Privacy Policy
This Privacy Policy explains how Welax Home (“we”, “us”, or “our”) collects, uses, stores, shares, and protects information in connection with the YQ Extension Public application (the “App”) that integrates with the Shopify platform for merchants who install or authorize the App.
By installing, authorizing, or using the App, you acknowledge that you have read and understood this Privacy Policy. If you do not agree, please uninstall or stop using the App.
1. Who we are
The App is operated by Welax Home for merchant operations, analytics, content, and related back-office services connected to Shopify stores. For privacy inquiries, please use the contact details in Section 13.
2. Scope
This Privacy Policy applies to:
- Merchants and merchant staff who install, authorize, or use the App;
- Personal data that we process on behalf of a merchant when providing App functionality (for example, customer, order, or product-related data obtained through Shopify APIs); and
- Technical and account-related information generated while operating the App.
This Policy does not cover Shopify’s own privacy practices, or websites/services of third parties that are not controlled by us. Shopify’s practices are described in Shopify’s privacy documentation.
3. Information we collect
3.1 Information collected through Shopify APIs
Depending on the permissions (scopes) granted by the merchant and the features enabled, we may access and process store data through Shopify Admin APIs, webhooks, and related Shopify interfaces, which may include:
- Shop information: shop domain, shop name, shop ID, locale/timezone, contact email associated with the shop, plan or status metadata needed for operation;
- Orders and fulfillment: order identifiers, line items, prices, taxes, discounts, shipping/billing address fields, fulfillment and refund-related data;
- Products and catalog: products, variants, collections, inventory-related fields, media references, and discounts/promotions metadata;
- Customers: customer identifiers, name, email, phone, addresses, tags, and order history references as authorized;
- Marketing / analytics events (if enabled): pixel or event payloads used for attribution and reporting;
- Other resources explicitly authorized by the merchant for App features (for example content, reviews, or support-related data).
We only request and process data that is reasonably necessary to provide the App’s features that the merchant has enabled.
3.2 Information collected directly from merchants
- Configuration and settings entered in the App or our admin systems;
- Support communications (emails, tickets, chat) and related attachments;
- Authentication and authorization records (for example access tokens / connection status stored securely for API access);
- Operational logs related to merchant use of the App (timestamps, actions, error diagnostics).
3.3 Information collected from merchants’ customers
We do not generally collect personal data directly from end customers of a merchant’s storefront unless a specific App feature requires it and is disclosed to the merchant. Customer personal data is typically received from Shopify on the merchant’s instruction when the merchant authorizes the App.
If storefront-facing features are enabled (for example reviews, widgets, or tracking scripts), we may process limited technical data such as IP address, device/browser information, cookie or similar identifiers, and page interaction events, solely to provide those features.
3.4 Automatically collected technical data
- Server logs: IP address, request path, user agent, timestamps, and status codes;
- Security and abuse-prevention signals;
- Performance and error diagnostics needed to keep the App reliable.
4. How we use information
We use the information described above to:
- Provide, operate, maintain, and improve the App’s features for the merchant;
- Synchronize and process store data (orders, products, customers, and related resources) as authorized;
- Authenticate the App, manage access tokens, and prevent unauthorized use;
- Generate operational reports, analytics, and internal business tools for the merchant;
- Provide customer support and respond to inquiries;
- Monitor reliability, detect fraud/abuse, and protect the security of our systems;
- Comply with legal obligations and enforce applicable terms;
- Respond to Shopify mandatory compliance requests (for example customer data request, customer redact, and shop redact) where applicable.
We do not sell personal information. We do not use merchant or customer personal data for unrelated advertising to third parties.
5. Legal bases (where applicable)
Where GDPR or similar laws apply, we process personal data on one or more of the following bases:
- Performance of a contract — to provide the App services requested by the merchant;
- Legitimate interests — to secure, improve, and support the App, balanced against individuals’ rights;
- Legal obligation — where processing is required by applicable law;
- Consent — where required for specific optional features (for example certain cookies or marketing-related processing).
