Privacy Policy

1. About this policy

This Privacy Policy explains how Holly Palm (“we”, “us”, “our”) handles information in connection with the Collection Export & Import application (the “App”) for Shopify. The App lets merchants export their store’s collections to an Excel or CSV file, edit them in a spreadsheet and import the file back to create, update or delete collections in bulk. It can also run scheduled exports and send email notifications about export and import jobs.

It applies to the merchants who install the App and the staff users who operate it inside the Shopify admin. The App works with collection data only and does not access the store’s customers or orders.

This policy covers the App only. It does not cover the merchant’s own store or Shopify’s platform, each of which is governed by its own privacy notice.

2. Our role

For the store content the App reads and writes on the merchant’s behalf — collections and their settings — the merchant is the data controller and we act as a data processor, processing it solely to perform the exports and imports the merchant requests. We do not use it for our own purposes, we do not sell it, and we do not use it to build marketing profiles or to train machine-learning models.

For the limited information relating to the merchant’s own account — the store domain, the email addresses chosen for notifications, subscription status and support correspondence — we act as a controller.

3. Information the App processes

3.1 Store and account information

• Shopify store domain (example.myshopify.com), store name and the store’s contact email address.
• The name and email of the staff user who opens the App, as provided by Shopify during authentication.
• Shopify access tokens issued to the App so that it can call the Shopify Admin API on the store’s behalf.
• Subscription plan and billing status, as reported by Shopify.

3.2 Collection data

When the merchant runs an export, the App reads the columns the merchant selects; when the merchant runs an import, it writes the values in the uploaded file back to the store. Depending on the selected columns this includes:

• Collection ID, handle, title, description, sort order, template suffix, image URL and alt text, and SEO title and description.
• Sales channel publishing status and publish dates.
• Smart collection conditions, and for manual collections the IDs, handles and positions of the products they contain.
• Collection metafields.

3.3 Export and import files

Files created by exports and files uploaded for imports, together with the results file of each import, are stored so that the merchant can download them from the Jobs page. Each file is available only through a signed link that expires after 15 minutes.

3.4 Job records

For each export or import we keep a job record: its type, status, progress counts (exported, created, updated, deleted, failed, skipped), the selected columns, filters and file format, the file name, timestamps and any error message. These records power the Jobs page and let interrupted jobs resume.

3.5 Notification and schedule settings

The merchant can choose which job events send an email, whether the store owner’s address receives them, and up to five additional email addresses. The merchant can also turn on a daily or weekly scheduled export. These settings are stored in the merchant’s own Shopify store (see Section 5).

3.6 Technical and diagnostic information

Our servers keep short-lived operational logs containing information such as the time of a request, the requested path, response status, the store domain and job identifiers, used to keep the service running and to investigate problems.

3.7 Merchant contact profile (central customer platform)

When the App is installed or re-authenticated, we maintain a merchant contact profile containing your store name, store email address, store domain, storefront URL, country/region, currency, timezone, Shopify plan and your App subscription plan. This profile is stored on a central customer platform operated by Holly Palm (a Shopify store we own and administer) and is used to provide the App’s services and to contact you about the App, as described in Section 4. Marketing emails sent through this platform respect unsubscribe preferences; you can opt out via the link in any marketing email.

3.8 What the App does not collect

• No customer or order data. The App does not request access to Shopify customers or orders.
• No payment card, bank account or other payment instrument data. Subscription charges are handled entirely by Shopify Billing.
• No advertising, analytics or cross-site tracking technologies.

4. Why we process it

• To provide the service: exporting collections to files, importing changes from files, running scheduled exports and making the files available for download.
• To send notifications: emailing the addresses the merchant has chosen when a job starts, finishes, fails or is cancelled.
• To apply the merchant’s plan: checking that the store has an active subscription plan before exports, imports and scheduled exports can run.
• To authenticate and secure access: verifying Shopify session tokens and validating webhook signatures.
• To operate and improve the App: monitoring availability, diagnosing failures and preventing abuse.
• To support merchants: answering questions and investigating reported problems.
• To contact you about the App: using your merchant contact profile (Section 3.7), we may send you service announcements and, where permitted, marketing communications about the App and other Holly Palm products — for example, new feature announcements and win-back offers. Marketing emails respect unsubscribe preferences; service-related messages required for the App’s operation may still be sent.

Where the GDPR applies, our lawful basis is performance of a contract with the merchant, and our legitimate interest in operating and securing the service. Where the Turkish Personal Data Protection Law (KVKK) applies, processing is necessary for the performance of a contract and for our legitimate interests under Article 5(2).

