Privacy policy

Kinetic Workflows (“we”, “us” or “our”) operates Kinetic Store Locator, a Shopify app. We are based in Western Australia, Australia. This policy applies to Shopify merchants who install the app, authorised merchant users, people who submit information through an optional dealer form, and visitors who interact with a merchant’s store locator.

1. Information we collect and process

Shopify installation and merchant information

• Shopify shop domain and shop identity, app installation status, authorised access scopes, encrypted access and refresh tokens, subscription plan and billing status.
• App settings, import history and configuration choices made by authorised merchant users.
• Support communications and information a merchant chooses to send us.

Location and dealer information

Merchants may enter or import location and dealer information such as a business name, street address, geographic coordinates, phone number, email address, website, opening hours, images, notes, tags, product associations, social links and merchant-defined custom fields. Some of this information may be personal information, particularly for sole traders or individual contacts.

If a merchant enables dealer submissions, an applicant may provide a contact email, notes and proposed location information. The submission is provided to that merchant for review.

Storefront use and analytics

The locator records limited interaction events so merchants can understand how it is used. These may include search text, selected filters, location selections, directions or website clicks, the selected location’s name, city and country, and a timestamp. Events are associated with the merchant’s shop, not with a Shopify customer account.

We do not intentionally collect Shopify customer, order, checkout or payment records. We do not intentionally store a visitor’s precise device location in analytics. As with most hosted services, our infrastructure may create security and operational logs containing an IP address, browser or device information, request details and timestamps.

Cookies and browser location

The embedded merchant administration uses a short-lived, signed cookie to maintain an authorised Shopify admin session. The public locator does not set its own advertising cookies.

If a visitor chooses “use my location”, the browser asks for permission. The coordinates are used transiently in that browser to calculate distances and position the map; the app records only that the location feature was used, not the coordinates. A typed address search is sent from the browser to OpenStreetMap’s Nominatim geocoding service.

2. How we use information

• install, authenticate, operate and secure the app;
• keep each merchant’s information isolated from other merchants;
• display locations, maps and merchant-selected information;
• process dealer submissions and merchant requests;
• administer plans and Shopify billing;
• provide merchant analytics and improve reliability and usability;
• respond to support, privacy, security and legal requests; and
• detect misuse and protect the app, merchants and visitors.

Depending on the context and applicable law, we rely on performing our contract with the merchant, legitimate interests in operating and securing the service, consent (including browser geolocation permission), and compliance with legal obligations.

3. When information is disclosed

We do not sell personal information and do not use merchant or visitor information for targeted advertising. We disclose information only as needed to provide the app, comply with law, protect rights and security, or complete a business transaction subject to appropriate safeguards.

A merchant’s published location information is visible to visitors of that merchant’s storefront. Dealer submissions are visible to authorised users of the merchant receiving the submission.

4. International processing

We operate from Australia. Production application data is hosted using Google Cloud in the United States, and our service providers may process information in other countries where they or their subprocessors operate. Privacy protections and legal rights may differ between countries. We use reputable providers and rely on their contractual and organisational safeguards for international processing.

5. Retention and deletion

• Merchant configuration, installation credentials, locations, submissions and interaction events are generally retained while the app is installed.
• Locator interaction analytics are automatically limited to the most recent 10,000 events per merchant and events older than 400 days are removed.
• When Shopify notifies us that the app has been uninstalled or sends a shop redaction request, we delete the merchant payload and credentials. We retain only a minimal deletion marker containing the shop domain and deletion time to prevent deleted data from being restored.
• Support correspondence and security or infrastructure logs may be retained for as long as reasonably needed for support, security, dispute resolution and legal compliance, subject to provider retention settings.

A merchant can request earlier export, correction or deletion by contacting us. We may retain limited information where required by law or necessary to establish, exercise or defend legal claims.

6. Security

We use measures appropriate to the nature of the information, including HTTPS in transit, encryption of Shopify access credentials before database storage, signed merchant sessions, access controls, tenant separation by permanent Shopify shop domain, input validation and mandatory Shopify privacy webhooks. No system is completely secure, and we cannot guarantee absolute security.

7. Your choices and rights

Depending on where you live, you may have rights to ask for access, correction, deletion, restriction, objection, portability or withdrawal of consent. You may also have the right to complain to a privacy regulator. We do not discriminate against anyone for exercising a privacy right.

• Visitors can refuse or revoke browser geolocation permission.
• Merchants control what location information is published and can edit or delete it.
• Merchants can uninstall the app and can request an export or earlier deletion.
• California residents may request information about collection and disclosure. We do not sell personal information or share it for cross-context behavioural advertising.

If information was supplied through a merchant’s storefront, contact that merchant first. We will assist the merchant with a verified request where appropriate. Requests sent directly to us should identify the relevant *.myshopify.com domain. We may need to verify the requester’s identity.

8. Merchant responsibilities

Merchants decide what information to place in the app and how the locator and dealer form are used. Each merchant is responsible for having an appropriate legal basis, giving required notices, obtaining necessary consents, responding to its customers and applicants, and avoiding unnecessary sensitive information.

9. Children

Kinetic Store Locator is a business service and is not directed to children. We do not knowingly collect personal information from children through the app.

10. Changes to this policy

We may update this policy as the app, service providers or legal requirements change. We will publish the revised policy here and update the “Last updated” date. If a change is material, we will provide additional notice where required.

11. Questions, requests and complaints

Contact us using the details below. We will review privacy requests and complaints and respond within a reasonable period. If you are not satisfied with our response, you may be able to complain to the Office of the Australian Information Commissioner or the privacy regulator where you live.