Privacy Policy

Last Updated: October 11, 2026  |  Effective Date: July 27, 2026

---

1. Information We Collect

We collect the following categories of information to provide and improve our Service:

• Account Information — Your email address, provided during Shopify OAuth installation, used for account creation, authentication, and communication.
• Shopify Store Information — Your store domain and URL, collected via the Shopify API with your explicit authorization, used to display your store within the Tiger Echo dashboard.
• Review & Product Data — Product listings (read from your Shopify store with your read_products permission) and customer reviews, ratings, and related metadata that you import or paste into the Service.
• Usage Data — Aggregate statistics on AI reply generation counts, email sending records, CSV upload history, feature usage patterns, and in-app behavior. This data is anonymized and used solely for Service improvement.
• Payment & Billing Information — Managed entirely by Shopify. We do not collect, process, or store credit card numbers, bank account details, or billing addresses. Subscription status is retrieved from Shopify's encrypted API.

We do not collect personally identifiable information beyond what is described above. We do not collect browsing history, device location, or marketing preference data.

2. How We Use Your Information

Your information is used exclusively for the following purposes:

• Providing, maintaining, and securing the Tiger Echo Service
• Authenticating your identity and managing your account
• Generating AI-powered review replies based on your imported review data
• Sending automated review request emails on your behalf through our email delivery partner
• Monitoring your review landscape and alerting you to new negative reviews
• Processing and managing your subscription through Shopify's billing infrastructure
• Analyzing usage patterns to improve product features and user experience
• Responding to your support requests and communicating service updates

3. Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA), our legal basis for processing your personal data is:

• Contract Performance (Art. 6(1)(b)) — Processing necessary to provide the Service you requested.
• Legitimate Interests (Art. 6(1)(f)) — Fraud prevention, security, and Service improvement. You have the right to object (see Section 7).
• Consent (Art. 6(1)(a)) — Where you voluntarily opt in to specific features such as marketing emails.

4. Third-Party Service Providers

We share your data only with the following trusted third parties, solely for the purposes of delivering the Service:

Provider	Data Shared	Purpose	Policy
Shopify Inc.	Store domain, email, subscription status	OAuth authentication, billing, API integration	shopify.com/legal/privacy
Resend Inc.	Recipient email addresses, email content	Transactional email delivery (review requests, alerts)	resend.com/privacy
DeepSeek	Review/email text and any reviewer details you import, used solely to generate reply/email drafts and review analytics summaries in real time (never used to train any model)	AI-powered reply/email draft generation and review analytics	deepseek.com/privacy
AliCloud (Alibaba)	Uploaded images (profile photos, review attachments)	Image storage and CDN delivery	alibabacloud.com/trust-center/privacy

We do not sell, trade, or rent your personal data to any third party. We do not use your data for targeted advertising.

Our web interface loads open-source front-end libraries (Bootstrap, Chart.js, Bootstrap Icons) from the public jsDelivr CDN. These requests transmit only your browser's technical information (IP address, user agent) to the CDN and do not include any of your personal data.

5. Cookies

Tiger Echo uses minimal cookies to ensure the Service functions correctly:

• Essential Session Cookies — Required for authentication and maintaining your logged-in state. These cookies cannot be disabled without making the Service unusable.
• Shopify Session Tokens — Issued by Shopify during OAuth, used to authenticate API requests. Governed by Shopify's cookie policy.
• No Tracking or Advertising Cookies — We do not use Google Analytics, Facebook Pixel, or any third-party tracking cookies.

You may control cookie settings through your browser. Disabling essential cookies will log you out of the Service.

6. Data Retention

• Account Data — Retained for the duration of your active subscription. When you uninstall the App or request deletion, we delete your store's data within 48 hours (and in any event within the 30-day maximum required by Shopify's API Terms).
• Review Data — Imported or synced review data is removed within 48 hours of uninstall or deletion request (maximum 30 days).
• Usage Logs — Anonymized aggregate statistics retained for up to 24 months for product analytics.
• Email Records — Sent email records retained for 12 months for audit and compliance purposes.

7. Data Security

We implement the following technical and organizational security measures:

• All data transmitted to and from our servers is encrypted using TLS 1.2+
• API credentials and secrets stored as environment variables, never in source code
• Server infrastructure hosted in Hong Kong, with access restricted to authorized personnel via SSH key authentication
• Database access requires authenticated VPN or direct secure connection
• Regular dependency updates and security patch management

While we strive to protect your data, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify affected users without undue delay and, where feasible, within 72 hours of becoming aware of the breach, and we will also notify the competent supervisory authority as required by applicable law (e.g., GDPR Art. 33).

8. International Data Transfers

Tiger Echo's application servers are located in Hong Kong SAR, China. Depending on the feature used, your data may also be processed by the following sub-processors in other jurisdictions:

• DeepSeek — review/email text is processed on servers in Mainland China to generate AI drafts and review analytics summaries.
• AliCloud (Alibaba Cloud) — review images are stored in the Hong Kong SAR region.
• Shopify Inc. — platform data is processed in Canada / Singapore and other Shopify regions.
• Resend Inc. — email delivery is processed in the United States.

For transfers of personal data from the EEA, the United Kingdom, or Switzerland to these third countries, we rely on Standard Contractual Clauses (SCCs, Module Two — Controller-to-Processor) and/or the UK International Data Transfer Addendum, together with the data-processing agreements in place with each sub-processor and transfer impact assessments where required. Where a destination benefits from an adequacy decision (e.g., Canada, the UK, Switzerland), transfers rely on that basis.

