Privacy policy.

1. Who We Are

Weblegs is a UK-based Shopify agency operated by Litho Services Ltd. We build, migrate, and optimise Shopify stores, and we develop Shopify applications available through the Shopify App Store.

Contact: support@weblegs.co.uk
Website: weblegs.co.uk

2. Scope

This policy covers the weblegs.co.uk website, all Shopify applications developed and published by Weblegs (collectively, “our Apps”), and the order and marketplace integrations we build and run for retail clients (see section 10). It applies to store owners who install our Apps, to visitors of our website, and to buyers whose orders pass through our integrations.

3. Data We Collect

3.1 Through Our Website

• Contact form submissions— name, email address, phone number (optional), and your message. Used solely to respond to your enquiry.
• Newsletter sign-ups— email address only. Used to send ecommerce and Shopify insights. You can unsubscribe at any time.

3.2 Through Our Shopify Apps

When you install one of our Apps, we may access and process the following data:

• Shopify store data— orders, products, collections, and other store information as required by the app's functionality.
• Session tokens— used for authentication and to maintain your logged-in session.
• App settings and preferences— configuration choices you make within the app, stored on a per-store basis.

4. Data We Do Not Collect

• We do not store customer personal data (names, email addresses, physical addresses) unless specifically required by an app's or integration's core function, in which case this is clearly stated in the app's listing or in section 10.
• We never store payment card details or financial account information.
• We do not sell, rent, or share your data with third parties for marketing or any other purpose.

5. How We Use Your Data

We use the data we collect to:

• Provide, maintain, and improve our Apps and services.
• Authenticate your identity and maintain secure sessions.
• Respond to support requests and enquiries.
• Send newsletters you have opted into (website only).

We process data on the legal basis of legitimate interest (providing the service you installed) and consent (newsletter sign-ups and contact form submissions).

6. Data Storage and Security

Data is stored on secure, encrypted servers. We use industry-standard security measures including HTTPS encryption, access controls, and regular security reviews. We retain data only for as long as necessary to provide our services.

7. Data Deletion

When a store uninstalls one of our Apps, all session data and app settings associated with that store are automatically deleted. No residual data is retained.

To request deletion of data collected through our website (contact form submissions or newsletter subscriptions), email support@weblegs.co.uk.

8. GDPR Compliance

We comply with the UK General Data Protection Regulation (UK GDPR) and the EU GDPR. You have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — request correction of inaccurate data.
• Erasure — request deletion of your personal data.
• Portability — request your data in a portable format.
• Objection — object to processing based on legitimate interest.

To exercise any of these rights, contact us at support@weblegs.co.uk. We will respond within 30 days.

9. Shopify Mandatory Compliance Webhooks

Our Apps handle all Shopify mandatory compliance webhooks:

• Customer data request— we respond with any customer data stored by the app, or confirm that no customer data is held.
• Customer data erasure (redact)— we delete any customer data associated with the specified customer, or confirm that no data is held.
• Shop data erasure (redact)— we delete all data associated with the store within 48 hours of receiving the webhook.

10. Order and Marketplace Integrations (including TikTok Shop)

We build and operate integrations that move orders between a retailer's sales channels (such as TikTok Shop) and their order management and warehouse systems (such as ChannelAdvisor/Rithum). For these integrations the retailer is the data controller and Weblegs acts as theirdata processor, processing data only on the retailer's instructions under a written agreement.

10.1 Data we process

• Order and delivery data— order ID, items, price paid, buyer username, recipient name, delivery address and phone number. Used only to create, pick, pack and ship the order and to send tracking information back to the sales channel.
• Marketplace data (TikTok Shop)— accessed only through the retailer's own authorisation of our integration (TikTok Shop Partner API) or the retailer's order exports. We access only what is needed to fulfil the order, and follow TikTok Shop's partner and data protection terms. The retailer can revoke access at any time.

We never use buyer data for marketing or profiling, never combine it with other data, and never sell or share it beyond the providers listed below.

10.2 Security

All connections are encrypted (HTTPS/TLS); systems require a login and are restricted to authorised retailer and Weblegs staff; administrative access uses multi-factor authentication; API credentials are held in an encrypted secrets vault, never in source code; and each client's data is kept in separate systems. Real customer data is never used for testing or demonstrations.

10.3 Retention

Marketplace order and buyer data held in our integration databases is deleted automatically 90 daysafter import. Once an order is fulfilled, its record is held in the retailer's own order management system under the retailer's retention policy. Data we hold for a client is returned or deleted on their instruction when the service ends.

10.4 Hosting and sub-processors

• Railway — application and database hosting (EU region where available).
• Infisical — encrypted credential vault (EU); holds no customer data.

The sales channels and order management systems our integrations connect to (for example TikTok Shop and ChannelAdvisor) are engaged directly by the retailer under their own terms.

10.5 Data breaches and your rights

If a breach affects personal data, we notify the retailer without undue delay so they can meet their 72-hour duty to report to the Information Commissioner's Office, and notify the marketplace as its terms require. If you bought from one of our clients, please contact that retailer to exercise your data rights; we will help them respond. You can also contact us at support@weblegs.co.uk or complain to the ICO at ico.org.uk.

11. Third-Party Services

Our Apps operate within the Shopify platform and use Shopify's APIs. Data accessed through these APIs is governed by Shopify's Privacy Policy. We do not integrate with or pass data to any other third-party services unless explicitly stated in the app's listing or in section 10.

For our website, enquiries from our campaign landing pages are stored in Klaviyo, our email platform, so we can send the results and follow-up you asked for; and the advertising and analytics providers described in section 12 receive page-visit data from those pages.

12. Cookies and Tracking

Our main website pages use essential cookies only, for site functionality. Our Apps use session cookies required for authentication.

Our campaign landing pages (such as /scan, /automate, /portal-ordering and /ai-visibility) also use advertising and analytics tags that set cookies:

• Meta Pixel(Meta Platforms) — measures visits and enquiries from our Facebook and Instagram ads.
• Google Analytics 4(Google) — measures how the pages are used.
• LinkedIn Insight Tag(LinkedIn) — measures visits from our LinkedIn ads.

These tags record page views and events such as submitting an enquiry, scanning a store or using a calculator, including event details like the store website scanned or the calculator's estimate. They do not receive your name or email address. Each provider handles this data under its own privacy policy. You can block or delete these cookies in your browser settings, opt out of Google Analytics with Google's browser add-on, and manage ad preferences in your Meta and LinkedIn account settings.

13. Changes to This Policy

We may update this policy from time to time. Changes will be posted on this page with an updated “Last updated” date. Continued use of our website or Apps after changes constitutes acceptance of the revised policy.

14. Contact

For any questions about this privacy policy or our data practices, contact us at:
support@weblegs.co.uk