StoreSpot / Privacy
Privacy Policy
What information StoreSpot uses, why it is needed and the choices available to merchants and shoppers.
Last updated: 29 October 2026.
1. Scope and responsibilities
This notice covers the StoreSpot app, its locator on Shopify stores, these help pages and support correspondence. Merchants decide what locator content to publish and are responsible for their own storefront notices and consent settings.
For our business relationship, service security and direct support, we determine the relevant purposes of processing. When handling personal information to operate a merchant’s locator on its instructions, we act as its processor. The data processing annex describes that relationship. Shopify and a merchant’s other services also have their own notices.
2. Information used by the app
| Information | Use and storage |
|---|---|
| Shop and authorized staff | Shop identifiers, installation/authorization state, access and refresh credentials, permission scopes and, when supplied by Shopify, staff ID, name, email, language and account-role details support authorized access. These session records are held in the app database. |
| Locator content | Groups, names, addresses, business coordinates, public contacts, links, descriptions, services, weekly and special hours and appearance settings are stored primarily in Shopify app-owned records and displayed as instructed. Private legacy contact-person/internal-note fields, if present, are kept separate from public storefront content. |
| Subscription notifications | The shop domain and verified subscription status are used for internal owner notifications about paid plans and plan changes. The app stores the last observed status and a delivery queue to avoid duplicate notices. No customer, order, staff-email or access-token data is included in these emails. |
| Save recovery | A pending location-list save can retain its previous state and requested changes in the app database so an interruption can be reconciled safely. It is not a full backup of the merchant’s Shopify content. |
| Address lookup | When a merchant uses address lookup, the app sends the entered address and selected country to Geoapify to find map coordinates. This is separate from a shopper’s optional browser position. Lookup results and request fingerprints are temporarily cached in the app database to reuse results and enforce usage limits. |
| Images and spreadsheets | Images are held in the merchant’s Shopify Files library and referenced by StoreSpot. Import/export files are processed for the requested operation; the production app does not keep a permanent workbook archive. Merchant downloads remain under the merchant’s control. |
| Support | Contact details, messages and relevant attachments supplied to us are used to answer requests. Please omit passwords, access tokens and unnecessary customer or sensitive information. |
StoreSpot requests access to Shopify files, app-owned content definitions/records and its storefront app proxy. It does not request access to Shopify customer or order records. Public business contact details can still be personal data.
3. Search, optional position and activity counts
Text search filters saved locations in the browser. The app does not include the typed search phrase in activity events.
If a shopper chooses Use my location and grants browser permission, the position is used in that browser to calculate straight-line distances and sort results within each group. StoreSpot does not send that shopper position to its app server or store it there. Clearing the position or leaving the page removes the in-page position; browser/device permission is managed separately. Ordinary search and browsing remain available without location permission.
Only when Shopify’s Customer Privacy API permits analytics, the app records search, location-detail, directions-click and contact-link events (phone, email and website). Stored information consists of shop/date/location-handle counts, short-lived hourly totals and random event-delivery identifiers to prevent duplicate counts. Events do not contain raw search text, shopper coordinates, customer IDs or a persistent visitor identifier. Counts do not establish unique people, physical visits or purchases. Theme-editor and app-preview activity is excluded.
The analytics module does not set analytics cookies or analytics local-storage entries. It sends no events when the consent API is unavailable or permission is denied. Requests still travel through the merchant’s Shopify storefront infrastructure, which can receive ordinary network information.
4. Network requests and external links
Shopify, the app host and map delivery providers receive network requests needed to deliver the service. These may include IP addresses, request times, browser information and resource paths. Map requests reveal which map area is requested; local distance calculation does not make map requests anonymous. Choosing Directions opens Google Maps as an external service, under its own terms and privacy notice.
The app’s web-request logging removes query strings; paths, status, timing and error details can remain, and paths may identify a shop. The reverse proxy does not enable access logging and removes request fields from its diagnostic logs. Host/security logs may still contain administrative IP addresses and operational events. Provider-side records are governed separately by the relevant provider’s policy.
5. Cookies and browser storage
The merchant interface stores its language preference in sl_admin_language local storage and a secure, partitioned preference cookie configured for up to 365 days. Local storage remains until changed or cleared. The current review-prompt dismissal uses session storage with a shop/staff-scoped key for that browser session. A dormant database dismissal mode is not represented as active tracking.
