Configurator - Privacy Policy

Privacy Policy — NetSource Product Configurator

Last updated: May 12, 2026 Effective date: May 12, 2026

This Privacy Policy describes how NetSource Inc. (“NetSource”, “we”, “us”, or “our”) collects, uses, stores, shares, and protects personal information in connection with the NetSource Configurator application (the “App”) installed on Shopify stores from the Shopify App Store.

This policy is written to comply with the Shopify Partner Program requirements, the EU General Data Protection Regulation (GDPR), the UK GDPR, the California Consumer Privacy Act (CCPA / CPRA), and Canada’s PIPEDA.

If you are a merchant who has installed the App, this policy explains what we do with your store’s data. If you are a customer of a Shopify store that uses the App, this policy explains what data the App processes on the merchant’s behalf when you save product configurations or request quotes.

1. Who we are

Data controller / business operator: NetSource Inc.

Support email: appsupport@netsourceinc.com

Website: https://www.netsourceinc.com

For data we process on behalf of a merchant (such as that merchant’s customers’ personal information), the merchant is the data controller and NetSource is a data processor. For data we collect directly from merchants (account, billing, support), NetSource is the data controller.

2. Data we collect

2.1 Merchant data (the Shopify store that installs the App)

When a merchant installs the App, Shopify provides us with:

The store’s com domain, store name, primary email, country, time zone, currency, and plan
The store owner’s name and email address
An OAuth access token that authorizes the App to call the Shopify Admin API on the merchant’s behalf

We also collect:

Subscription and billing state — current plan tier (Starter / Advanced / Premium / Unlimited), billing interval, trial status, marketing add-on enrolment, Shopify subscription IDs, trial end date. All charges are processed by Shopify Billing; we do not see or store payment-card information.
Configuration data created in the App — product configurator items, configuration groups, conflict rules, store-wide display settings, plan-gated feature toggles.
Setup service data (only if the merchant purchases the optional one-time “white-glove setup service”) — the Shopify collaborator request code the merchant submits on the form, the contact email and freeform notes the merchant provides, and the Shopify one-time charge ID. The collaborator code is transmitted to our operations email inbox (appsupport@netsourceinc.com) and is never displayed in log output.
Operational telemetry — non-PII metrics such as record counts, feature adoption rates, and aggregated revenue data, which are pulled into an internal NetSource portfolio dashboard. This dashboard contains aggregated business metrics; it does not contain individual customer PII.
Application error logs — when the App encounters an error, we may log the error message, stack trace, route or component name, shop domain, and structured metadata (such as the product or quote ID involved). Error logs are retained for diagnostic purposes only and are pruned regularly.

2.2 Customer data (the merchant’s storefront customers)

When a customer interacts with the App on a merchant’s storefront — for example, by saving a product configuration, submitting a quote request, or viewing saved quotes in their customer account — the App processes:

Identifiers: Shopify customer ID, email address, first and last name, phone number (if provided)
Address: shipping or billing address (if the customer has one on file in Shopify or provides one during quote submission)
Quote contents: the product the customer was configuring, selected options, quantity, computed price at time of save, customer-provided notes or quote-request reasons, preferred contact method (email / phone), and quote status (saved / submitted / working / finalized / customer acceptance / purchased)
Marketing automation events (only when the merchant has enabled the optional Marketing Automation add-on and the customer has not opted out): timestamps of reminder emails sent to the customer, whether the email was delivered, opened, or clicked, and any discount codes generated for the customer

The App reads Shopify customer records via the Shopify Admin API using the read_customers scope. We do not import, export, or sync customer data outside of Shopify and our hosted backend.

2.3 Data we do not collect

We do not collect, store, or transmit:

Payment-card numbers, CVVs, bank account details, or any other financial-instrument data — all payments flow through Shopify Billing
Social security numbers, government identification numbers, or biometric data
Health, religious, political, or other categories of “sensitive” personal information as defined by GDPR Article 9
Data from minors known to be under 13 (the App is not directed at children)

3. How we collect data

From Shopify — when the merchant installs the App and grants OAuth permissions, and on an ongoing basis through Shopify webhooks and Admin API queries
From the merchant — when they fill in App settings, create configurator items, configure marketing reminders, or purchase the optional setup service
From the merchant’s customers — when they save a configuration, submit a quote, view saved quotes in their Shopify customer account, or click a link in a reminder email
From Shopify Billing — confirmation of approved subscriptions and one-time charges
From AWS Simple Email Service (SES) — delivery, open, click, and bounce events for emails the App sends on the merchant’s behalf

4. How we use data

We use merchant and customer data only to:

