Privacy Policy
Last updated: February 27, 2026
BackAlert ("we", "us", "our") is operated by Viriar s.r.o. We provide back-in-stock email notification services to Shopify merchants. This privacy policy explains how we collect, use, and protect personal information.
1. Information We Collect
For Shoppers (End Users):
- Email address — collected when you subscribe to a back-in-stock notification or join a wishlist
- Product preferences — which products or variants you subscribed to
- Browser locale — to send notifications in your language
We do not collect names, payment information, IP addresses, or any other personal data from shoppers.
For Merchants:
- Shopify store domain and access tokens (for API access)
- Store settings configured within the app (colors, texts, notification preferences)
- Inventory data (product availability) to trigger notifications
2. How We Use Your Information
- Send a one-time email notification when a subscribed product is back in stock
- Send optional reminder emails (48 hours after initial notification, if product is still available)
- Provide merchants with aggregated demand data (number of subscribers per product)
- Track notification-to-purchase conversions for merchant analytics (no shopper PII is shared)
- Operate and improve the BackAlert service
3. Legal Basis for Processing (GDPR)
We process personal data based on:
- Consent — shoppers explicitly subscribe by entering their email address
- Legitimate interest — merchants use the service to improve customer experience
- Contract performance — to fulfill the notification service merchants signed up for
4. Data Retention
Subscription data is retained until the earliest of:
- (a) The shopper unsubscribes via the link in the notification email
- (b) The notification is successfully sent and the subscription is fulfilled
- (c) The merchant uninstalls the app (data is deleted within 48 hours per Shopify GDPR requirements)
- (d) A GDPR deletion request is received
Fulfilled notifications are retained for up to 90 days for merchant analytics, then automatically purged.
5. Data Sub-processors
| Provider | Purpose | Location |
|---|
| Cloudflare | Hosting, database (D1), CDN | EU/US |
| Resend | Email delivery | EU (eu-west-1) |
| Shopify | E-commerce platform | Canada/US |
| Klaviyo | Email marketing integration (optional, merchant-enabled) | US |
6. Data Sharing
We do not sell, rent, or share your personal information with third parties for marketing purposes. Data is only shared with the sub-processors listed above, strictly for service operation.
7. Cookies and Tracking
BackAlert does not use cookies on the merchant's storefront. Wishlist preferences are stored via localStorage in the shopper's browser.
Email tracking:
- Notification emails contain a 1×1 transparent tracking pixel that records when the email is opened.
- Links in notification emails route through a click tracking redirect that records clicks before forwarding to the product page.
- Purpose: email performance analytics for merchants (open rate, click rate).
- Data collected: notification ID only — no cookies, no cross-site tracking, no fingerprinting.
- Opt-out: blocking images in your email client prevents open tracking. You can also copy the product link directly instead of clicking it.
No analytics scripts or fingerprinting techniques are used on the storefront.
8. Your Rights (GDPR / CCPA)
You have the right to:
- Access your personal data
- Rectify inaccurate data
- Delete your data ("right to be forgotten")
- Port your data to another service
- Object to processing
- Withdraw consent at any time by unsubscribing
To exercise these rights, contact the merchant directly or email us at support@backalert.uhrin.digital. We respond to all requests within 30 days.
9. Data Security
We protect your data using:
- HTTPS encryption for all data in transit
- HMAC signature verification on all webhook and API requests
- Access tokens stored securely in encrypted database
- Rate limiting to prevent abuse
10. Children's Privacy
BackAlert does not knowingly collect data from children under 16. If you believe a child has provided us with personal data, please contact us and we will delete it.
11. Changes to This Policy
We may update this policy. Material changes will be communicated through the app dashboard. Continued use of the service constitutes acceptance of the updated policy.
12. Contact
Viriar s.r.o.
Email: support@backalert.uhrin.digital