Privacy and Cookie Policy

1. Data controller and privacy contact

The data controller is Ferrario Alberto Giancarlo, Via Paolo Borsellino 28, 47832 San Clemente (RN), Italy, VAT IT04656260405. Requests concerning personal data can be sent to support@goappo.io.

2. Scope of this policy

This policy covers the goappo.io website, the Appo service, which turns a website into mobile apps for iOS and Android and manages their publication on the stores, and the Appo app for Shopify, which merchants install from the Shopify App Store. A separate section, number 5, describes the data processed through the Shopify app.

3. Data collected on the website

The following data is processed on goappo.io:

• Contact form: name, email address, company, message and, if provided, phone number, website address and business sectors. The data is kept in order to reply to the request.
• Technical browsing data: IP address, browser and device type, pages visited, and date and time of access, recorded by the hosting infrastructure for the operation and security of the site.
• Cookies and similar tools: described in section 12.

4. Data of Appo service users

To activate and manage an Appo account, the following is processed: the user's name and email address, the address of the website from which the app is derived, the app settings and customization content, the subscription status, and the communications exchanged with support.

5. Shopify merchants

When a merchant installs the Appo app for Shopify, the following data is processed:

• Shop domain and shop name, to identify the shop and create the corresponding app.
• Shop owner email address, used to find or create the merchant's Appo account; the shop name and email address are sent to the Appo service when the app is created.
• Offline access token issued by Shopify, with its scopes and, where applicable, the refresh token: it is stored in order to call the Shopify Admin API on the merchant's behalf.
• Order name or number, received through the order webhooks and forwarded to the Appo service to generate push notifications; the names of the shop's customers are not processed.
• Support chat messages, written by the merchant in the app dashboard (Business plan) and sent to the Appo service together with the shop domain, so that Appo's operators can reply.
• Notification settings chosen by the merchant, and the subscription and billing state, received from Shopify through the subscription update webhook.
• Configuration data: identifiers of the app and of the Appo user linked to the shop, onboarding completion state, and the date of any uninstallation.

The data is stored in the database of the Shopify app. The app handles the three mandatory Shopify compliance webhooks. On receipt of shop/redact, sent by Shopify after uninstallation, the shop record and the stored sessions are deleted, and the Appo service is asked to delete the data of the linked app. The customers/data_request and customers/redact webhooks require no action, because the app stores no personal data of the shop's customers. The retention of support chat messages is described in section 9.

6. Purposes and legal bases

• Providing the service and managing the account, the app and the subscription: performance of a contract (Art. 6(1)(b) GDPR).
• Complying with tax and accounting obligations and with the requirements of the Shopify platform, including the compliance webhooks: legal obligation (Art. 6(1)(c)).
• Replying to requests received through the contact form, ensuring the security of the site and of the service, and verifying that the websites named for creating an app work (section 11): legitimate interest (Art. 6(1)(f)).
• Non-technical cookies and tools, such as campaign measurement: consent (Art. 6(1)(a)), which can be withdrawn at any time.

7. Recipients and processors

The data is processed by the controller and, on its behalf, by the following providers:

• Shopify, which provides the platform on which the app operates and the shop data.
• DigitalOcean, for hosting the Shopify app and its database, in the EU (Frankfurt).
• Vercel, for hosting the goappo.io website.
• Telegram, the messaging service through which Appo's operators receive and answer support chat messages; the message text and the shop domain transit through Telegram.
• Iubenda, for cookie consent management.
• Google (Tag Manager) and Meta (Pixel), activated only after consent, for measurement and campaigns.

The data is not sold or disclosed to third parties for their own purposes.

8. Transfers outside the EEA

Some providers may process data outside the European Economic Area, in particular in the United States. Transfers rely on the adequacy decisions of the European Commission, where applicable, or on the standard contractual clauses provided for in Art. 46 GDPR.

9. Retention

• Shopify app data: for the duration of the installation; after uninstallation it is deleted on receipt of the shop/redact webhook.
• Support chat messages: kept in the Appo service as long as the merchant's Appo account exists; deleted when the account is deleted or on request, as described in section 10. The copies received by the operators through Telegram remain in the Telegram history.
• Appo service accounts: for the duration of the contract and afterwards for the time required by law.
• Contact form messages: for the time needed to reply to the request and to any resulting negotiation.
• Cookies: for the duration shown in the banner preferences.

10. Data subject rights

Under Articles 15 to 22 GDPR, data subjects may request access to their data, rectification, erasure, restriction of processing and portability, and may object to processing. Requests can be sent to support@goappo.io. Data subjects also have the right to lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it).

11. Site reading (AppoBot)

To create an app, the Appo service reads the website indicated by the user with an automated program, AppoBot, in order to verify that the site works. The legal basis is legitimate interest (Art. 6(1)(f) GDPR). Masked text fragments of at most 160 characters and a masked page title are stored; the fragments are deleted after 90 days. Anyone who believes they are concerned can object by writing to support@goappo.io. The full notice under Art. 14 GDPR is available at https://apps.goappo.io/bot.

12. Cookies

The site uses technical cookies, which are necessary for operation and security and do not require consent, and measurement and marketing cookies and tools, which are installed only after consent given through the banner.

Consent is managed by Iubenda. Consent can be refused, given and withdrawn at any time through the “Manage” button of the banner or the cookie preferences. Refusing does not affect browsing. Cookies can also be removed from the browser settings.

13. Changes to this policy

This policy may be updated; the date of the latest revision is shown at the top of the page. Significant changes are announced on the site.