Privacy Policy

Store Spot — Shopify Store Locator App

Last updated: April 15, 2026 • Effective date: April 15, 2026

1. Introduction

RodeaStudio ("we", "us", or "our") operates the Store Spot application ("App"), a Shopify store locator that helps merchants display their physical store locations on an interactive map. This Privacy Policy explains how we collect, use, store, and protect information when you use our App.

By installing or using Store Spot, you agree to the practices described in this policy. This policy applies to both merchants (Shopify store owners) and their customers who interact with the store locator.

2. Data Controller

3. Information We Collect

3.1 Merchant Data

When a merchant installs Store Spot, we collect and store the following information through Shopify's API:

Data	Purpose	Legal Basis
Shop domain	Identify the merchant's store	Legitimate interest
Shopify access token	Authenticate API requests	Performance of contract
Shop GID (Shopify ID)	Unique shop identification	Legitimate interest
Merchant locale/language	Provide localized experience	Legitimate interest
Subscription plan	Manage billing and feature access	Performance of contract

3.2 Store Location Data

Merchants voluntarily enter store location information that is displayed to their customers:

• Store name and description
• Physical address (street, city, state, ZIP code, country)
• Geographic coordinates (latitude and longitude, auto-generated via geocoding)
• Contact details (phone number, email address, website URL)

This data is provided directly by the merchant and is intended to be publicly visible to store visitors through the store locator widget.

3.3 Analytics Data

Store Spot collects anonymous analytics data to help merchants understand how customers interact with the store locator. This data is aggregated and does not identify individual persons:

Data Category	Examples	Purpose
Session data	Session ID, duration, timestamp	Measure engagement
Device information	Device type, browser, OS, screen resolution	Optimize user experience
Approximate location	Country, region, city (IP-based)	Regional analytics
User geolocation	Latitude/longitude (only when user grants permission)	Distance calculation to nearest store
Store views	Which stores were viewed and for how long	Popular location insights
Search queries	Search terms entered in the locator	Improve search relevance
Interaction data	Clicks on phone, email, website, directions	Measure conversion
Map interactions	Zoom level, pan, interaction type	Optimize map experience
Referrer	Page that led to the store locator	Traffic analysis

4. How We Use Information

We use the collected information for the following purposes:

• Provide the service: Display store locations on an interactive map, enable search and filtering, calculate distances
• Analytics and reporting: Provide merchants with insights about customer interactions with their store locator
• Billing and subscription management: Manage plan tiers, trial periods, and feature access
• App improvement: Understand usage patterns to improve features and performance
• Communication: Respond to support requests and inquiries
• Compliance: Meet legal and regulatory requirements

5. Third-Party Services

Store Spot integrates with the following third-party services:

5.1 Shopify

The App is built on the Shopify platform and uses Shopify's APIs for authentication, billing, and data access. Shopify collects and processes its own data according to Shopify's Privacy Policy.

5.2 Google Maps Platform

The App uses the following Google Maps services to display maps and convert addresses to coordinates:

• Maps JavaScript API — Renders the interactive map
• Geocoding API — Converts store addresses into geographic coordinates
• Places API — Provides enhanced location search features

Google may collect usage data through these APIs. Refer to Google's Privacy Policy for more information.

6. Data Storage and Security

6.1 Storage

All data is stored in a secure PostgreSQL database hosted on a cloud provider. Data is encrypted in transit using TLS/SSL connections.

6.2 Security Measures

• All data transmissions are encrypted via HTTPS/TLS
• Shopify access tokens are stored securely and never exposed to client-side code
• Access to the database is restricted and authenticated
• Webhook payloads are verified using HMAC signatures
• OAuth authentication is handled through Shopify's secure framework

6.3 Data Retention

• Merchant data: Retained for as long as the App is installed. Deleted upon uninstallation via Shopify's webhooks
• Store location data: Deleted when the merchant uninstalls the App or deletes individual stores
• Analytics data: Retained for the duration of the merchant's subscription and deleted upon uninstallation
• Session data: Shopify session tokens expire according to Shopify's session management policies

7. Data Sharing

We do not sell, rent, or share your personal data with third parties for marketing purposes. Data may be shared only in the following circumstances:

• With the merchant: Analytics data is shared with the merchant who owns the store locator (this is the purpose of the analytics feature)
• Service providers: With Shopify and Google Maps as described in Section 5, strictly to provide the App's functionality
• Legal requirements: When required by law, regulation, or legal process

8. Your Rights

8.1 Merchant Rights

• Access: You can view all data associated with your shop through the App's dashboard
• Rectification: You can edit or update store location data at any time
• Deletion: You can delete individual stores or uninstall the App to remove all data
• Data portability: You can export your store data via CSV export functionality

8.2 End-User (Store Visitor) Rights

• Geolocation opt-out: You can decline the browser's geolocation permission request
• Analytics opt-out: You can use browser settings to block or limit tracking (e.g., Do Not Track)

8.3 GDPR Rights (EU Users)

If you are located in the European Economic Area (EEA), you have additional rights under the General Data Protection Regulation (GDPR):

• Right of access (Article 15)
• Right to rectification (Article 16)
• Right to erasure / "right to be forgotten" (Article 17)
• Right to restriction of processing (Article 18)
• Right to data portability (Article 20)
• Right to object (Article 21)

To exercise any of these rights, please contact us using the details in Section 2.

8.4 CCPA Rights (California Users)

Under the California Consumer Privacy Act (CCPA), California residents have the right to:

• Know what personal information is collected
• Request deletion of personal information
• Opt out of the sale of personal information (we do not sell personal information)
• Not be discriminated against for exercising these rights

9. Data Deletion on App Uninstall

When a merchant uninstalls Store Spot, the following actions are automatically triggered via Shopify webhooks:

• All store location data associated with the shop is deleted
• All analytics sessions and related data (views, searches, interactions) are deleted
• The shop record and associated data are removed from our database
• Shopify session tokens are invalidated

This process is automatic and completed within a reasonable timeframe after uninstallation.

10. Shopify Customer Data

Store Spot does not access, collect, or process Shopify customer data (e.g., shopper personal information, order data). The App operates solely with merchant-provided store location data and anonymous analytics.

The App has registered the following compliance webhooks with Shopify:

• customers/data_request — Responds to customer data access requests
• customers/redact — Handles requests to delete customer data
• shop/redact — Handles shop data deletion upon uninstallation

11. Children's Privacy

Store Spot is not directed at children under the age of 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will take steps to delete such information.

12. International Data Transfers

Your data may be transferred to and processed in countries other than your country of residence. These countries may have data protection laws that differ from your jurisdiction. By using the App, you consent to such transfers. We take appropriate safeguards to ensure your data is protected in accordance with applicable law.

13. Cookies and Local Storage

Store Spot may use browser local storage to:

• Maintain user preferences (e.g., language selection)
• Track analytics session identifiers
• Determine returning user status

The App does not use third-party advertising cookies.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make changes:

• We will update the "Last updated" date at the top of this page
• For material changes, we will notify merchants through the App or via email
• Continued use of the App after changes constitutes acceptance of the updated policy

15. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

We aim to respond to all privacy-related inquiries within 30 days.