5. Where information is stored

• In the merchant’s Shopify store. Collections themselves always live in the merchant’s store. The App’s notification and schedule settings are stored as an app-owned metafield on the store’s installation of the App.
• In our database. Our PostgreSQL database holds Shopify session records, job records (Section 3.4) and, when a scheduled export is turned on, the time of its next run.
• In file storage. Export, import and results files (Section 3.3) are stored in a private, encrypted storage bucket.
• In transit through our processing pipeline. Jobs pass through a message queue and serverless functions. Queue messages carry identifiers rather than collection data; the data is read from Shopify or from the stored file at the moment of processing.
• On our central customer platform. Your merchant contact profile (Section 3.7) is held on a Shopify store owned and administered by Holly Palm, under the same security standards as the App itself.

6. Who we share information with

We do not sell personal data and we do not share it for advertising. We disclose it only to the following recipients, and only to the extent needed:

We may also disclose information where required by law, court order or a valid request from a public authority, and to our professional advisers where necessary. If our business is transferred, information may be transferred with it; the merchant will be notified before any such transfer takes effect.

7. International transfers

Our infrastructure is hosted in the Amazon Web Services eu-central-1 region (Frankfurt, Germany). Shopify may process data outside the European Economic Area and outside Türkiye. Where personal data is transferred out of the EEA or the United Kingdom, the transfer is covered by the European Commission’s Standard Contractual Clauses or another approved safeguard. Transfers of data of individuals in Türkiye are made in accordance with Article 9 of the KVKK.

8. How long we keep information

• Export, import and results files: deleted automatically 30 days after they are created.
• Session records, job records and schedule data: kept while the App is installed. When the App is uninstalled, all of this data and any remaining files for the store are deleted from our systems. The deletion runs again when Shopify sends the shop/redact request after uninstall.
• Settings metafield: stored in the merchant’s store as app-owned data and removed by Shopify when the App is uninstalled.
• Collection changes made by imports: these are part of the merchant’s store and remain under the merchant’s control after the App is uninstalled.
• Operational logs: retained only as long as needed for security, debugging and service reliability, and in any case no longer than 30 days.
• Support correspondence: retained as long as necessary to handle the request and for our legitimate record-keeping.
• Merchant contact profile: retained in deactivated form (marking the App as uninstalled) on our central customer platform so that we can honor your communication preferences; you may request full deletion at any time via the contact details in Section 15.

9. Shopify’s mandatory privacy requests

The App implements the three compliance webhooks Shopify requires and responds to them as follows:

• customers/data_request — the App does not access or store customer data, so there is nothing for us to export.
• customers/redact — the App does not access or store customer data, so there is nothing for us to erase.
• shop/redact — all data belonging to the store (session records, job records, schedule data and files) is permanently deleted. Your merchant contact profile on our central customer platform is also erased at this point: contact details are removed and the remaining record is anonymized.

10. Security

• All traffic is encrypted in transit with TLS.
• Files are kept in a private storage bucket with public access blocked and encryption at rest, and can only be downloaded through signed links that expire after 15 minutes.
• Every Shopify webhook is signature-verified before it is processed.
• App functionality is reachable only with a valid Shopify session token, and each store can only see its own jobs and files.
• Access to production systems is restricted to the personnel who need it.

No system can be guaranteed to be perfectly secure. If a personal data breach affects merchant data, we will notify the affected merchants and the relevant supervisory authority without undue delay and, where required, within 72 hours of becoming aware of it.

11. Cookies

The App sets only strictly necessary cookies, used by Shopify’s authentication libraries to complete the OAuth flow and to maintain a session while a merchant uses the App inside the Shopify admin. We do not set advertising, analytics or cross-site tracking cookies.

12. Your rights

Depending on where you live, you may have the right to access your personal data, to have it corrected or erased, to restrict or object to its processing, to data portability, and to withdraw consent where processing is based on consent. Under the KVKK you additionally have the right to learn whether your data has been processed, to request notification of third parties to whom it has been disclosed, and to object to a result produced solely by automated analysis.

Merchants may contact us at hello@hollypalm.com. We respond to privacy-related requests within 30 days. You also have the right to lodge a complaint with your local supervisory authority, or in Türkiye with the Personal Data Protection Authority (KVKK Kurumu).

13. Children

The App is a business tool and is not directed at children. We do not knowingly collect personal data from anyone under the age of 16.

14. Changes to this policy

We may update this policy as the App evolves. The date at the top of the page always reflects the current version. If a change materially affects how merchant data is handled, we will notify merchants inside the App or by email before it takes effect.

15. Contact

Developer: Holly Palm
Email: hello@hollypalm.com
We respond to privacy-related requests within 30 days.