Shopify authentication and the merchant’s storefront may use their own storage. These static help pages use a local script for navigation and presentation. They contain no analytics pixels, forms or remote fonts and set no application cookie. These help pages do not load Shopify authentication, map assets or external content until you follow a link to another service.
6. Purposes and legal bases
Where we act as controller and GDPR applies, we rely on the contract with an individual merchant to provide the requested service; legitimate interests to communicate with business staff, protect the service and resolve support issues; applicable legal obligations for required records and disclosures; and consent for optional processing where required. Our legitimate interests are operating a useful, secure service and preventing abuse, balanced against individuals’ rights. Processing on a merchant’s behalf follows its lawful instructions.
We do not sell personal information or use locator activity for cross-site advertising. We do not use these counts to make decisions producing legal or similarly significant effects on shoppers.
7. Providers and international processing
| Provider | Service and relevant information |
|---|---|
| Shopify | Store platform, authorization, API, app-owned content, files/images and storefront delivery. Shopify’s merchant relationship and international processing follow its own agreements. |
| RackForest Zrt. | Hungarian VPS hosting for the app and PostgreSQL database. The same VPS serves these static help pages. Hosting personnel can have infrastructure-level access. Provider privacy information. |
| Cloudflare | Domain/DNS services and direct R2 delivery of public map data, fonts and map artwork. Private encrypted database backups use a separate EU-jurisdiction R2 bucket. Public map delivery uses Cloudflare’s global network. No Cloudflare application Worker handles these map requests; Cloudflare’s own security and operational processing still applies. Customer data processing addendum. |
| Geoapify | Address lookup in the merchant location editor. Requests contain the entered address and country and are sent by the app server; shopper geolocation is not sent for this lookup. Geoapify also receives technical request information. Its privacy notice describes API processing and retention. |
| Grafana Labs | External availability monitoring, with a Germany-region monitoring stack and probes in Germany, the United States and South Korea. Checks request only our public health endpoint and map-file metadata. We do not send merchant records, visitor activity, app credentials or production request logs to this monitor. Operational contact details and alert delivery are handled separately. Provider privacy information. |
| Resend | Delivery of internal subscription notifications to the StoreSpot operator. Messages include the shop domain and subscription status, using our verified notify.buttonnest.com sender domain configured in the Ireland sending region. A sending-region choice does not mean all provider processing is confined to that region. Provider privacy information. |
| Zoho Mail | Support and privacy correspondence in a Zoho EU account. EU account hosting does not exclude access or processing elsewhere in the Zoho group. Privacy and transfer information. |
MapLibre and Protomaps are software/data components; using the libraries alone does not send shopper data to their authors. No separate customer-session recording service is enabled. Operational checks run on the VPS and independently through Grafana. Alerts use Zoho Mail and the operator’s configured external email contact.
An EU backend or storage choice does not make all processing EU-only. Cloudflare’s service terms incorporate its data processing addendum for covered personal data. Zoho describes international processing within its group and contractual transfer safeguards in its privacy policy. The particular safeguard depends on the provider, data and transfer; a region choice alone does not establish a safeguard. Contact us for information about the arrangements relevant to your data, subject to legitimate confidentiality restrictions.
Information is disclosed only as needed to deliver the service, to authorized personnel and providers, or when a valid legal obligation requires it. We assess requests for information and limit disclosures to the relevant purpose.
