Grammo: Packaging EPR Report helps Shopify merchants work out how much packaging they place on the market in each country, so they can prepare their packaging (EPR) reports and show their registration numbers on their storefront.
The app is operated by StoreFleet (Jose James, LLC, 131 Continental Dr, Suite 305, Newark, DE 19713, USA), which is responsible for the data described in this policy. You can reach us at [email protected].
Your app data, such as the interface language, your packaging library, your packaging rules, the packaging assigned to each product variant, your registration numbers, your report settings and the headline figures of your last report, is stored in your own Shopify store as app-owned metafields on your shop and product variants. It is not copied to the app's server, except in the report snapshots and declared figures you choose to save, described below.
The app's server stores your shop domain, shop name, granted access scopes, install and uninstall dates and an encrypted access token, so it can keep your installation working.
It also keeps a short shop profile, refreshed about once a day: the shop name and myshopify domain, the shop owner's email address and the shop's contact email, your Shopify plan and whether the shop is a development store, the shop's country (not its street address), currency, time zone, primary language, number of products and the date the shop was created. It does not store the shop's address, phone number, owner name or location coordinates.
If you subscribe to the Pro plan, Shopify bills it; the server reads your plan from Shopify and stores only the date your shop first started a Pro subscription, so the trial is offered once. It does not receive or store payment details.
If you add email addresses in the app's settings, the server stores each address with the date it was added and, if it unsubscribed, the date it did, so the app can send the emails you turned on and never email an address that unsubscribed.
If you save a report snapshot (Pro), the server stores the snapshot's name and the figures of that report run: totals per destination country and material, the data gaps found, your packaging components, your shipping rules, and the name, SKU, units shipped and packaging of each product variant shipped in the period. A snapshot contains no orders, customers or addresses. Snapshots stay until you delete them in the app or your shop's data is erased.
If you enter declared figures (Pro), the server stores, for each year and kind (plan quantities or year-end figures), the kilograms per German material category, the dual system you chose and when you saved them. They contain no personal data and stay until you delete them in the app or your shop's data is erased.
If you turn on email alerts (Pro), the server stores which alerts you chose and their language, when it last checked and last emailed, and which thresholds it has already reported. Once a day it uses the app's access to your store to read the product variants created since the last check (their name, SKU and whether they have packaging) and the headline figures of your last report, and writes the alert email from them; it does not keep this product data or these figures. Your alert settings stay until you change them or your shop's data is erased.
It records the time each time you finish a report (not the report's figures), so it can count how often reports are run.
When Shopify sends a privacy request about one of your customers, the server logs that the request arrived, with the customer and order IDs it names but without the customer's name, email or phone.
To build reports, the app reads your orders (their fulfillments, the quantity of each item shipped and the destination country) and your products, only inside your browser while you use the app. Order data is never sent to or stored on the app's server, and it is not shared with anyone. The app uses only the destination country from the shipping address; it does not use customer names, emails or phone numbers. Report files are created in your browser and saved to your device.
The in-app support chat is run by our support service, StoreFleet Support Hub. When you use it, the app sends the service your messages, your shop domain and shop name, your Shopify plan, the app's granted scopes and install date, and the name, email address, language and role (owner, staff or collaborator) of the staff member who is chatting, as provided by Shopify. The support service stores the conversation, linked to your shop domain, so our team can answer you.
Each time the app is installed or uninstalled, and the first time you finish a report, the app sends a notice to our support service, StoreFleet Support Hub, which we operate. The notice contains your shop domain and shop name, whether the shop is a development store, the shop owner's email address (or the shop's contact email when the owner's is empty) and the shop's primary language.
These notices, and a daily update, also carry the short shop profile described above, so our team can see which plan, country and setup the app is used with. The daily update also carries usage counts of the app's features: how many packaging components, shipping rules, variants with packaging and registrations (and how many of them are shown on the storefront) you have, how many countries your last report covered, how many reports you ran in the last 30 days, and whether you saved report defaults and turned on the storefront embed or block. These are numbers and on/off values only, never the content of your packaging data, registrations, reports or orders.
