Privacy policy

Effective date: October 23, 2026

Backrow: Sold Out Last ("the app") is a Shopify app made by AI Studio, operated by Jacek Samól (sole proprietor) ("we", "us"). This policy explains what information the app collects from Shopify stores that install it, how it is used and when it is deleted.

Who we are

The data controller responsible for the data described in this policy is Jacek Samól, sole proprietor (Polish tax ID, NIP: 7773038899), registered address: os. 700-Lecia Miasta 2 lok. 22, 64-320 Buk, Poland. Email: info@jaceksamol.com

Who this policy is about

The app is used by merchants inside Shopify admin. It works with the store's collections, products and inventory levels. It does not collect information about the store's customers or orders.

What the app accesses through Shopify

When you install the app you grant it these Shopify permissions (access scopes):

• read_products and write_products: to read your collections and the products in them, to change a collection's sorting to Manual and back, and to change the order of products in a collection.
• read_inventory: to read inventory levels, inventory tracking and the "continue selling when out of stock" setting of product variants.

The app does not request access to customers, orders, location names or any other store data.

Product and collection details read from Shopify (for example titles, tags and stock levels) are used to decide the product order and to show your collections in the app. Titles and stock levels are not stored by the app; they are read from Shopify again when needed. It stores only the IDs of the locations you enter in the rule settings.

What the app stores

All stored data is linked to your store's myshopify.com domain:

1. Session data. The access token Shopify issues to the app for your store (offline access, with its refresh token and expiry), the granted scopes and the store domain. The app uses store-level (offline) access only; it does not store names or email addresses of staff members.
2. Collection rules. For each collection where you use the app: the collection ID, whether the rule is on, the list of product IDs in the order to restore, the collection's previous sorting, your rule settings (whether "continue selling" products count as available, the location IDs you chose, the product tags you excluded), the time and result of the last run (number of products moved, number sold out, an error message if any) and technical fields used to avoid running two changes at once.
3. Activity log. A record of the app's runs that changed or tried to change the order of a collection: time, collection ID, what triggered it (stock change, panel action, saved settings or the scheduled daily re-check), the result, the number of products moved and a short message (at most 300 characters, for example an error message). Not every run gets an entry: runs after a stock change that needed no reordering are not recorded, the same error after a stock change for the same collection is recorded once per hour, and daily re-check runs that needed no reordering are recorded as one summary entry. The newest 100 entries per store are kept in the database (the app shows the newest 50); older ones are deleted automatically when a new entry is added.

Server logs

The app writes technical messages to its server output: one line for each request it receives (method, path, status and response time), and messages about its work, which can contain your store domain, collection IDs, the type of event received from Shopify and error messages. The query string of a request is not written to the log: for requests from Shopify admin it contains your store domain and a signed session token that identifies the staff member who opened the app. The app does not write log files and does not store these messages in its database. The hosting provider collects the server output and keeps it for a limited time set by the provider; we keep no other copy. These logs are used only to run and fix the app.

Billing information

Plans are sold through Shopify's billing. The app does not see or store payment details. To apply the plan you chose, the app asks Shopify which plan your store has, using your store's Shopify ID. The store ID and the answer are kept only in the server's memory (a paid-plan answer for up to 5 minutes) and are not stored in the database.

What the app does not do

• It does not collect, store or process data about your customers or their orders.
• It does not use analytics or advertising tools and does not set tracking cookies.
• It does not sell or rent any data, and does not share it with third parties for marketing.
• It does not add any code or scripts to your online store.

Where data is processed and who else has access

The app and its database run on Fly.io, in the Frankfurt, Germany (EU) region; the database is kept on an encrypted storage volume. The hosting provider stores the data on our behalf. Shopify processes data as the platform the app runs on. Apart from the hosting provider and Shopify, we do not share the data stored in the app's database with anyone, unless required by law. Support messages are handled as described under "Support messages" below.

The app's pages, including this one, load a font from Shopify's content delivery network (cdn.shopify.com), so when you open them your browser's IP address is sent to Shopify.

Backups: the hosting provider takes a daily snapshot of the storage volume that holds the database and keeps each snapshot for 5 days. Data deleted from the database can therefore remain in these snapshots for up to about 5 more days, after which the snapshots are deleted. Snapshots are used only to restore the app after a failure.

