ECOMMLIST · Effective 20 October 2026

Privacy policy

Arrival Studio is operated by ECOMMLIST. Contact ecommlist@gmail.com for privacy questions, access requests or deletion requests.

Data used to provide the app

We store the Shopify store domain, authenticated app sessions and access tokens, merchant delivery settings, widget drafts and published versions, billing-plan status, usage counters and operational records. With the store’s permission, we read product and variant identifiers and names, tags, collections, location names, markets, the store timezone, shipping profiles, the shipping policy and app activation settings in the published theme. We use these to configure and display delivery estimates. We do not request Admin API customer or order record scopes for the delivery-estimation service.

AI assistance is optional

After a merchant enables AI sharing, a requested assistance task can send selected delivery settings, a bounded selection of product names and identifiers, and sanitized shipping-policy excerpts to our AI provider. Common contact details are removed from policy excerpts. Source text is treated as untrusted input. We do not send Shopify access tokens, application credentials, customer records or order records. Our AI provider processes requests under its API terms and data controls; provider-side retention is governed by those controls. Requests set API response storage to false. AI results are suggestions, and publication always requires a separate merchant action. Sharing can be disabled in the app.

Storefront analytics

The optional analytics feature records daily totals of widget views and interactions, linked to the store and widget. It uses no shopper identifier, tracking cookie, IP address, precise location or order attribution in our application database. Events are sent only when Shopify’s customer-privacy API permits analytics processing, and respect browser Do Not Track and Global Privacy Control. Country context may be sent to select the applicable published policy. More detailed destination inputs are used in the browser for calculations. We do not retain destination inputs as a shopper profile.

Request metadata

Shopify’s app proxy forwards request metadata, including a client IP address and a signed customer identifier when a shopper is logged in. Our application authenticates the proxy request but does not use that identifier or IP address for delivery calculations, customer profiles or analytics, and does not retain either in its application database. Hosting and network providers may process request metadata under their operational logging and retention controls.

Service providers and safeguards

Shopify provides the commerce platform and hosted app subscription flow. Netlify hosts the application, Neon provides its PostgreSQL database, and our AI provider processes optional AI requests. Data may be processed outside your country, including in the United States. Access is restricted to operating the service. Connections use TLS, app tokens are encrypted in application storage, authenticated requests are scoped to the merchant’s store, and secrets stay on the server. We do not sell personal data or use merchant content to advertise to shoppers.

Retention and deletion

Active widget configurations are retained while the app is installed. Historical versions follow the plan’s history allowance; the current published version is preserved. AI runs, audit records, source evidence, saved simulations and aggregated analytics are retained for up to 90 days. Proposals expire within 7 days and are removed by bounded cleanup; records are also eligible for cleanup after 30 days. Activity logs and terminal usage reservations are retained for up to 180 days, completed background jobs for 14 days, and hashed webhook receipts for 30 days. Store-linked monthly quota and operating-cost totals are retained for up to 24 months. Anonymous application-wide operating totals contain no store or shopper identifiers and may be retained longer to enforce operating budgets. Cleanup runs in bounded batches, so processing can take an additional cleanup cycle. App sessions are deleted on uninstall. Shopify’s store-redaction callback erases the tenant and its related records; a backup cleanup removes uninstalled stores after 30 days. Infrastructure backups may persist until the providers’ ordinary backup expiration.

Your choices

Merchants can export their app data, edit delivery settings, unpublish widgets, disable AI and uninstall the app. Contact us for access, correction or deletion requests and other rights available under applicable privacy law. Store customers should contact the merchant responsible for their purchase. We authenticate Shopify privacy webhooks and do not retain their raw customer payloads. We will update this page when data practices materially change.