9. Your Rights

9.1 General Rights (All Users)

• Right of Access — Request a copy of all personal data we hold about you.
• Right to Rectification — Request correction of inaccurate or incomplete data.
• Right to Erasure — Request deletion of your account and all associated data.
• Right to Data Portability — Request your data in a machine-readable format (JSON/CSV).
• Right to Object — Object to processing based on legitimate interests.

9.2 GDPR Rights (EU/EEA Users)

In addition to general rights above, you have:

• Right to Restrict Processing — Temporarily restrict processing pending investigation.
• Right to Withdraw Consent — Withdraw consent at any time where processing is consent-based.
• Right to Lodge a Complaint — File a complaint with your national Data Protection Authority (DPA).
• Right to Not Be Subject to Automated Decision-Making — Not be subject to decisions based solely on automated processing that significantly affect you.

9.3 UK GDPR Rights (UK Users)

Same as EU GDPR rights. You may contact the Information Commissioner's Office (ICO) at ico.org.uk.

9.4 CCPA Rights (California Residents)

• Right to Know — Know what personal data we collect, use, and share.
• Right to Delete — Request deletion of personal information.
• Right to Opt-Out — Opt out of the sale or sharing of personal information (we do not sell or share your data).
• Global Privacy Control (GPC) — We honor the GPC browser signal. If your browser sends a GPC signal, we treat it as a valid opt-out request for any sale or sharing of personal information.
• Right to Non-Discrimination — Exercising your rights will not result in discriminatory treatment.

9.5 PIPEDA Rights (Canadian Users)

Compliant with PIPEDA. Contact the Office of the Privacy Commissioner of Canada (OPC) at priv.gc.ca.

9.6 Australian Privacy Rights (Australian Users)

Compliant with the Privacy Act 1988 (Cth) and Australian Privacy Principles (APPs). Contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

9.7 Southeast Asian Rights (Singapore, Malaysia, Thailand, Indonesia, etc.)

Compliant with Singapore PDPA, Malaysia PDPA, Thailand PDPA, and equivalent regional laws. You may withdraw consent and request access or correction at any time by contacting us.

9.8 Brazil — LGPD Rights

If you are in Brazil, we comply with the Lei Geral de Proteção de Dados (LGPD, Law No. 13.709/2018). You have the same rights as described above (access, correction, deletion, portability, and objection), plus the right to revoke consent. You may contact the Autoridade Nacional de Proteção de Dados (ANPD) at gov.br/anpd.

9.9 Middle East Rights (UAE, Saudi Arabia, Egypt)

We comply with regional data protection laws, including the UAE Federal Decree-Law No. (45) of 2021 (PDPL) together with its DIFC and ADGM free-zone regimes; the Kingdom of Saudi Arabia Personal Data Protection Law (PDPL, Royal Decree M/19); and the Egyptian Personal Data Protection Law No. 151 of 2020. Data subjects in these jurisdictions may exercise access, correction, deletion, and portability rights by contacting us, and may reach their respective authorities: UAE u.ae / DIFC Commissioner, Saudi SDAIA (sdaia.gov.sa), and the Egyptian Data Protection Center.

9.10 Hong Kong — PDPO Rights

Residents of Hong Kong may exercise their rights under the Personal Data (Privacy) Ordinance (PDPO), including access, correction, and data-erasure requests. You may contact the Office of the Privacy Commissioner for Personal Data (PCPD) at pcpd.org.hk.

9.11 Switzerland — FADP Rights

Residents of Switzerland are protected under the revised Federal Act on Data Protection (FADP, SR 235.1) and may exercise rights equivalent to the GDPR. You may contact the Federal Data Protection and Information Commissioner (FDPIC) at edoeb.admin.ch.

10. Children's Privacy

Tiger Echo is a business-to-business (B2B) service intended for Shopify merchants who are businesses or adults operating a store. We do not knowingly collect personal data from children. Under the U.S. Children's Online Privacy Protection Act (COPPA), we do not collect personal data from children under 13, and under GDPR we do not target or knowingly collect data from children under 16. If we become aware that we have collected personal data from a child below the applicable age, we will take steps to delete such information promptly.

11. Automated Decision-Making

Tiger Echo uses AI to generate suggested review replies. These are draft suggestions only — they are displayed to you for review and must be manually approved before any action is taken. You are always in full control. AI-generated content is not used for any automated decisions that produce legal or similarly significant effects on you.

11.1 Marketing Communications & Email Consent

Tiger Echo's email features (review-request emails and campaigns) send messages only to recipients whose contact details you (the merchant) provide. You are responsible for ensuring you have a lawful basis — such as the recipient's consent or a legitimate interest under applicable law (e.g., a post-purchase review request) — before sending. We do not purchase, rent, or scrape email lists. Every marketing email we send includes a visible unsubscribe link, and we process opt-out requests promptly in compliance with applicable anti-spam laws, including the U.S. CAN-SPAM Act and Canada's Anti-Spam Legislation (CASL).

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. We will notify you of material changes by:

• Posting the updated policy on this page with a revised "Last Updated" date
• Sending an email notification to your registered email address for significant changes
• Adding a prominent notice within the Tiger Echo dashboard

We encourage you to review this Privacy Policy periodically. Your continued use of the Service after any modification constitutes your acceptance of the revised policy.

13. Contact Us

We aim to respond to all privacy-related requests within 30 days. For complex requests, we may extend this period by an additional 30 days with prior notice.