The app's admin pages may use Microsoft Clarity to understand how merchants and their staff use the app, so we can improve it. Clarity records page interactions inside the app (clicks, scrolling, mouse movement and the pages viewed) as session replays and heatmaps, tagged with your shop domain, the app name and the app's plan. Text typed into fields and the support chat are masked, so their content is not recorded. Clarity runs without cookies: the app tells Clarity that analytics and advertising storage are denied, so visits are not linked to each other through cookies. Clarity does not run on your storefront and does not receive your order or customer data. Microsoft processes this data on our behalf; recordings are kept for 30 days and recordings we mark as favorites, plus a sample Microsoft selects at random, for up to 9 months.
We use the email address and language only to send you service emails about the app: a welcome, setup help, tips, questions about your satisfaction and feedback, a request to review the app, and a short note after you uninstall it. Development stores are never emailed. You can opt out at any time with the unsubscribe link in any of these emails or by writing to [email protected].
The app emails only the addresses you add in its settings, and only for the emails you turn on there. Every email carries a one-click unsubscribe link; an address that unsubscribed is never emailed again by the app. Each recipient gets a separate message, so no recipient sees the others' addresses.
We store your installation details and access token, and read your orders and products in your browser, because we need them to provide the app you installed (performance of our agreement with you). We store support conversations so we can answer the questions you send us (performance of our agreement with you). We send service emails and the emails you turn on in the app, and log the privacy requests Shopify sends us on the basis of our legitimate interests in helping you use the app, improving it and showing that we handled those requests. We send the daily usage counts and use Microsoft Clarity on the basis of our legitimate interests in understanding which features are used and improving the app. You can object to service emails at any time as described above, and to usage analytics by writing to us.
The app does not sell any data. To answer support chat messages, the support service mirrors them, with your shop domain and shop name, to our support team's Slack workspace (Slack Technologies) and may use an AI model provider (Anthropic) to draft replies. Service emails and the app's emails are sent through our own mail server, which we operate; no third-party email provider receives them. Usage analytics of the app's admin pages are processed by Microsoft (Clarity). Nothing else is shared with third parties.
Support messages sent to Anthropic are used only to draft replies to you. Neither we nor Anthropic use your support messages, or any other data we receive from your store or about your customers (including data derived from it or aggregated), to develop or train artificial intelligence or machine learning models.
Slack Technologies, Anthropic and Microsoft may process the data described above outside the European Union, the European Economic Area and the United Kingdom, including in the United States. Where a country does not have an adequacy decision from the European Commission (or, for UK data, UK adequacy regulations), we rely on the safeguards in each provider's data processing terms: certification under the EU-US Data Privacy Framework (and its UK Extension) where the provider is certified, and otherwise the European Commission's Standard Contractual Clauses, together with the UK International Data Transfer Addendum for UK data.
You can ask for a copy of the safeguards that apply to a transfer by writing to [email protected].
When you uninstall the app, Shopify revokes its access, the installation is marked as uninstalled and the stored refresh token is discarded. 48 hours later Shopify asks the app to erase your shop's data. The server then asks the support service to delete your shop's support conversations, deletes the privacy requests it logged for your customers, the email addresses you added, your alert settings, your declared figures, your report snapshots, the record of whether your shop used its Pro trial, and your installation record. It keeps only a record that your shop's erasure request arrived. Copies of support messages already posted to Slack are not deleted automatically; ask us through the contact below to remove them.
Uninstalling does not necessarily remove the app data stored in your store's metafields; it may stay in your store until it is removed, and the app cannot reach it once uninstalled. To remove it, use the app before uninstalling: clear the packaging of your variants on the Products page (Clear packaging) and delete your packaging components, packaging rules and registrations. If you have already uninstalled, reinstall the app to do this. Your interface language, report settings and last report figures contain no personal data and stay in your store; contact us if you want help removing them.
We keep your installation record, support conversations and the privacy requests logged for your customers while the app is installed, and delete them when Shopify asks the app to erase your shop's data, as described above. We keep the email address and language from service-email notices only for as long as we send you service emails about the app; after you opt out or your shop's data is erased, we stop using them and delete them. We keep the record that your shop's erasure request arrived only as long as we need it to show that we handled the request. You can ask us to delete any of this data sooner through the contact below.
Depending on where you are, you may have the right to ask for access to, correction or deletion of personal data we hold about you, to object to or restrict its use (including opting out of service emails), and to lodge a complaint with your local data protection authority. Merchants can send these requests to the contact below. If you are a customer of a shop that uses the app, contact that shop: its requests reach us through Shopify's privacy requests, as described above.
Questions about this policy or your data can be sent to [email protected] or through the support contact on the app's Shopify App Store listing.