AccessYesAccessYes is a Shopify app that adds an accessibility menu to a store. This policy explains what information the app handles, why, and for how long. It covers two groups of people: merchants, who install the app and use its admin, and visitors to the stores that use it.
In short
- We keep the information we need to run the app for your store: your store's details, your settings and your support messages.
- We hold no information about your customers or your storefront visitors.
- A visitor's accessibility settings stay in their own browser. The menu sets no cookies.
- The usage numbers on your dashboard are counts, not records of people.
- We never sell information or use it for advertising.
- When you uninstall the app, everything about your store is deleted 48 hours later.
Who we are
The app is run by AccessYes("we", "us"). You can reach us at support@accessyes.app.
For merchant information, we are the controller under the EU and UK General Data Protection Regulation (GDPR). For the little we handle on a store's behalf when its visitors use the menu, the merchant is the controller and we act as their processor.
Information about merchants
What we receive from Shopify
When you install the app and open it in your Shopify admin, Shopify gives us:
- your store's name, its myshopify.com address and its primary domain;
- the store owner's email address and the store's time zone;
- an ID for each staff member who opens the app, so we can sign them in, and the language their admin uses;
- an access token that lets the app read your store's themes, and, if you publish an accessibility statement, create and update that one page;
- which AccessYes plan your store is on. Payments go through Shopify; we never see card or bank details.
What you give us
- Settings: how the menu looks and behaves, which tools it offers, and any icon you upload.
- Setup progress: which onboarding and setup steps you have done.
- Accessibility statement: if you publish one, we record which page in your store the app created, so we can keep it up to date.
- Support requests: your messages, attachments, and the email address you want us to reply to.
We email the store owner about the app: a welcome message, reminders to finish setup, and a short note after uninstalling. Each of these has an unsubscribe link. Replies to support requests go to the address you gave us.
Information about storefront visitors
The menu is built to work without knowing who a visitor is.
Settings stay on the visitor's device
The adjustments a visitor turns on, such as a larger text size, are saved in their own browser's local storage so they last from page to page. They are never sent to us. The visitor can clear them with the menu's Reset button or by clearing their browser's site data. The menu sets no cookies.
Usage counts
To fill the merchant's dashboard, the menu tells our server when:
- a page with the menu loads;
- the menu is opened;
- an adjustment or a profile is turned on (which one, and at what level).
Each report names only the store. It carries no cookie, no identifier, and nothing the browser stores, so reports cannot be linked to each other or to a person.
IP addresses
Like any website, our server sees the IP address of each request. To stop abuse, it counts requests per address for a minute using a scrambled (hashed) form of the address, which disappears after two minutes. The address is not stored with the usage counts. Our web server also keeps standard access logs, which include IP addresses, for up to 14 days for security and troubleshooting.
Country
On the Pro plan a merchant can choose the menu's language, or whether it shows at all, by country. Shopify works out the visitor's country on the storefront as it does for prices and currencies; the decision is made in the visitor's browser and the country is not sent to us.
Read aloud
Read aloud uses the voices built into the visitor's browser or device. We do not receive what is read. Some browsers use their maker's online voices; that is between the visitor and their browser.
Customer data
The app does not access your customers, orders or checkout. If a customer asks Shopify for their data or for its deletion, we have nothing to return or delete, and we answer Shopify's request accordingly.
How we use information
- To provide the app: sign you in, save and publish your settings, and show your dashboard.
- To publish and update your accessibility statement page when you ask us to.
- To answer support requests.
- To send the emails described above.
- To keep the service secure, prevent abuse, and fix errors.
- To improve the app, using totals across stores.
We do not sell information, share it for advertising, or use it to profile anyone.
Legal bases
Under the GDPR we rely on:
- Contract, to provide the app you installed and answer your support requests;
- Legitimate interests, for security, abuse prevention, error monitoring, aggregate product improvement and service emails about the app (you can unsubscribe at any time);
- Legal obligation, where a law requires us to keep or disclose information.
Who we share it with
We use a few service providers to run the app. They process information only on our instructions.
| Provider | What for |
|---|---|
| Shopify | The platform the app runs on: sign-in, billing, and the storefront the menu loads in |
| Cloudflare | Hosting the app's admin pages and sending email |
| Our server host | Running the app's server and database |
| Sentry | Reporting errors in the app, set up not to collect personal data such as IP addresses |
We may also disclose information when the law requires it, or to a buyer if the app is sold, in which case this policy continues to apply.
International transfers
Some providers process information outside the European Economic Area or the UK. Where they do, the transfer is covered by an adequacy decision, such as the EU–US Data Privacy Framework, or by the European Commission's Standard Contractual Clauses.
How long we keep it
| Information | Kept |
|---|---|
| Individual usage reports | 7 days, then only the daily totals remain |
| Daily usage totals | While the app is installed |
| Rate-limit counters | 2 minutes |
| Server access logs | Up to 14 days |
| Store details, settings, uploaded icons, support requests | While the app is installed, and 48 hours after uninstalling |
| Access token | Deleted as soon as the app is uninstalled |
Shopify asks us to erase a store's data 48 hours after it uninstalls the app. We then delete everything about the store. If you reinstall before that, your settings are still there. The accessibility statement page is your store's content and stays in your store until you delete it.
Security
Information travels over HTTPS. Requests from Shopify are verified with signatures, and each store can reach only its own data. Access to our systems is limited to the people who run the app.
Your rights
Depending on where you live, you can ask to see the information we hold about you, correct it, delete it, receive a copy, restrict or object to how we use it, and withdraw consent where we rely on it. To do so, emailsupport@accessyes.app. We answer within one month. You can also complain to your data protection authority.
If you shop at a store that uses AccessYes, contact that store first: it decides how its storefront handles your information. We will help it answer you.
Children
The app is for businesses and is not directed at children.
Changes to this policy
When we change this policy, we update the date at the top. If a change matters to how we use your information, we will tell store owners by email before it takes effect.
Contact
Questions about this policy or your information: support@accessyes.app.