Store Feed by GrowBoost

Privacy Policy

Last updated: August 17, 2026

This Privacy Policy describes how GrowBoost ("we", "us", or "our") collects, uses, and protects information when you install and use the Store Feed application (the "App") available on the Shopify App Store. Section 9 covers the growboost.pl website itself.

1. Information We Collect

When you install Store Feed, we collect and store the following information:

• Shop domain — your Shopify store's permanent domain (e.g. yourstore.myshopify.com)
• Access token — a Shopify API access token that allows the App to read your store's products, blog articles, and price rules in order to build the feed
• App configuration — your widget settings (title, colors, icon set, visibility preferences, etc.)
• Aggregated analytics — anonymous, aggregated counts of widget impressions and clicks per day, broken down by device type (desktop, tablet, mobile). We do not collect or store any personal data about your store visitors.

2. Information We Do Not Collect

We do not collect:

• Personal data of your store's customers (names, emails, addresses, payment information)
• Customer browsing history or individual tracking data
• Any data beyond what is necessary to operate the App

3. How We Use Your Information

We use the collected information exclusively to:

• Display the Store Feed widget on your storefront with your products, blog posts, and promotions
• Store and refresh the feed cache to ensure fast load times
• Show aggregated analytics (impressions, clicks, CTR) in your app dashboard
• Manage your subscription plan (Free or Starter)

We do not sell, rent, share, or otherwise disclose your data to third parties for their own purposes.

4. Data Storage and Security

Your data is stored in a PostgreSQL database hosted on Supabase (located in the United States). Access to the database is restricted through Row-Level Security (RLS) and is only accessible by the App's backend. We use industry-standard security practices to protect your data.

Your Shopify access token is stored securely in our database and is used solely to make authorized API calls to your store. We do not log or share access tokens.

5. Data Retention

We retain your data for as long as the App is installed on your store. When you uninstall the App, we mark your store as uninstalled and stop accessing your Shopify store data. Upon receiving a shop/redact webhook from Shopify (typically 48 hours after uninstall), we permanently delete all data associated with your store, including the feed cache, analytics, and configuration.

6. Customer Data Requests

As Store Feed does not collect any personal data about your store's customers, we have no customer data to provide or delete in response to customer data requests. We acknowledge and comply with all Shopify mandatory privacy webhooks:

• customers/data_request — acknowledged; no customer data stored
• customers/redact — acknowledged; no customer data stored
• shop/redact — all shop data is permanently deleted

7. Third-Party Services

Store Feed uses the following third-party services to operate:

• Shopify — e-commerce platform and API provider (Shopify Privacy Policy)
• Supabase — database hosting (Supabase Privacy Policy)
• Fly.io — application hosting (Fly.io Privacy Policy)

8. Cookies and Tracking in the Widget

The Store Feed widget uses sessionStorage (not cookies) to remember whether a visitor has dismissed or minimized the widget. This data is stored locally in the visitor's browser and is not transmitted to our servers. It is automatically cleared when the browser session ends.

9. Cookies on This Website

Strictly necessary. We keep your cookie choice in your browser's local storage so the consent banner does not reappear on every visit. This is stored without consent under GDPR Art. 6(1)(f) — our legitimate interest in the site working correctly.

Analytics — with your consent only. If you allow it, we run Google Analytics 4 through Google Tag Manager to count page views and see which pages are useful. Nothing is set until you choose "Allow analytics".

Name	Set by	Purpose	Duration
gb_consent_v1	growboost.pl	Stores your consent choice (local storage)	Until you clear browser data
_ga	Google	Distinguishes visitors in statistics	2 years
_ga_<ID>	Google	Maintains GA4 session state	2 years

We use Google Consent Mode v2 with ad_storage, ad_user_data and ad_personalization permanently set to denied. We run no advertising or remarketing cookies. Analytics data is processed by Google Ireland Limited and retained for 14 months.

You can change your choice at any time: open cookie settings. You can also delete cookies in your browser settings.

You have the right to access, rectify, erase or restrict processing of your data, to withdraw consent at any time, and to lodge a complaint with the Polish supervisory authority (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw). Write to support@growboost.pl to exercise any of them.

10. Launch Notification List

If you enter your email address in the launch form on growboost.pl, we process that address for one purpose only: to send you a single email announcing that Store Feed is available.

Item	Detail
Data collected	Your email address and the fact that you ticked the consent box
Purpose	One launch announcement email — no newsletter, no other marketing
Legal basis	Your consent, GDPR Art. 6(1)(a)
Processor	Google Ireland Limited (Google Forms / Google Workspace), where the responses are stored
Retention	Deleted within 30 days after the launch email is sent, or immediately on request
Sharing	Never sold, rented or passed to anyone else

You can withdraw your consent at any time by writing to support@growboost.pl. Withdrawal does not affect processing carried out before it. If you withdraw before launch, you will not receive the announcement at all.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify merchants of any significant changes by updating the "Last updated" date at the top of this page. Continued use of the App after changes are posted constitutes acceptance of the updated policy.

---