Operate the App’s core features — store and retrieve saved product configurations, present them in the merchant’s admin and in customer accounts, apply conflict rules, compute quote totals, expand configured parent products into component line items at order time.
Send transactional and marketing-automation emails on the merchant’s behalf, via AWS SES, to customers who have saved or submitted quotes (only when the merchant has enabled the feature). Customers may opt out at any time via an unsubscribe link in each email.
Process Shopify subscription billing — recurring plan charges, marketing-add-on charges, and the optional one-time setup-service charge are all created and confirmed through Shopify Billing using the access token granted at install.
Provide support — when a merchant emails us at appsupport@netsourceinc.com, we may review their App settings, saved quotes, or error logs to diagnose the issue.
Fulfill the optional setup service — when a merchant submits a Shopify collaborator request code, we use it once to accept the collaborator invitation, perform the agreed setup work, and then revoke or allow the collaborator access to expire.
Maintain operational quality — aggregate metrics (record counts, feature adoption, error rates) are pulled into an internal NetSource dashboard so we can monitor App health and prioritize improvements.
Comply with legal obligations — including responding to GDPR / CCPA data-subject requests, tax reporting, and lawful requests from regulators.

We do not sell personal information. We do not share personal information with third parties for advertising or profiling. We do not use customer data to train machine-learning models.

5. Legal basis for processing (GDPR / UK GDPR)

Purpose	Legal basis
Operating the App for the merchant	Contract (Art. 6(1)(b)) — between the merchant and NetSource
Processing customer data on the merchant’s behalf	The merchant’s legal basis under their own privacy policy; NetSource acts as a processor under Art. 28
Sending marketing-automation reminder emails	The merchant’s legal basis (consent or legitimate interest); the merchant is responsible for obtaining consent under applicable law
Billing and fraud prevention	Legal obligation (Art. 6(1)(c)) and legitimate interest (Art. 6(1)(f))
Aggregated portfolio analytics	Legitimate interest (Art. 6(1)(f)) — App quality and improvement; data is aggregated and contains no individual PII
Responding to data-subject requests	Legal obligation (Art. 6(1)(c))

6. Third parties we share data with (sub-processors)

We share data only with the following sub-processors, each of which provides infrastructure necessary to operate the App:

Sub-processor	Purpose	Location
Shopify Inc.	Source of merchant and customer data; OAuth, webhooks, Admin API, Billing API	Canada / US / EU
Gadget.dev (Gadget Inc.)	Application hosting, database, scheduled actions	United States (AWS)
Amazon Web Services (AWS) — Simple Email Service (SES)	Sending transactional and marketing-automation emails on the merchant’s behalf	United States

We do not share personal data with advertising networks, analytics providers, data brokers, or any other third party not listed above. We do not transfer personal data to any country that does not provide an adequate level of protection without appropriate safeguards (e.g., Standard Contractual Clauses).

7. Data retention

Active merchant data is retained for as long as the App is installed on the merchant’s store.
Saved quotes and configurations are retained for the lifetime of the merchant’s installation or until the customer or merchant deletes them.
Marketing-automation logs (sent / opened / clicked events) are retained for up to 24 months for reporting purposes.
Application error logs are retained for up to 90 days.
Internal portfolio-dashboard snapshots (aggregated, non-PII) are retained for up to 36 months for trend analysis.
Setup-service collaborator request codes are deleted from our systems as soon as the setup work is complete, and in no case retained more than 30 days after submission.

7.1 When the merchant uninstalls the App

When the merchant uninstalls the App:

The merchant’s OAuth access token is revoked immediately by Shopify
Active Shopify subscriptions are cancelled
In-flight setup-service requests are cancelled
Within 48 hours, Shopify sends us the shop/redact webhook; on receipt we delete all of the merchant’s configurations, saved quotes, conflict rules, reminder settings and logs, and store-specific records. This delay window is mandated by Shopify and gives merchants who reinstall within 48 hours an opportunity to recover their data.

7.2 Customer-initiated deletion

When a merchant invokes “Erase customer data” in their Shopify admin, Shopify sends us the customers/redact webhook. On receipt we delete that customer’s saved quotes and redact their personally identifying fields (first name, last name, email, phone, address fields) from our records.

When a merchant invokes “Request customer data” in their Shopify admin, Shopify sends us the customers/data_request webhook. We collect a copy of that customer’s saved quotes and any associated PII and make it available to the merchant for delivery to the customer, within 30 days as required by GDPR.

8. Security

We protect personal information using the following safeguards:

Encryption in transit — all data is transmitted over TLS 1.2 or higher between Shopify, the merchant, the customer’s browser, our hosted backend, and our sub-processors
Encryption at rest — the App’s database (hosted on Gadget.dev) is encrypted at rest using AES-256
Access control — OAuth tokens, API keys, and AWS credentials are stored as environment variables in the hosting platform and are never committed to source control. Production credentials are accessible only to authorized NetSource staff.
Tenancy isolation — every database query is scoped to a single merchant’s shop ID; we have audited the codebase to prevent cross-store data access
Webhook signature verification — all incoming Shopify webhooks have their HMAC signatures verified before processing
Least privilege — the App requests only the Shopify access scopes it actually needs (see Section 13)
Monitoring — error logs are reviewed regularly; security-relevant errors trigger ops alerts
Incident response — in the event of a confirmed data breach affecting personal data, we will notify affected merchants without undue delay and, where required, the appropriate supervisory authority within 72 hours of becoming aware

No system is perfectly secure; we cannot guarantee absolute security but we work continuously to maintain industry-standard protections.

