Skip to content
Smart Product Options Variants

Legal

Privacy Policy

Effective 16 September 2026

This policy describes how SRH Web Agency (“we”, “us”, “Smart Product Options Variants”) handles information when merchants install and use the Shopify app Smart Product Options Variants (custom product options, add-on prices, and a Theme App Extension). It is written for Shopify’s App Store listing and for merchants who need to know what the app accesses on their shop.

Smart Product Options Variants is a merchant tool. Shoppers on a merchant’s storefront interact with the option widget; they do not create a Smart Product Options Variants account.

1. Who is responsible

SRH Web Agency operates Smart Product Options Variants and the production app at productoptions.srhwebagency.com. Shopify remains responsible for the merchant’s store, Admin, Checkout, and orders. Merchants remain responsible for their own storefront privacy notices to shoppers.

2. Shopify permissions we request

Smart Product Options Variants uses the Shopify Admin GraphQL API only (not the REST Admin API). After install, the app requests these access scopes (from configuration / SCOPES: read_products,write_products,read_files,write_files,read_orders,write_cart_transforms):

  • read_products — product identity used to assign option sets and write product metafields for the storefront widget.
  • write_products — write the helix.options JSON metafield on assigned products, shop metafields for global sets, and (when priced options are used) a catalog add-on product tagged helix-option-addon.
  • read_files and write_files — list and upload images into the merchant’s Shopify Files for image dropdowns and swatches (files stay on Shopify; we store the resulting URL).
  • read_orders — optional order context for option selections that already live on Shopify line items. Smart Product Options Variants does not import order history into its own catalog.
  • write_cart_transforms — register a cart transform so priced options can add an amount at cart and checkout.

Smart Product Options Variants does not request read_customers, read_checkouts, or similar customer-profile scopes. We do not read customer names, emails, addresses, or payment methods from Shopify in order to run the option widget.

3. Merchant data we store

All application data is scoped to the installing shop (multi-tenant). We store:

  • Shop identity and sessions. Shop domain, install time, plan label, and OAuth session records (offline access token and, for online sessions, staff first name, last name, email, and user id as provided by Shopify’s session storage).
  • Option configuration. Option sets (names, status, labels, types, help text, add-on prices, conditions, assignment mode, customer audience, and country limits), product assignments (product GID and title), and image URLs selected from Shopify Files.
  • Widget settings. Appearance, alignment, storefront translation strings, and merchant-saved templates on the shop settings JSON — not shopper personal data.
  • Shopify-side copies we write. A helix.options metafield on assigned products and a helix.global_options shop metafield so the theme block can render. For priced options we may also store helix.addon_variant_id / helix.addon_variants shop metafields.

4. Shopper (customer) data

Smart Product Options Variants does not create shopper accounts and does not store Shopify customer profiles. Customer option selections and file uploads are submitted through Shopify’s cart as line item properties and stored on the Shopify order — not in Smart Product Options Variants’s database.

File inputs may include whatever a shopper attaches (artwork, photos). Those files are sent to Shopify with the cart, not kept as Smart Product Options Variants media. Merchants should mention Smart Product Options Variants’s storefront widget in their own privacy policy if required by their region.

We do not persist raw GDPR webhook payloads. If later product features store customer personal data on our servers, this policy and the GDPR webhook handlers will be extended in the same change.

5. How we use this data

  • Provide custom options on the product page.
  • Write metafields and cart-transform data so add-on prices can be charged at checkout.
  • Show merchants their option sets, products, and settings.
  • Respond to uninstall and mandatory compliance webhooks.
  • Deliver merchant support messages when Contact is configured.

6. Where data is stored

  • PostgreSQL (Supabase) — primary store for sessions, shop rows, option sets, assignments, queued jobs, and compliance audit rows. This is not Hostinger MySQL. The database is a separate Supabase Postgres project (pooled connections on port 6543 plus a direct connection on port 5432 for migrations).
  • PostgreSQL job queue — short-lived job payloads (shop domain, commands) stored as QueueJob rows. Jobs are not a second copy of shopper answers.
  • Shopify — OAuth, Files (swatch uploads), product/shop metafields, cart line item properties, orders, and cart transforms remain on Shopify.
  • Email — if the merchant submits Contact, the message is sent to Smart Product Options Variants’s support inbox over SMTP. Reply-To is the merchant’s email so we can answer from that inbox.