When we process customer personal data obtained from a merchant’s Shopify store, we generally act as a processor / service provider on behalf of the merchant (the controller), except where we determine purposes independently (for example our own account, billing, or security records), in which case we act as a controller for that limited processing.
6. Sharing and disclosure
We may share information only in the following circumstances:
- Service providers / subprocessors: hosting, database, logging, queue, email, or security vendors who process data on our instructions and under confidentiality obligations;
- Shopify: as required to operate integrations, receive webhooks, or fulfill platform compliance workflows;
- Affiliates: internal group entities that need access to operate the App for the merchant, under equivalent protections;
- Legal / safety: when required by law, regulation, legal process, or to protect rights, safety, and integrity of users, merchants, or our systems;
- Business transfers: in connection with a merger, acquisition, financing, or sale of assets, subject to appropriate confidentiality and continuity of protections.
We do not share personal data with third parties for their independent marketing purposes.
7. International data transfers
We may store and process information on servers located in regions where we or our service providers operate, which may include locations outside the merchant’s or customer’s country of residence (for example Asia-Pacific or other regions used for hosting). Where required by law, we implement appropriate safeguards for cross-border transfers (such as contractual protections with subprocessors).
8. Data retention
We retain information only for as long as necessary for the purposes described in this Policy, including:
- While the App is installed / authorized: operational store data needed to provide features;
- After uninstall or authorization revocation: we delete or anonymize shop and related personal data within a reasonable period, generally no later than 30 days, except where longer retention is required for legal, accounting, security, dispute resolution, or backup integrity reasons;
- Shopify compliance webhooks: when we receive a shop/customer redact or data request, we process it in accordance with Shopify’s requirements and applicable law;
- Logs and security records: retained for a limited period for troubleshooting and security monitoring, then deleted or aggregated.
9. Security
We implement reasonable administrative, technical, and organizational measures designed to protect personal data against unauthorized access, loss, misuse, alteration, or disclosure. These may include access controls, encryption in transit (HTTPS), credential encryption at rest where applicable, least-privilege practices, and monitoring.
No method of transmission or storage is completely secure. Merchants are responsible for safeguarding their Shopify accounts and for granting only necessary App permissions.
10. Your rights and choices
10.1 Merchants
- Review and manage App access and permissions in Shopify Admin;
- Uninstall the App at any time to stop new data collection through the App;
- Request access, correction, or deletion of merchant account-related information we control, subject to legal exceptions;
- Contact us for privacy questions using Section 13.
10.2 Merchants’ customers
End customers should generally contact the merchant (the store) regarding their personal data, because the merchant is typically the controller of storefront customer data. We will assist merchants in responding to valid data subject requests that relate to data we process on their behalf, including through Shopify’s mandatory compliance webhook flow where applicable.
Depending on your location, you may have rights under GDPR, UK GDPR, CCPA/CPRA, or similar laws, including rights to access, correct, delete, restrict, object, portability, and to appeal certain decisions. You may also lodge a complaint with a supervisory authority.
11. Children’s privacy
The App is designed for use by businesses and is not directed to children under 16 (or the age required by local law). We do not knowingly collect personal information from children. If you believe a child has provided personal information to us, please contact us and we will take appropriate steps to delete it.
12. Changes to this policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or App features. The “Last updated” date at the top of this page indicates the latest revision. Material changes will be reflected on this page. Continued use of the App after an update constitutes acceptance of the revised Policy, except where additional consent is required by law.
13. Contact us
For privacy-related questions, requests, or complaints regarding YQ Extension Public, contact:
- Operator: Welax Home
- Email: fanfan@honsit-global.com
- Website: https://www.welaxhome.com
Please include your shop domain and a clear description of your request so we can respond efficiently. We will aim to respond within a reasonable period consistent with applicable law.