8. Retention, deletion and recovery
| Record | Retention and cleanup |
|---|---|
| Activity counts | Daily reports cover the current and previous calendar years in the shop’s timezone. Hourly reports cover yesterday and today. Event receipts expire after 24 hours. Cleanup runs during report/event processing and through a daily host job, including idle shops. Timezone grace and job timing mean these are not exact midnight-erasure guarantees. |
| Special-hours history | Special-hours history is not offered on Free; paid plans retain the previous 2 calendar months, using each location’s local date. An expired entry stops counting toward the Free allowance immediately. Background cleanup removes expired saved dates in bounded batches; a previous-day exception can remain briefly while it still affects opening hours after midnight. Cleanup may be delayed by API availability or pending-save recovery. Previously saved future dates are preserved after a downgrade. Restricted backup copies follow the separate backup policy. |
| Address lookup cache | Lookup results expire after 24 hours, or after one minute for an unavailable response. Expired entries are removed during subsequent lookup processing. Plan-usage counters are retained separately; expiry is not an exact-time erasure guarantee. |
| Authorization and recovery | Expired online sessions are removed after their access and any refresh validity have ended. Offline installation credentials remain while needed for the installation. Pending-save recovery records remain until safely reconciled or shop cleanup; they are not blindly deleted on a timer. |
| Subscription notification records | Sent delivery-queue records are removed after 90 days during successful delivery jobs. The latest observed subscription status and pending or review-required deliveries remain until resolved or shop cleanup. Provider delivery logs and copies in the operator mailbox have separate lifecycles and are reviewed with operational correspondence. |
| Operational logs | Host journal configuration limits retention to 14 days and storage to 200 MB, with earlier rotation possible. Container logs use size-based rotation, up to three 10 MB files per container; this does not establish a fixed number of retention days. |
| Backups | Encrypted offsite database backups run daily. The retention policy keeps seven daily and four weekly snapshots and removes snapshots older than 35 days during successful daily maintenance. Restricted backups may therefore temporarily retain deleted records. Failures are monitored and require correction; this is not a guarantee of deletion at an exact hour. Separate initial test material is subject to its storage lifecycle cleanup. |
| Support messages | We review closed support correspondence quarterly and remove material no longer needed, normally within 24 months after resolution. This is a manual review policy, not automatic deletion of every email at a fixed timestamp. Relevant evidence may be retained longer for an identified legal obligation or active dispute. |
On receipt of a valid Shopify uninstall or shop-redaction notification, the app removes shop-scoped sessions, dismissal records, pending-save records, subscription notification records and activity data. Failed cleanup returns an error so delivery can be retried. Customer data-request/redaction messages are validated and acknowledged; this app has no customer/order database to return or erase. Shopify controls delivery timing; delayed or retried notifications may postpone cleanup. You can also contact us about a deletion request.
Shopify content and images have separate lifecycles. Uninstalling removes the app-owned Shopify catalog; our reinstall check began with an empty catalog. Removing an image reference or uninstalling does not instruct StoreSpot to delete the underlying Shopify Files asset. PostgreSQL backups do not include a complete copy of Shopify metaobjects, settings or Files. Export locations before uninstalling; reinstalling is not a restoration method.
Deleted records can remain temporarily in restricted backups until those copies expire. Before a restore returns to service, the operator must reconcile current installations and intervening deletion requests, remove disallowed shop data and clear restored credentials. If that reconciliation cannot be established, the affected shop’s restored data must not be put back into service. Recovery is an operator-controlled process; backups are not reopened for ordinary use without this reconciliation.
9. Choices and requests
StoreSpot is provided under the ButtonNest brand by Halász Gábor e.v., a Hungarian sole trader registered under number 20034488, with a business address at 5000 Szolnok, Czakó Elemér u. 5. 1./12., Hungary. The Hungarian tax number is 60293224-1-36 and the EU VAT number is HU60293224. For product support, contact storespot@buttonnest.com.
Email privacy@buttonnest.com to request applicable access, correction, deletion, restriction or portability, or to object to processing based on legitimate interests. Consent can be withdrawn without changing the lawfulness of earlier processing. We may verify identity and authority proportionately. For content controlled by a store, contact that merchant first; we assist it as appropriate.
Where GDPR applies, we normally respond within one month and explain any lawful extension. You may complain to your competent data protection authority, including in the country where you live or work, or Hungary’s National Authority for Data Protection and Freedom of Information (NAIH). Shopify’s applicable privacy-request obligations also apply. Legal retention exceptions are assessed for the specific record rather than used to retain everything indefinitely.
10. Security and changes
Implemented controls include HTTPS, key-only administrator access, a non-public database, restricted secret files, Shopify authentication and webhook validation, shop-scoped access/deletion and encrypted offsite backup material. Daily backup maintenance and local/external availability checks support incident detection and recovery. No certification, uninterrupted availability or absolute security guarantee is claimed.
On material changes we will update this notice and provide an in-app notice or contact the merchant through its service contact, ordinarily at least 30 days in advance where practicable. Urgent security or legal changes may take effect sooner with an explanation. The last-updated date appears at the top of this notice.