Privacy Policy

EPR Auto-Tracker · MINISAGE TECH LTD · Last updated: 2026-10-26

1. Who we are

EPR Auto-Tracker / Packaging EPR (“the App”) is operated by MINISAGE TECH LTD, company number 17229324. Registered office: 18 Crowthorp Road, Northampton, NN3 5DU, United Kingdom. Contact: hello@minisage.co.uk.

We are the data controller for personal information used to manage our relationship with merchants, respond to enquiries and secure the App. When we process store order data on a merchant's instructions, the merchant is the controller and we act as processor. This policy covers the App and this website.

2. What data we collect

We receive information from Shopify, from merchants using the App and from people contacting us:

• Shop domain and Shopify access token — required to call the Shopify API on your behalf.
• Shopify session information — session identifiers, permissions and expiry information; sessions may also contain merchant staff user ID, name, email and account details supplied by Shopify.
• Packaging mappings — the material type (e.g. paper, plastic) and weight in grams you assign to each product variant.
• Report headers — country code, reporting period, and aggregated totals (grams per material) saved when you generate a report.
• Report line items — snapshots containing order ID and name, variant ID, product title, quantity, material, packaging weight, ship-to country and order date, used as a report audit trail.
• Service records — plan and DPA acceptance details, custom materials, order-access audit records (including a hashed staff/session reference), and correspondence you send us.
• Public website usage — public pages include Vercel Analytics to measure visits and page usage. The analytics component is excluded from routes starting with /app or /auth.

Order-based reporting remains unavailable pending Shopify protected customer data approval. Where order access is authorised and reporting is available, the reporting code requests orders on demand and stores the line-item snapshots above, rather than full orders.

The reporting code does not request customer names, emails, phone numbers or street addresses; it reads only the shipping country code. Order identifiers can still relate to individuals when linked with information held by the merchant, so we do not treat them as anonymous.

3. How we use data and our lawful bases

• Contract (UK GDPR Article 6(1)(b)): to provide the App, authenticate your Shopify connection and respond to service requests where you are personally party to our contract.
• Legitimate interests (Article 6(1)(f)): to administer business merchant accounts and staff access, respond to business enquiries, understand public website usage, keep the service secure and investigate faults or misuse. Our interests are operating, improving and protecting the service; we must balance these against your rights.
• Legal obligation (Article 6(1)(c)): where processing is necessary to meet applicable legal duties, including responding to data protection requests.
• Merchant instructions: order-related processing for EPR reports and their audit trails is performed as processor. The merchant is responsible for its lawful basis for that processing.

Shop details and API permissions are needed to connect the App; packaging mappings are needed to calculate packaging totals. Without the relevant information we cannot provide those functions. We do not sell your data or use it for advertising.

4. Who receives data

Our service providers process information needed to operate the App:

• Vercel — application hosting, serverless request processing and analytics on public website pages.
• Neon — PostgreSQL storage for shop, session, mapping, report and audit records.
• Shopify — the connected commerce platform providing OAuth, APIs, webhooks and app billing. Shopify's role depends on the processing; its own platform processing is also governed by its privacy terms.

Vercel and Neon act as processors for our controller activities and sub-processors for data we process for merchants. We may also disclose information where legally required. This policy does not change Shopify's own privacy obligations.

5. International transfers

The App is hosted on Vercel. Its Neon database is in AWS us-east-1, United States, so shop domains, Shopify tokens, packaging mappings and report records are stored in the US. Using Vercel and Shopify can also involve processing outside the UK.

Restricted transfers from the UK require a valid transfer mechanism. Depending on the recipient and processing, this can be applicable UK adequacy regulations or appropriate contractual safeguards, such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with the required transfer risk assessment. EU GDPR transfers, where applicable, require an EU transfer mechanism.

For information about safeguards applicable to your data, or to request a copy, contact hello@minisage.co.uk. US hosting alone does not establish that a transfer is protected by an adequacy decision.

6. Data retention and deletion

Shop, mapping and report records are retained while the App is installed. Export any reports you need to keep before uninstalling. The uninstall webhook deletes Shopify session records; the remaining shop data is deleted from the application database when Shopify's authenticated shop/redact webhook is processed. Deletion depends on receipt and successful processing of that webhook, rather than a guaranteed deadline measured from uninstall.

Order-access audit records use a 180-day retention threshold: records older than that are purged when the order-access logging path next runs. This is not a scheduled daily purge. Shop redaction also deletes these records.

Correspondence is kept only for as long as needed to resolve the enquiry and handle related legal obligations or disputes. Application database deletion does not itself establish when provider backups or infrastructure logs expire.

7. Shopify GDPR webhooks

The App authenticates Shopify's mandatory GDPR webhooks and does not log full webhook payloads:

• customers/data_request — acknowledges receipt; it does not automatically export stored records. Contact us for help with a request involving retained order identifiers.
• customers/redact — deletes report line items associated with the specified orders for that shop.
• shop/redact — deletes that shop's sessions, report line items, reports, packaging mappings, custom materials, order-access audit records and shop record in a database transaction.

Webhook logs include shop domain and topic; customer redaction also logs the count of orders to redact.

8. Your rights

Subject to the applicable conditions, you can request access, correction, erasure, restriction of processing or portability of your personal data. You can object to processing based on legitimate interests and withdraw consent where processing relies on consent, without affecting earlier lawful processing. These rights are not absolute.

Contact hello@minisage.co.uk or write to our registered office. We may need to verify your identity. We normally respond within one month; where the law permits an extension, we will explain it. For store customer data, contact the merchant as controller; we assist with requests relating to data we process for them.

You can complain to the UK Information Commissioner's Office (ICO) via ico.org.uk/make-a-complaint. You may contact us first to try to resolve the issue, but this does not remove your right to complain. You may also have the right to complain to your local data protection authority.

9. Changes and contact

We may update this policy. The date at the top identifies the latest revision. For privacy questions, contact MINISAGE TECH LTD at hello@minisage.co.uk or our registered office above.