Privacy Policy

This Privacy Policy explains how Obox Systems LLC ("Obox", "we", "us") handles information in connection with the Obox 3D Jewelry Configurator app for Shopify (the "App") and the website jewelshop.ai (the "Site"). It is written to be read alongside our Terms of Service.

1. The short version

The App is a storefront display widget. It requests no Shopify permission scopes and does not collect or store personal data about shoppers. A shopper who rotates a ring or switches its metal and stone does so entirely in their own browser — those choices are not sent to us. Like any web page, the configurator is loaded from our servers, so they see standard request data (see Section 3). The only information we store is what is needed to run a paid subscription: which store installed the App and whether its subscription is active. We never see or store payment card details — billing is handled by Shopify.

2. Information we store

To operate the subscription and licensing for the App, we store store-level information:

• the store's Shopify domain (e.g. your-store.myshopify.com);
• the App subscription status (active / inactive), plan, and the identifier Shopify gives the subscription;
• the website origin(s) authorised to display the configurator;
• a license identifier, whether the license came from Shopify, and the dates the record was created and last updated;
• for each subscription charge the App creates for the store: the identifier Shopify gives it, whether it is a test charge, the amount, and when it was created.

This information relates to a store, not to an individual person. We do not store shopper names, email addresses, shipping or billing addresses, order contents, or payment information.

3. Information we do not collect

Because the App requests no data-access scopes, it has no access to your customers, orders, products, or checkout beyond displaying the configurator on a product page. Shopper interactions with the 3D viewer stay in the shopper's browser.

The configurator on a product page is a page served from jewelshop.ai inside a frame. Loading it, its 3D files and the license check means the shopper's browser makes ordinary requests to our servers, which see the IP address and browser type that come with any web request; these appear only in the technical logs described in Section 6. Like every request to jewelshop.ai, these pass through Cloudflare, the content delivery network and reverse proxy in front of the whole Site, which sees and forwards them (including the IP address and request data) to provide security and caching. That page also loads Cloudflare Web Analytics, a cookieless beacon that reports an anonymous page view (the page address, referrer, browser type and load-time measurements) and does not identify the shopper.

4. Payments

App subscriptions are billed exclusively through the Shopify Billing API. Payment is handled by Shopify under Shopify's own terms and privacy policy. We receive only the resulting subscription status (active or cancelled) — never card numbers or bank details.

5. GDPR / data-request webhooks

Shopify requires apps to respond to mandatory compliance webhooks. We honour them as follows:

• customers/data_request — we hold no customer data, so there is nothing to return.
• customers/redact — we hold no customer data, so there is nothing to delete.
• shop/redact — Shopify sends this about 48 hours after a store uninstalls the App; we then delete the store's license record and its charge records. (Uninstalling already deactivates the license. If the store has reinstalled and subscribed again in the meantime, its new, active license and its charge records are kept.)

Each webhook is verified by cryptographic signature before it is acted on.

6. The jewelshop.ai website

The Site is our marketing and documentation site. It, and the configurator page described in Section 3, use Cloudflare Web Analytics — privacy-friendly, cookieless traffic analytics — to understand aggregate visits. Where we enable it, the Site, including the live demo when you open it on jewelshop.ai itself, may also use Google Analytics, and only after you consent to it. Google Analytics never runs in the configurator shown on a store's product page, or on any other page that embeds it. Our servers keep standard technical logs (such as IP address and browser type) for security and reliability. We do not sell personal data.

7. Data retention

We retain a store's license record and charge records for as long as the App is installed. When the App is uninstalled, the license is deactivated at once, and both are deleted when Shopify's shop/redact request arrives, as described in Section 5. Technical logs are kept only as long as needed for security and operations.

8. Sub-processors

We rely on a small set of infrastructure providers to run the service — hosting for the App backend and Site (Hetzner, in the EU), Cloudflare as the content delivery network and reverse proxy in front of the Site (it sees and forwards every request to it, including the IP address and request data, for security and caching) and for web analytics, and Shopify for installation and billing. These providers process data only to deliver their service to us.

9. Your rights

Depending on where you are, you may have rights to access, correct, or delete personal data we hold about you. Because our App stores no shopper personal data, most such requests concern the merchant contact for a store. To exercise any right, contact us at the address below.

10. Changes to this policy

We may update this policy from time to time. When we do, we will revise the effective date at the top of this page. Material changes will be communicated where appropriate.

11. Contact

Obox Systems LLC
1621 Central Ave, Cheyenne, WY 82001, United States
[email protected]