International transfers

The app's database and server run in the EU (see above). Some of the providers we use are based outside the European Economic Area (EEA), so data can be transferred to them or accessed from outside the EEA:

• The hosting provider, Fly.io, Inc., is a company based in the United States. Fly.io states that it participates in the EU-U.S. Data Privacy Framework (https://fly.io/legal/data-privacy-framework/); transfers to Fly.io rely on the European Commission's adequacy decision for that framework.
• The text of support messages is processed by Anthropic (see "Support messages") in the United States. These transfers are covered by the Standard Contractual Clauses approved by the European Commission (Commission Implementing Decision (EU) 2021/914), included in Anthropic's Data Processing Addendum (https://www.anthropic.com/legal/data-processing-addendum).
• Our e-mail provider, Google (Google Workspace), may store or process support messages outside the EEA. Transfers to the United States rely on the EU-U.S. Data Privacy Framework, to which Google LLC has certified; transfers to other countries without an adequacy decision rely on the Standard Contractual Clauses included in Google's Cloud Data Processing Addendum (https://cloud.google.com/terms/data-processing-addendum/).
• Shopify processes the data it holds about your store, and the IP address sent when a page loads its font, under its own privacy policy and its own transfer safeguards.

To get a copy of the safeguards used for these transfers, contact info@jaceksamol.com.

Legal basis

Where the GDPR applies, we process the data described in this policy on these legal bases:

• Store data the app reads from Shopify and stores (session data, collection rules, activity log): to provide the service you installed the app for (performance of a contract, Article 6(1)(b) GDPR).
• The plan check (your store's Shopify ID and the plan Shopify returns): to apply the plan you chose, which is part of providing the service (performance of a contract, Article 6(1)(b) GDPR).
• Server logs: our legitimate interest in keeping the app running, secure and free of errors (Article 6(1)(f) GDPR).
• Support messages: our legitimate interest in answering your requests (Article 6(1)(f) GDPR).
• Your browser's IP address sent to cdn.shopify.com when a page of the app loads its font: our legitimate interest in showing the app's pages in the same font as Shopify admin (Article 6(1)(f) GDPR).

Providing your store's data is not required by law, but it is necessary to use the app: without the access token Shopify issues when you install it, the app cannot work. We do not use automated decision-making or profiling within the meaning of Article 22 GDPR.

How long data is kept and how it is deleted

• While the app is installed, the data above is kept so the rules can run. Turning a rule off clears the stored product order of that collection; its settings and last result stay until the app is uninstalled. An activity log entry stays until 100 newer entries of your store push it out, or until your store's data is deleted.
• When you uninstall the app, Shopify sends the app an uninstall notification. If that notification confirms your store's myshopify.com domain, the app deletes all data of your store (session, collection rules, activity log) from its database right away. If it does not (the domain is missing, or does not match the store the notification is addressed to), the app deletes nothing at that moment and the data stays in the database until the next step.
• About 48 hours after uninstall Shopify sends a store data deletion request (shop/redact). The app then deletes all data of your store that is still stored, including when the uninstall notification did not delete it or did not arrive. If the deletion fails (for example the database is unavailable), the app reports an error to Shopify so that the request is sent again.
• Requests from Shopify about a customer's data (customers/data_request, customers/redact) are answered without action, because the app stores no customer data.
• Deleted data can remain in the hosting provider's daily snapshots for up to about 5 more days (see above).
• Server logs are not part of the database and are not deleted when you uninstall; they are deleted when the hosting provider's log retention period ends.

While the data waits for that request, it cannot be used to change your store: after uninstall the app no longer has access to your store.

Uninstalling does not change your collections back: a collection keeps the order and the Manual sorting it had at that moment. Turn the rule off in the app before uninstalling if you want the previous order and sorting restored.

Your choices and rights

You can turn off a rule at any time and uninstall the app at any time, which deletes the stored data as described above.

Under the GDPR you have the right to:

• access the personal data we hold about you and get a copy of it;
• have it corrected if it is inaccurate (rectification);
• have it deleted (erasure);
• restrict its processing;
• receive the data you provided in a structured, machine-readable format and have it sent to another controller (data portability);
• object at any time, on grounds relating to your particular situation, to processing based on our legitimate interest (Article 6(1)(f) GDPR), under Article 21 GDPR.

To use these rights, contact info@jaceksamol.com.

You also have the right to lodge a complaint with a data protection supervisory authority. The authority competent for us as the data controller is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, PUODO), ul. Stawki 2, 00-193 Warsaw, Poland, https://uodo.gov.pl. You can also complain to the supervisory authority in the EU or EEA country where you live or work, or where you think the infringement took place.

Support messages

If you write to info@jaceksamol.com, your message and our reply are kept in that mailbox to handle your request. They are kept for 24 months after the last message in the conversation. Our e-mail provider, Google (Google Workspace), stores the mailbox and processes the messages in it. To prepare a reply, the text of your message is also processed by the provider of the AI model that helps write it: Anthropic (Claude). Replies are written by an AI assistant on behalf of AI Studio; you can ask for your request to be passed to a person.

Changes to this policy

If the app starts collecting different data, we will update this policy and its effective date before the change takes effect.

Contact

AI Studio, operated by Jacek Samól (sole proprietor). Email: info@jaceksamol.com