1. Introduction
This Privacy Policy explains how So Super (“Locations So Super”, “we”, “us” or “our”)
collects, uses, discloses and safeguards information when you use our store locator, map and directory
application and related website, dashboard, hosted locator and public API (together, the Service).
The Service is offered both as a Shopify app and as a hosted (“standalone”) platform. By creating an
account, installing the app, or otherwise accessing the Service, you agree to the practices described in this policy.
If you do not agree with this policy, please do not use the Service.
2. The roles we play (controller vs. processor)
Data-protection laws distinguish between the party that decides why and how personal data is processed
(the controller) and the party that processes it on someone else’s behalf (the processor).
We act in both capacities:
-
As a processor for our merchants: the location data, custom fields, tags, images and other
content you upload to the Service (“Merchant Content”) is processed on your behalf and
under your instructions. You are the controller of that data and are responsible for having a lawful
basis and for the accuracy of what you publish. We only process Merchant Content to provide the Service.
-
As a controller for account, billing, support and technical data: when you sign up for a hosted
account, subscribe to a plan, contact support, or use our API, we determine how that information is processed and
act as the controller.
3. Information we collect
3.1 Information you give us
- Account data. For hosted accounts, your email address and an encrypted password. For Shopify
merchants, your shop domain and the shop profile data Shopify shares with the app.
- Merchant Content. The locations you create or import — including name, address, geographic
coordinates, phone, email, website, opening hours, tags, custom fields, translations and any image URLs you supply.
- Billing data. Plan selection and billing contact details. Card numbers are handled directly by
our payment processors; we do not store full payment card numbers.
- Support & communications. Messages you send us (for example to
[email protected]) and your replies to our emails.
3.2 Information collected automatically
- Storefront analytics. To power search and traffic reports for merchants, we record anonymous
usage events on the public locator (such as searches performed and map interactions), grouped under a random,
rotating session identifier that expires after 30 minutes of inactivity. We do not store visitor IP
addresses or user agents as part of these storefront analytics sessions.
- API request logs. When the public REST API is used, we log the request method, path, response
status, duration, request identifier, and — for security and abuse prevention — the caller’s IP address and
user agent.
- Performance & error data. We log application errors, performance metrics and basic request
metadata (such as user agent and page path) to monitor reliability and diagnose problems.
- Cookies & similar technologies. See section 5.
3.3 Information we receive from Shopify
If you install the Service as a Shopify app, we receive certain shop information from Shopify (such as your shop
domain and store profile) through the Shopify API, and we access it in accordance with Shopify’s terms and this
policy. Shopify’s own handling of your data is governed by
Shopify’s Privacy Policy.
4. How we use your information
We use the information we collect to:
- Provide, operate and maintain the Service (including rendering your public locator, directory and location pages);
- Create and manage your account, subscription, billing and plan entitlements;
- Import, store, display and let you edit Merchant Content, including via CSV and the public API;
- Produce aggregated search and traffic analytics for merchants;
- Secure the Service, prevent fraud and abuse, enforce rate limits, and debug errors;
- Respond to support requests and send service-related notices (such as email verification and billing receipts);
- Comply with legal obligations and enforce our terms.
We do not sell your personal information, and we do not use Merchant Content for advertising or to train
third-party machine-learning models.
5. Cookies and similar technologies
We use cookies and similar technologies that are necessary to operate the Service, including:
- Authentication & session cookies to keep you signed in to the dashboard and to maintain
secure sessions (including within the Shopify embedded admin);
- Security tokens to protect against cross-site request forgery;
- A rotating analytics identifier on the public locator to group a visitor’s actions within a
single short-lived session for aggregate reporting.
These are used to make the Service function and are not used to build advertising profiles. Some third parties
(for example our mapping and font providers) may also set their own cookies when their content loads; those are
governed by their respective policies.
