Privacy policy

Who we are

MapStockist is a Shopify app that provides a store locator for merchants. This policy explains how we handle data when a merchant installs the app and when shoppers use the locator on a merchant’s store.

Data we collect from merchants

• Store details from Shopify, such as the shop domain and an access token needed to run the app.
• Location data you add: names, addresses, contact details, opening hours, images and custom fields.
• Product information from your Shopify catalogue, if you link products to locations.
• App settings, such as appearance, translations and routing rules.

Data we collect from shoppers

• Search activity on the locator: the place or text searched, the number of results, and the search centre rounded to about 1 km. When a shopper uses “Use my location”, their exact position is used for the search but only the rounded position is stored.
• Views of location pages and clicks on directions, phone, website and email links, for the merchant’s analytics.
• A random session identifier, kept in the browser tab’s session storage and cleared when the tab closes, so the merchant’s analytics can group one visit’s searches together. It is not a cookie and is not used to track shoppers across sites.
• Information submitted in contact or “become a stockist” forms (such as name, email, phone and message), together with the IP address it was sent from, to protect against spam. This is passed to the merchant.
• IP addresses are also used to rate-limit searches and form submissions. For this they are held only in the app’s memory, never written to the database, and forgotten when the app restarts.

How we use data

We use data only to provide the app: showing locations, running searches, sending lead notifications, and producing analytics for the merchant. We do not sell data. Merchants can see and export the data collected on their store.

Our support staff can access a store’s data in the app to help a merchant or fix a problem. Every change they make is recorded in an audit log.

Third parties

• Addresses, and places shoppers search for, are sent to a geocoding provider (OpenStreetMap Nominatim, Google or Mapbox, depending on how the app is set up) to find coordinates.
• Maps are loaded by the shopper’s browser from the map provider: OpenStreetMap for the included map, or Google Maps or Mapbox if the merchant uses their own key. These providers receive the shopper’s IP address as part of that request.
• Lead notifications are sent through our email delivery provider.
• The app and its database are run on our hosting provider’s servers.

Data deletion and requests

When a merchant uninstalls the app, we stop accessing their store straight away. About 48 hours later Shopify asks us to delete the store’s data, and we delete all of it: locations, leads, analytics and settings.

When a shopper asks a merchant for their data through Shopify, we email the merchant everything that shopper submitted through the locator’s forms, so the merchant can respond. When Shopify asks us to delete a shopper’s data, we delete their form submissions.

Contact

Questions about privacy? Email hello@mapstockist.com.