Privacy Policy

Effective date: March 9, 2026
Last updated: March 9, 2026
ONDUTYOPS LLC

This Privacy Policy describes how ONDUTYOPS LLC ("we," "us," or "our") collects, uses, and shares information when you use UnlistedDrop (the "App"), a Shopify application available on the Shopify App Store. By installing or using the App, you agree to the practices described in this policy.

1. Information We Collect

We collect the following information to operate the App:

Merchant information: Shopify store domain, store owner name and email, Shopify plan type, installation date, and subscription status.
Drop and product data: Drop configurations you create, including product IDs, inventory caps, launch windows, and drop type. Drop status and lifecycle events.
Customer registration data: Email addresses of customers who register for a drop on your storefront, registration timestamps, and purchase conversion status.
Analytics data: Drop performance metrics including views, registrations, join rate, and conversion rate.
Technical data: Session tokens, authentication data, IP addresses, and server logs used for security and error tracking.

2. How We Use Your Information

We use the information we collect to:

Provide, operate, and maintain the App and its features
Process drop registrations and send notification emails to registered customers on your behalf
Manage billing and subscriptions through Shopify's Billing API
Display analytics and performance data in your merchant dashboard
Respond to merchant support requests
Detect and prevent fraud or unauthorized access
Improve and develop new App features
Comply with legal obligations

We do not use your data or your customers' data for advertising or for any purpose unrelated to operating the App.

3. Sharing of Information

We do not sell, rent, or trade your personal information or your customers' personal information to third parties.

We share data only with the following service providers, solely to operate the App:

Shopify Inc. — The App operates within Shopify's platform and is subject to Shopify's API policies.
Render — We host the App's backend infrastructure on Render. Data is stored on servers in the United States.
Resend — We use Resend to deliver transactional drop notification emails to your registered customers on your behalf.

We may also disclose information if required by law, court order, or to protect the rights, property, or safety of ONDUTYOPS LLC, our merchants, or others.

4. Shopify Data and GDPR Webhooks

UnlistedDrop is a Shopify embedded app. Our access to your store data is limited to the minimum API scopes required to operate the App. We do not access order history, customer payment data, or any data outside the scopes authorized during installation.

In compliance with Shopify's requirements, we handle the following mandatory webhooks:

customers/data_request: Upon request, we will provide a report of any customer data we hold associated with your store.
customers/redact: We will permanently delete customer data within 30 days of receiving a redaction request.
shop/redact: We will permanently delete all store data and associated customer data within 30 days of a shop redaction request or after the 30-day post-uninstall retention period expires.

5. Data Retention

We retain merchant and customer data for as long as the App is installed on your store, plus a 30-day grace period following uninstallation to allow for reinstallation. After this period, all personally identifiable information is permanently deleted. You may request deletion of your data at any time by contacting us at the address below.

6. Security

We use industry-standard security measures including HTTPS/TLS encryption for all data in transit, encrypted database connections, session token authentication via Shopify App Bridge, and per-shop data isolation to prevent cross-tenant access. No method of transmission over the internet is 100% secure, but we use commercially reasonable measures to protect your data.

7. Your Rights

You have the right to access, correct, delete, or export the data we hold about your store and associated customers. To exercise any of these rights, contact us at privacy@unlisteddrop.com. We will respond within 30 days.

If you are located in the European Economic Area (EEA) or United Kingdom, you have additional rights under the General Data Protection Regulation (GDPR), including the right to restrict processing and the right to lodge a complaint with a supervisory authority.

If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information we collect and the right to request deletion. We do not sell personal information as defined under the CCPA.

As a merchant, you are the data controller for your customers' personal information. UnlistedDrop acts as a data processor on your behalf when handling customer registration data.

8. Cookies

The App does not inject cookies or tracking scripts into your Shopify storefront. The App uses Shopify's session token mechanism for authentication and is fully embedded within Shopify Admin. Our marketing website may use standard page view analytics that do not collect personally identifiable information.

9. Children's Privacy

UnlistedDrop is a business-to-business service intended for Shopify merchants. It is not directed at children under the age of 13, and we do not knowingly collect personal information from children under 13.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the effective date above. For material changes, we will notify merchants via the App or by email. Your continued use of the App after any changes constitutes acceptance of the updated policy.

11. Contact

For questions, concerns, or data requests related to this Privacy Policy:

Company: ONDUTYOPS LLC
Email: privacy@unlisteddrop.com
Website: www.unlisteddrop.com