App, the merchant accepts them.

• Roles: the merchant is the data controller of shopper personal data. The App provider (MeiYi) acts as data processor and processes personal data only on the merchant's behalf and on their documented instructions, which are represented by the App's settings and features.
• Scope of processing: review submissions (rating, review text, optional name and email supplied by the shopper, optional size and fit details, uploaded photos and videos) and order lookups performed solely to determine verified-purchase status. The App does not request customer name, address, phone, or email fields from Shopify's APIs.
• Purpose limitation: personal data is processed only to operate the review features described above. It is never sold, never used for advertising, and never shared with third parties for their own purposes.
• Sub-processors: Alibaba Cloud (object storage and hosting, Hong Kong region) stores uploaded review media and application data on the App provider's behalf. No other sub-processor receives personal data.
• International transfers: data is stored and processed in the Hong Kong region. The App provider remains responsible for personal data handled by its sub-processors.
• Security: all traffic between shoppers, merchants and the App is encrypted in transit over HTTPS. Media is kept in a private bucket that is not publicly listable. Access to production systems is limited to authorised personnel who need it for operations and support.
• Retention: verified-purchase lookups are held in a short-lived in-memory cache (30 minutes) and never stored. Review data is retained while the App is installed.
• Deletion and data subject requests: the App implements Shopify's customers/data_request, customers/redact and shop/redact webhooks. On customers/redact the shopper's personal fields are anonymised; on shop/redact (48 hours after uninstall) all of the store's data is deleted.
• Incidents: the App provider will notify the merchant without undue delay after becoming aware of a personal data breach affecting their data.
• Definitions: "personal data", "data controller", "data processor" and "processing" carry the meanings given in the GDPR.

Contact

Questions about this policy, the data processing terms, or data requests: bronck88@gmail.com

Last updated: 2026-08-26