MindFlash StudioClear information about the data Gift Engine processes, why it is used, and how long it is retained.
1. Who is responsible for this processing?
For the Gift Engine website, merchant relationship, support, security, and service administration, the controller is Vladimir Pogozhev, trading as MindFlash Studio, Calle Puerto Franco 41, 38410 Los Realejos, Santa Cruz de Tenerife, Spain. Contact: mindflashapp@gmail.com.
When Gift Engine processes personal data from a merchant’s Shopify store to provide the application, the merchant is normally the controller and MindFlash Studio acts as processor under the Data Processing Addendum.
2. Data we process
Website visitors. This static marketing site does not use optional analytics, advertising pixels, or marketing cookies. Hosting providers may process limited technical data, such as IP address, request time, browser information, and security logs, to deliver and protect the site.
Merchants and Shopify administrators. Gift Engine processes the Shopify shop domain; app installation status; campaign configuration; selected product, collection, and gift identifiers and titles; store settings; and Shopify administrator session data, which may include administrator name, email address, user identifier, locale, access token, refresh token, and token expiry.
Shopper and order-related data. During storefront eligibility checks, Gift Engine receives product identifiers, cart subtotal in minor units, and currency. This cart snapshot is evaluated transiently and is not stored. After Shopify confirms payment for an order containing a verified Gift Engine gift, Gift Engine records the Shopify order identifier, campaign identifier, gift-variant identifier, event time, currency, and order subtotal for attribution and service reporting. Gift Engine does not intentionally store shopper names, email addresses, postal addresses, telephone numbers, payment-card data, or a complete cart history.
3. Why we use data and legal bases
- To provide, secure, and support the Gift Engine service and manage merchant access: performance of a contract or steps requested before entering a contract.
- To maintain service security, prevent misuse, troubleshoot errors, and keep service records: legitimate interests in operating a secure and reliable service.
- To process limited shopper/order-related data on a merchant’s documented instructions: the merchant’s lawful basis as controller, with MindFlash Studio acting as processor.
- To comply with applicable legal obligations and respond to valid rights requests.
4. Service providers and locations
Gift Engine uses Shopify to integrate with merchant stores. It uses Google Cloud and Firebase infrastructure for website hosting, application runtime, and database services. The Gift Engine application runtime and primary database are hosted in Google Cloud’s Belgium region (europe-west1) within the European Economic Area.
Some service providers may process data outside the EEA as necessary to provide their services. Where applicable, such transfers are subject to appropriate safeguards made available by the relevant provider, such as adequacy decisions or contractual safeguards.
5. Retention
- Merchant configuration and session data are retained while the app is installed and needed to provide the service.
- Shopify sessions are removed when the app is uninstalled.
- Remaining shop data are erased when Shopify sends the
shop/redactrequest, or by a 30-day fallback cleanup after uninstallation. - Gift-event attribution records are retained for up to 24 months.
- Customer-data request records are retained for up to 90 days.
6. Rights and requests
Depending on applicable law, individuals may have rights of access, rectification, erasure, restriction, objection, portability, and the right to lodge a complaint with a supervisory authority. For data controlled by a merchant, please contact the merchant first. Merchants may contact mindflashapp@gmail.com for assistance with Shopify privacy requests. For data controlled by MindFlash Studio, contact us at the same address.
Individuals in Spain may also contact the Spanish Data Protection Agency (AEPD). We may ask for information necessary to verify identity before acting on a request.
7. Automated decisions
Gift Engine automatically applies a merchant-configured campaign rule to determine whether a cart qualifies for one gift. It does not use this process to make decisions with legal or similarly significant effects about an individual.
8. Changes
We may update this Privacy Policy when the service, legal requirements, or processing practices change. Material changes will be posted on this page with a revised date.