9. Your rights (data subjects)

Depending on where you live, you may have the right to:

Access the personal data we hold about you
Rectify inaccurate or incomplete personal data
Erase your personal data (“right to be forgotten”)
Restrict or object to processing
Data portability — receive your data in a structured, machine-readable format
Withdraw consent at any time, where processing is based on consent
Lodge a complaint with a data protection authority (e.g., your local EU supervisory authority, the UK ICO, or the California Attorney General)
Opt out of any “sale” or “sharing” of personal information (CCPA / CPRA) — note that NetSource does not sell or share personal information as defined by these laws

9.1 How to exercise these rights

Customers of a Shopify store using the App — first contact the merchant directly. The merchant is the data controller and can fulfill most requests through their Shopify admin (which will trigger our GDPR webhooks). If the merchant is unresponsive, you may contact us at appsupport@netsourceinc.com and we will assist within 30 days.
Merchants — contact us directly at appsupport@netsourceinc.com.

We will not charge a fee for reasonable requests. We may require proof of identity for sensitive requests. We will respond within 30 days, or up to 60 days for complex requests (with notice).

10. International transfers

Our infrastructure is located in the United States (Gadget.dev / AWS). If you are located outside the United States — for example, in the European Economic Area, the United Kingdom, or Canada — your personal data will be transferred to and processed in the United States.

For transfers from the EEA, UK, or Switzerland, we rely on:

The European Commission’s Standard Contractual Clauses (SCCs) with our sub-processors
The UK International Data Transfer Addendum where applicable
Additional technical safeguards (encryption, access control) where required by the Schrems II decision

Shopify, Gadget, and AWS each maintain their own GDPR-compliant cross-border-transfer mechanisms.

11. Children’s privacy

The App is a B2B tool offered to Shopify merchants. It is not directed at children, and we do not knowingly collect personal information from anyone under the age of 13 (or 16 in jurisdictions where that is the applicable threshold). If you become aware that a child has provided us with personal information, please contact us and we will delete it.

12. Marketing emails and unsubscribe

When the merchant enables the Marketing Automation add-on, the App sends quote-reminder emails to customers who have saved or submitted a quote. These emails are sent from noreply@shopify.netsourcecommerce.com on the merchant’s behalf via AWS SES.

Each marketing-automation email includes a one-click unsubscribe link. Clicking this link adds the customer to a per-shop suppression list; the customer will not receive further reminder emails from that merchant’s installation.

Customers may also contact the merchant directly to be removed from reminders.

Transactional emails — for example, the completion notice for the optional white-glove setup service — are not subject to unsubscribe because they relate directly to a service the merchant or customer has requested.

13. Shopify access scopes we use

The App requests the following Shopify Admin API scopes. Each scope is requested only because it is required for a specific App feature.

Scope	Why we need it
read_customers	Associate saved quotes with the customer who created them; display customer details to the merchant in the admin
read_products / write_products	Read product and variant data the merchant marks as configurable; update product metadata to flag configurator products
read_orders / write_orders	Look up orders associated with completed quotes; apply order tags so merchants can identify configurator-driven orders
write_order_edits	Expand a single configured parent line item into individual component line items on the placed order, so the merchant’s inventory and fulfillment systems see each component
read_inventory / write_inventory	Check availability of configurator items and adjust inventory for component-level deduction
read_locations	Resolve inventory locations for multi-location merchants
read_themes / write_themes	Detect whether the merchant’s theme supports the App’s theme extension; assist with theme-extension installation
read_cart_transforms / write_cart_transforms	Deploy and monitor the cart-transform Shopify Function that powers configurator behavior at checkout

14. Cookies and tracking

The App’s admin interface runs as an embedded application inside the Shopify admin. We use only the cookies required for the App’s session to work; we do not place advertising or third-party tracking cookies. Email open and click tracking in marketing-automation emails is handled by AWS SES on our behalf and is limited to engagement metrics; we do not link this data to any third-party advertising platform.

15. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices, new features, legal requirements, or sub-processors. When we make a material change, we will update the “Last updated” date at the top of this policy and, where required by law, notify merchants by email or via an in-app banner.

The current version is always available at the URL where you accessed this policy.

16. Contact us

If you have questions about this Privacy Policy, our data practices, or wish to exercise a data-subject right:

NetSource Inc.

Email: appsupport@netsourceinc.com

Website: https://www.netsourceinc.com/contact-us/

For data-protection-specific inquiries (GDPR / UK GDPR Article 13–22 requests, CCPA / CPRA verifiable consumer requests), please use the same email and include “Privacy Request” in the subject line so we can route it appropriately.

End of Privacy Policy.