Privacy Policy

Last updated: March 23, 2026

Prova ("we", "our", "the app") is a Shopify application that helps merchants collect photo reviews from their customers. This privacy policy explains what data we collect, how we use it, and your rights.

1. Data We Collect

We collect the following personal data in the course of providing our service:

• Customer name and email address — received from Shopify when an order is fulfilled, used to send a review request email.
• Order information — order ID, order number, and purchased product IDs, used to associate reviews with the correct products.
• Review content — star rating, review text, and optionally a photo, submitted voluntarily by customers.
• Merchant account data — Shopify shop domain and session tokens, required for app authentication.

2. How We Use Your Data

• To send review request emails to customers after order fulfillment.
• To store and display reviews on the merchant's dashboard and storefront widget.
• To generate analytics for the merchant (review counts, average ratings).

We do not sell, rent, or share personal data with third parties for marketing purposes.

3. Third-Party Services

We use the following third-party services to operate the app:

• Resend (resend.com) — to send review request emails. Customer email addresses are shared with Resend solely for email delivery.
• Cloudinary (cloudinary.com) — to host review photos uploaded by customers. Photos are uploaded directly from the customer's browser to Cloudinary.
• Shopify (shopify.com) — as the platform provider. We access order and customer data through Shopify's APIs in accordance with their Partner Program Agreement.

4. Data Retention

Review data (name, review text, rating, photos) is retained for as long as the merchant's Prova account is active. When a merchant uninstalls the app, session data is deleted immediately. Review data may be retained for up to 30 days after uninstallation to allow for reinstallation, after which it is permanently deleted.

5. Your Rights (GDPR)

If you are located in the European Economic Area, you have the following rights regarding your personal data:

• Access — request a copy of the data we hold about you.
• Rectification — request correction of inaccurate data.
• Erasure — request deletion of your personal data.
• Portability — request your data in a machine-readable format.
• Objection — object to the processing of your data.

We process personal data on the basis of legitimate interest (sending review requests following a completed purchase). We do not use personal data for automated decision-making or profiling with legal or significant effects.

To exercise any of these rights, contact us at the email address below.

6. Data Security

We implement appropriate technical and organizational measures to protect personal data, including encrypted connections (HTTPS), secure session management via Shopify, and access controls on our database.

7. Data Breach Notification

In the event of a data breach affecting customer personal data, we will notify affected merchants within 72 hours of becoming aware of the breach, in accordance with applicable law.

8. Cookies

Prova does not set any cookies on customer-facing pages. Within the Shopify admin, session cookies are managed by Shopify's App Bridge.

9. Changes to This Policy

We may update this privacy policy from time to time. Changes will be reflected by updating the "Last updated" date above. Continued use of the app after changes constitutes acceptance of the updated policy.

10. Contact

For privacy-related questions or data requests, contact us at:

privacy@provaapps.com