Access tokens are stored in the shop’s session row. They are used only to call Shopify Admin GraphQL for that shop. Option tables do not duplicate the access token.

We do not sell personal data. We do not use shopper option answers for advertising networks. We do not train third-party AI models on merchant option configuration or shopper uploads.

7. GDPR and Shopify mandatory webhooks

Smart Product Options Variants implements Shopify’s mandatory compliance webhooks. Shopify authenticates each request before we process it.

  • customers/data_request — Shopify asks us to provide data we hold about a customer. Smart Product Options Variants does not store Shopify customer profiles. We log the request (shop domain, Shopify webhook request id, topic, timestamp, and status — never the raw customer body) and respond that we do not hold customer personally identifiable information from the Customers API. Merchants can disclose that response to the shopper.
  • customers/redact — Shopify asks us to delete customer personal data. We do not store customer profiles. We record a non-PII audit row and return HTTP 200. Shopper answers that live on Shopify orders are deleted or retained according to the merchant’s Shopify data settings, not bySmart Product Options Variants.
  • shop/redact — Shopify sends this after uninstall (typically within 48 hours) when the shop’s data must be erased. We delete sessions, option sets, queued jobs for that shop, and the Shop tenant row before responding. If that purge fails we return an error so Shopify retries. Compliance audit rows are kept.
  • app/uninstalled — we run the same guaranteed cleanup when the merchant uninstalls, without waiting for shop/redact.

Compliance webhook receipts are stored in a separate audit table keyed by shop domain (not a foreign key to the shop). That audit trail is kept after tenant data is purged so we can show Shopify that the request was received and handled. The row stores only shop domain, request id, topic, status, and timestamp. Customer email, phone, name, and other payload fields are not written to the database or to fallback logs.

8. Data retention

  • While the app is installed: option sets, assignments, sessions, and shop settings are kept so the widget works.
  • After uninstall: we delete sessions and all shop-scoped rows (option sets, assignments, shop settings, queued jobs for that shop).
  • Shop redact: the same deletion path runs if any tenant data is still present when Shopify sends shop/redact.
  • Compliance audit logs: retained after purge for legal and App Store compliance evidence. They are not used to operate the option widget.
  • Support email: if a merchant contacts us, copies may remain in our support inbox.

9. Cookies and similar technology

The embedded admin uses Shopify’s session cookies to keep the merchant logged in. The storefront Theme App Extension does not set a Smart Product Options Variants cookie and does not write an anonymous visitor id. Option state is submitted with the cart, not stored as a shopper identity on our servers.

10. International transfers

The app process is hosted on Hostinger (Node.js). PostgreSQL is hosted on Supabase. Shopify remains the merchant’s store, Admin, Files, cart, and order host. If a merchant or shopper is in the EEA, UK, or another region, data described above may be processed in the US to provide the app. Shopify also processes data under the merchant’s Shopify agreement.

11. Your choices and requests

Merchants can:

  • Uninstall Smart Product Options Variants, which starts deletion of shop-scoped data.
  • Use Shopify Admin → Apps to review permissions, or Shopify’s customer data request / redaction tools (those trigger the webhooks above).
  • Contact us using Smart Product Options Variants → Contact in the app, or email sohilhunani11@gmail.com. Do not send privacy requests to Shopify about this app’s stored option sets; Shopify will forward mandatory GDPR topics to us.

Shoppers should contact the merchant first. The merchant can use Shopify’s customer privacy tools; we will receive the corresponding webhook.

12. Children

Smart Product Options Variants is a B2B Shopify app. We do not knowingly collect personal information from children. Option answers come from the merchant’s checkout, not from child accounts we create.

13. Changes

We will update this page when our data practices or Shopify requirements change. The effective date at the top will change. The current version is always at this URL.

14. Contact

SRH Web Agency — Smart Product Options Variants
Email: sohilhunani11@gmail.com
In-app: Smart Product Options Variants → Contact
See also the Terms of Service.