Privacy policy

This policy explains how Abbl handles information for its Shopify apps.

Effective date: 31 August 2026

Information we process

We process the Shopify store domain, app installation identifiers, granted permissions, subscription status, merchant configuration, operational diagnostics and support requests needed to provide and secure the service. Shopify access credentials and provider keys are encrypted or held in protected secret storage and are never sent to the storefront browser.

Abbl Discovery Filters processes product, variant, collection, product metafield and inventory information to build a store-specific search index. It does not require customer profiles, orders, checkout data or payment information.

How we use information

We use this information to install and operate the app, synchronise catalogue changes, provide search and filtering, administer subscriptions, prevent misuse, diagnose failures and answer support requests. We do not sell merchant or customer information.

Service providers

We use Shopify for commerce and app distribution, Microsoft Azure for hosting and protected storage, Typesense for the rebuildable catalogue search index, and approved communication or engineering providers when support requires them. Providers receive only the information needed for their role.

Retention and deletion

Configuration and rebuildable catalogue projections are retained while the app installation is active and are scheduled for deletion after uninstall in accordance with Shopify's privacy requirements. Detailed, redacted query telemetry is retained for up to 30 days; aggregated pseudonymous discovery and audit records for up to 13 months; support information follows the documented support-retention schedule.

Your choices and rights

Merchants can uninstall the app at any time. Shopify's mandatory data request and redaction webhooks are supported. To request access, correction or deletion, contact support@abbl.app.

Security and changes

Abbl uses tenant isolation, least-privilege access, encrypted credentials, authenticated webhooks and redacted diagnostics. We may update this policy as the service or applicable requirements change; the effective date above identifies the current version.