6. How we share your information
We do not sell personal information. We share data only in the limited ways described below:
- Service providers (sub-processors). We use reputable third parties to run the Service. Current
sub-processors include:
- Shopify — app platform, distribution and billing for Shopify merchants;
- Stripe — payment processing for hosted accounts;
- Mapbox — mapping, map tiles and geocoding;
- Google Fonts — delivery of web fonts;
- DigitalOcean — cloud hosting and infrastructure;
- Cloudflare — DNS and, for merchant custom domains, content delivery and network protection;
- AppSignal — error and performance monitoring;
- Postmark — transactional email delivery (account confirmations, receipts and notifications).
Each provider processes data under its own terms and, where applicable, data-processing agreements.
- Public display. Merchant Content you choose to publish (location names, addresses, opening
hours, custom fields, etc.) is displayed publicly on your locator and may be indexed by search engines. Do not
include personal data you do not wish to make public.
- Legal requirements. We may disclose information if required to do so by law, subpoena or other
legal process, or to protect the rights, safety or property of us, our merchants or the public.
- Business transfers. In connection with a merger, acquisition, reorganisation or sale of assets,
information may be transferred, subject to this policy.
7. Shopify apps and the Shopify platform
When the Service runs inside Shopify, your use is also subject to Shopify’s terms and privacy practices. Data
exchanged between Shopify and the app is limited to what is necessary to operate the store locator. For questions
about Shopify’s own data handling, please refer to
Shopify’s Privacy Policy.
8. Data retention
We retain Merchant Content for as long as your account or app installation is active. When you delete a location,
custom field or your account — or uninstall the app — the associated data is removed from our production systems.
We keep API request logs, error and performance data for a limited period for security and diagnostics, and we may
retain certain billing records as required by law. Backups are cycled on a routine schedule.
9. Security
We use industry-standard administrative, technical and organisational measures to protect your data, including
encryption in transit (TLS/HTTPS), encrypted password storage, scoped API keys, rate limiting, tenant isolation and
monitored infrastructure. No method of transmission or storage is 100% secure, so we cannot guarantee absolute
security. You are responsible for keeping your account credentials confidential.
10. International data transfers
The Service is operated using infrastructure that may be located outside your country of residence (including the
United Kingdom, the United States and Canada). Where personal data is transferred across borders, we rely on appropriate safeguards such
as standard contractual clauses or equivalent mechanisms, and our sub-processors do the same.
11. Your privacy rights
Depending on where you live, you may have rights over your personal data, including the right to:
- Access the personal data we hold about you;
- Correct inaccurate or incomplete data;
- Delete your data (“right to be forgotten”);
- Restrict or object to certain processing;
- Receive a portable copy of your data; and
- Withdraw consent where processing is based on consent.
To exercise any of these rights, contact us at
[email protected]. We will verify your identity and respond within the
timeframes required by applicable law.
Merchants: because we usually process Merchant Content as your processor, requests from your own
customers about their data should be directed to you first. You control that data through the dashboard,
CSV export and API. If you need our help fulfilling a request, contact us and we will assist you.
California residents (CCPA/CPRA). We do not “sell” or “share” personal
information as those terms are defined under California law, and we do not process sensitive personal information
for purposes beyond those described here. California residents may exercise the rights above and may not be
discriminated against for doing so.
12. Do Not Track
The Service does not track users across third-party websites over time and does not respond to browser
“Do Not Track” signals, because we do not engage in that kind of tracking.
13. Children’s privacy
The Service is intended for businesses and is not directed at children under 16. We do not knowingly collect
personal information from children. If you believe a child has provided us with personal data, contact us at
[email protected] and we will promptly delete it.
14. Changes to this Privacy Policy
We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date
at the top of this page and, for material changes, provide notice through the Service or by email. Continued use of
the Service after changes take effect constitutes acceptance of the updated policy.
15. Contact us
If you have questions about this Privacy Policy or our data practices, please contact us:
