Privacy Policy

1. Introduction

This Privacy Policy explains how Formeo (“we”, “us”, or “our”), a software application owned and operated as part of the Replyeo Labs (https://replyeo.com), collects, processes, and protects information when Shopify merchants install and use our Shopify application, storefront extension, and related services (collectively, the “Service”).

We are committed to full compliance with global privacy regulations including the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and the mandatory Shopify App Store Developer requirements.

2. Data Controller vs. Data Processor

Under data protection regulations, there is an important distinction between the data we handle:

• Merchant Data (We act as Data Controller): When store owners install Formeo, register, configure settings, or contact our support team, we act as a Data Controller for merchant contact information, billing records, and support correspondences.
• Customer Order Data (We act as Data Processor): When end-customers place Cash on Delivery orders via Formeo on a merchant's Shopify storefront, the merchant is the Data Controller, and Formeo acts strictly as a Data Processor under a standard Data Processing Addendum (DPA) to execute the checkout and synchronize the order to Shopify.

3. Information We Collect

A. Information Collected Automatically Upon Installation:

• Shopify store domain (e.g. store.myshopify.com)
• Shop currency, timezone, and primary store language
• OAuth access tokens granted under authorized scopes (read_orders, write_orders, read_themes, write_themes)

B. Information Processed During Storefront COD Orders:

• Customer Full Name
• Customer Phone Number (used for order dispatch and WhatsApp/SMS OTP fraud verification)
• Delivery Address, City, Province, and Postal Code
• Cart line items, quantity selections, and in-form upsells
• IP address and browser user-agent (used strictly for fraud defense and duplicate order filtering)

4. How We Use Collected Information

• To instantly create draft orders or completed orders inside your Shopify Admin.
• To deliver OTP verification codes via WhatsApp or SMS to prevent fake courier deliveries.
• To synchronize order lines to connected Google Sheets or third-party webhooks selected by the merchant.
• To fire standard marketing pixel events (Meta CAPI, TikTok, Google Ads) as configured by the merchant.
• To provide technical assistance and customer support.

5. Compliance with Mandatory Shopify Privacy Webhooks

Formeo fully implements and respects all mandatory Shopify compliance webhooks:

• customers/data_request: Upon receiving a customer data request from Shopify, we export all stored data relating to that customer within 48 hours.
• customers/redact: When a store owner or customer requests data erasure, our automated workers immediately purge all identifying customer records from our logs.
• shop/redact: 48 hours after a merchant uninstalls Formeo, all associated store configurations, tokens, and cached orders are permanently deleted from our database.

6. Data Security & Storage

All data transmitted between storefront visitors, Formeo servers, and Shopify is encrypted using industry-standard TLS 1.3 cryptographic protocols. Databases are hosted within secured, enterprise-grade cloud environments with role-based access control and strict firewall isolation.

7. Contact Information

If you have any questions, requests for data redaction, or privacy concerns, please contact our Data Protection Officer: