Privacy Policy

Last Updated: July 27, 2026  |  Effective Date: July 27, 2026

---

1. Information We Collect

We collect the following categories of information to provide and improve our Service:

• Account Information — Your email address, provided during Shopify OAuth installation, used for account creation, authentication, and communication.
• Shopify Store Information — Your store domain and URL, collected via the Shopify API with your explicit authorization, used to display your store within the Tiger Echo dashboard.
• Review & Product Data — Product listings, customer reviews, ratings, and related metadata that you import or sync through the Service.
• Usage Data — Aggregate statistics on AI reply generation counts, email sending records, CSV upload history, feature usage patterns, and in-app behavior. This data is anonymized and used solely for Service improvement.
• Payment & Billing Information — Managed entirely by Shopify. We do not collect, process, or store credit card numbers, bank account details, or billing addresses. Subscription status is retrieved from Shopify's encrypted API.

We do not collect personally identifiable information beyond what is described above. We do not collect browsing history, device location, or marketing preference data.

2. How We Use Your Information

Your information is used exclusively for the following purposes:

• Providing, maintaining, and securing the Tiger Echo Service
• Authenticating your identity and managing your account
• Generating AI-powered review replies based on your imported review data
• Sending automated review request emails on your behalf through our email delivery partner
• Monitoring your review landscape and alerting you to new negative reviews
• Processing and managing your subscription through Shopify's billing infrastructure
• Analyzing usage patterns to improve product features and user experience
• Responding to your support requests and communicating service updates

3. Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA), our legal basis for processing your personal data is:

• Contract Performance (Art. 6(1)(b)) — Processing necessary to provide the Service you requested.
• Legitimate Interests (Art. 6(1)(f)) — Fraud prevention, security, and Service improvement. You have the right to object (see Section 7).
• Consent (Art. 6(1)(a)) — Where you voluntarily opt in to specific features such as marketing emails.

4. Third-Party Service Providers

We share your data only with the following trusted third parties, solely for the purposes of delivering the Service:

Provider	Data Shared	Purpose	Policy
Shopify Inc.	Store domain, email, subscription status	OAuth authentication, billing, API integration	shopify.com/legal/privacy
Resend Inc.	Recipient email addresses, email content	Transactional email delivery (review requests, alerts)	resend.com/privacy
DeepSeek	Review text content (anonymized, no PII)	AI-powered review reply generation	deepseek.com/privacy
AliCloud (Alibaba)	Uploaded images (profile photos, review attachments)	Image storage and CDN delivery	alibabacloud.com/trust-center/privacy

We do not sell, trade, or rent your personal data to any third party. We do not use your data for targeted advertising.

5. Cookies

Tiger Echo uses minimal cookies to ensure the Service functions correctly:

• Essential Session Cookies — Required for authentication and maintaining your logged-in state. These cookies cannot be disabled without making the Service unusable.
• Shopify Session Tokens — Issued by Shopify during OAuth, used to authenticate API requests. Governed by Shopify's cookie policy.
• No Tracking or Advertising Cookies — We do not use Google Analytics, Facebook Pixel, or any third-party tracking cookies.

You may control cookie settings through your browser. Disabling essential cookies will log you out of the Service.

6. Data Retention

• Account Data — Retained for the duration of your active subscription. Upon account cancellation or data deletion request, your account data is deleted within 30 days.
• Review Data — Synced from your Shopify store. Deleting your account removes all imported review data within 30 days.
• Usage Logs — Anonymized aggregate statistics retained for up to 24 months for product analytics.
• Email Records — Sent email records retained for 12 months for audit and compliance purposes.

7. Data Security

We implement the following technical and organizational security measures:

• All data transmitted to and from our servers is encrypted using TLS 1.2+
• API credentials and secrets stored as environment variables, never in source code
• Server infrastructure hosted in Hong Kong, with access restricted to authorized personnel via SSH key authentication
• Database access requires authenticated VPN or direct secure connection
• Regular dependency updates and security patch management

While we strive to protect your data, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.

8. International Data Transfers

Tiger Echo is operated from China, and your data is processed on servers located in Hong Kong SAR, China. If you are located outside China, your data may be transferred across borders. We ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs) where applicable
• Data Processing Agreements with all sub-processors listed in Section 4
• Transfer impact assessments for high-risk jurisdictions

9. Your Rights

9.1 General Rights (All Users)

• Right of Access — Request a copy of all personal data we hold about you.
• Right to Rectification — Request correction of inaccurate or incomplete data.
• Right to Erasure — Request deletion of your account and all associated data.
• Right to Data Portability — Request your data in a machine-readable format (JSON/CSV).
• Right to Object — Object to processing based on legitimate interests.

9.2 GDPR Rights (EU/EEA Users)

In addition to general rights above, you have:

• Right to Restrict Processing — Temporarily restrict processing pending investigation.
• Right to Withdraw Consent — Withdraw consent at any time where processing is consent-based.
• Right to Lodge a Complaint — File a complaint with your national Data Protection Authority (DPA).
• Right to Not Be Subject to Automated Decision-Making — Not be subject to decisions based solely on automated processing that significantly affect you.

9.3 UK GDPR Rights (UK Users)

Same as EU GDPR rights. You may contact the Information Commissioner's Office (ICO) at ico.org.uk.

9.4 CCPA Rights (California Residents)

• Right to Know — Know what personal data we collect, use, and share.
• Right to Delete — Request deletion of personal information.
• Right to Opt-Out — Opt out of the sale of personal information (we do not sell your data).
• Right to Non-Discrimination — Exercising your rights will not result in discriminatory treatment.

9.5 PIPEDA Rights (Canadian Users)

Compliant with PIPEDA. Contact the Office of the Privacy Commissioner of Canada (OPC) at priv.gc.ca.

9.6 Australian Privacy Rights (Australian Users)

Compliant with the Privacy Act 1988 (Cth) and Australian Privacy Principles (APPs). Contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

9.7 Southeast Asian Rights (Singapore, Malaysia, Thailand, Indonesia, etc.)

Compliant with Singapore PDPA, Malaysia PDPA, Thailand PDPA, and equivalent regional laws. You may withdraw consent and request access or correction at any time by contacting us.

10. Children's Privacy

Tiger Echo is not intended for users under the age of 16. We do not knowingly collect personal data from children. If we become aware that a child under 16 has provided us with personal data, we will take steps to delete such information promptly.

11. Automated Decision-Making

Tiger Echo uses AI to generate suggested review replies. These are draft suggestions only — they are displayed to you for review and must be manually approved before any action is taken. You are always in full control. AI-generated content is not used for any automated decisions that produce legal or similarly significant effects on you.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. We will notify you of material changes by:

• Posting the updated policy on this page with a revised "Last Updated" date
• Sending an email notification to your registered email address for significant changes
• Adding a prominent notice within the Tiger Echo dashboard

We encourage you to review this Privacy Policy periodically. Your continued use of the Service after any modification constitutes your acceptance of the revised policy.

13. Contact Us

We aim to respond to all privacy-related requests within 30 days. For complex requests, we may extend this period by an additional 30 days with prior notice.