Privacy Policy

01Overview

setlist (“setlist”, “we”, “us” or “our”) provides an operational product development app for Shopify merchants, available as an embedded Shopify app and through this website. This Privacy Policy explains what information we collect, how we use it, who processes it on our behalf, and the rights and choices you have.

By installing the setlist app or using this website, you agree to the practices described here.

02Who this applies to

• Merchants who install and use the setlist app on their Shopify store.
• People whose information a merchant adds to setlist, for example product testers.
• Visitors to this marketing website.

If you are a customer or tester of a merchant that uses setlist, the merchant is the controller of your personal data and setlist acts as a processor on their behalf. Please also review that merchant’s own privacy policy.

03Information we collect

• Store and account data from Shopify. When a merchant installs setlist we receive an OAuth session and access the store data needed to run the app: shop domain, session tokens, products, variants, SKUs, inventory levels, locations and publication (sales channel) settings. Access is limited to the permissions the merchant grants.
• Product development data you create in setlist. Bills of materials, supply lines, costs and margins, prices, forecasts, product types, launches, classifications, design notes and message threads, and internal reference images you upload.
• Tester and customer data. If a merchant uses the sample testing features, we store tester names, email addresses, phone numbers, notes and questionnaire responses, and we may create or link a Shopify customer record and a Shopify draft order to sell a sample. This data originates from the merchant.
• Integration data. If a merchant connects Fulfil, we sync materials, stock on hand, unit costs and labor, and we store the connection details (subdomain and an encrypted API key).
• Technical and usage data. Server logs, IP address, browser and device information, and basic diagnostic data generated when the app and this website are used.

04How we use information

• Provide, operate and secure the app and website.
• Build SKUs, costs, forecasts and launch readiness, and stage an unlisted draft product and inventory to Shopify when a merchant chooses to.
• Sync materials and costs from Fulfil where connected.
• Run the sample testing workflow, including questionnaires and draft orders.
• Maintain, troubleshoot and improve the service.
• Communicate about the service and respond to support requests.
• Comply with legal obligations and enforce our terms.

We do not sell your personal information, and we do not use Shopify store data or customer data for advertising.

05Where your data is stored

We host the application and store data with the following providers, who process data on our behalf under appropriate data protection terms:

These providers may store and process data in the United States and other countries. We use providers that offer industry standard security and contractual data protection commitments.

06Sharing and disclosure

We share information only as described in this policy: with the sub-processors above; with Shopify and Fulfil to operate the integrations you enable; when required by law or to respond to lawful requests; to protect our rights, our users or the public; and in connection with a merger, acquisition or sale of assets, with notice. We do not sell personal information.

07Shopify and protected data

setlist accesses Shopify store data through the Shopify Admin API using only the scopes a merchant approves. Some scopes, for example the customer and draft order access used by the sample testing program, involve Shopify protected customer data. We access this data only to provide the features the merchant uses, retain it only as long as needed, and handle it in line with Shopify’s API Terms and Protected Customer Data requirements. When a merchant uninstalls setlist, we stop accessing their store and delete or de-identify the associated data as described below.

08Retention and deletion

• We keep data while the merchant’s account is active and the app is installed.
• When the app is uninstalled we receive Shopify’s app uninstall notification and remove the merchant’s stored data within a reasonable period, except where we must retain limited records to meet legal, accounting or security obligations.
• Merchants can request export or deletion of their setlist data at any time by contacting us. A merchant’s customers or testers can exercise their rights through the merchant, who can act on their behalf in setlist.

09Security

We use technical and organizational measures to protect your data, including encryption in transit, access controls, and encryption of sensitive credentials such as connected integration API keys. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

10International transfers

Your data may be processed in the United States and other countries where we and our sub-processors operate. Where required, we rely on appropriate safeguards for international data transfers.

11Your rights

Depending on where you live, you may have rights to access, correct, delete, port or restrict the processing of your personal data, and to object to certain processing. To exercise these rights for data setlist holds as a controller, such as merchant account data or website data, contact us at the address below. For data we process on behalf of a merchant, please contact that merchant. We respond within the timeframes required by applicable law.

12Cookies and this website

The setlist embedded app uses strictly necessary cookies and session tokens to keep you signed in and to operate inside Shopify admin. This marketing website uses minimal cookies and does not run third party advertising trackers. Fonts are served from our own hosting. You can control cookies through your browser settings.

13Children’s privacy

setlist is a business tool and is not directed to children. We do not knowingly collect personal information from children under 16. If you believe a child has provided us information, contact us and we will delete it.

14Changes

We may update this policy from time to time. We will post the new version here and update the date above. Significant changes will be communicated through the app or by email where appropriate.

15Contact

Questions or requests about this policy or your data can be sent to privacy@setlist.app.

setlist
[Legal entity name]
[Registered address]

If you are in the EEA or UK and have an unresolved concern, you may also contact your local data protection authority.