Privacy Policy
Last updated 21 August 2026
This policy explains what Niim Reviews (“the app”) collects when a merchant installs it on a Shopify store, why, and how long it is kept. The app is operated by (development build — LEGAL_ENTITY_NAME not set), (development build — LEGAL_ENTITY_ADDRESS not set).
What we collect
From the merchant’s store
- Store domain and an OAuth access token, so the app can operate
- Product IDs, handles and titles, to attach reviews to the right product
- Widget preferences the merchant sets in the app
From shoppers who write a review
- The name and, where given, the location they choose to display
- Their email address, only when they provide one
- The rating, review text and any photos they attach
- Their IP address, retained for 30 days purely to limit spam submissions
- Their Shopify customer ID, when they are signed in to the store
We do not collect payment details, browsing history, or any data beyond what is needed to display and moderate reviews.
How it is used
Review content is displayed on the merchant’s storefront and in the merchant’s Shopify admin. We do not sell personal data, share it with advertisers, or use it to train models. We do not use it for automated decision-making or profiling.
Where it is stored
Data is stored in a Supabase-hosted PostgreSQL database and object store, encrypted in transit (TLS) and at rest, with encrypted backups. Access tokens are held in a table reachable only by the application service role. Access is limited to named staff who require it, and access is logged.
How long we keep it
- Reviews — for as long as the merchant keeps the app installed
- Shopper IP addresses — 30 days
- Access tokens — deleted immediately on uninstall
- Everything else — deleted when Shopify sends the shop redaction request, 48 hours after uninstall
Your rights
Shoppers can ask the store they reviewed to correct or erase their review. We honour Shopify’s mandatory data request and redaction webhooks automatically: a data request is answered with everything we hold, and a redaction request strips the name, email, location and IP from the review while leaving the review text with the store it was written for.
Requests can also be sent directly to support@example.invalid. We respond within 30 days.
Sub-processors
- Supabase — database and image storage
- our application host — application hosting
- Shopify — the platform the app runs on
Changes
Material changes will be notified to installed merchants by email before taking effect.