Privacy policy

1. Introduction

This Privacy Policy explains how Nexfal (a product brand of WebContrive Technologies Pvt Ltd. "8th Floor, Mahek IT Park, 801-811, nr. Kiran Hospital, Naginawadi, Katargam, Surat, Gujarat 395004") collects, uses, stores, and shares information when you use our Shopify applications (Rivyo, Rebolt Bundle, Wishlist Club, Editly, Addup Checkout, Utterbond, Quickhunt) and any associated SaaS products, websites, and services (collectively, the “Services”).

By installing or using any of our Services, you agree to this Privacy Policy. If you do not agree, please uninstall the relevant application and discontinue use.

2. Information We Collect

2.1 Information you provide

Account information: Name, email address, Shopify store URL, and billing details when you install an app or create a Nexfal account.
Support communications: Messages, screenshots, or files you share when contacting our support team.
Form submissions: Data you enter on nexfal.com (demo requests, newsletter sign-ups, contact forms).

2.2 Information collected automatically

Shopify store data: Product, order, customer, and storefront data accessed via the Shopify API, limited to the scopes each app requests during installation.
Usage data: Feature usage, session duration, error logs, and performance metrics within our apps and SaaS dashboards.
Device and browser data: IP address, browser type, operating system, referring URL, and language preference, collected via cookies and similar technologies.

2.3 Information from third parties

We may receive information from Shopify (through their Partner API), payment processors, analytics services, and any third-party integrations you enable within our apps.

3. How We Use Your Information

Provide, operate, and maintain the Services.
Process transactions and send related communications (billing, confirmations).
Provide customer support and respond to enquiries.
Send product updates, feature announcements, and marketing communications (with opt-out).
Monitor usage patterns to improve performance, fix bugs, and develop new features.
Detect, investigate, and prevent fraud or unauthorised access.
Comply with legal obligations.

4. Information Sharing

We do not sell your personal information. We may share information with:

Service providers: Hosting, analytics, email delivery, payment processing, and customer-support tools that process data on our behalf.
Shopify: As required by the Shopify Partner programme and API terms.
Legal authorities: When required by law, regulation, court order, or governmental request.
Business transfers: In connection with a merger, acquisition, or sale of assets, with notice to affected users.

5. Data Retention

We retain your information for as long as your account is active or as needed to provide the Services. Upon app uninstallation, we delete or anonymise store-specific data within 7 days, except where retention is required by law or for legitimate business purposes

6. Data Security

We retain your personal information only for as long as necessary to provide our services, operate our business, and maintain our relationship with you. We may also retain your information for a longer period where required to comply with applicable laws, resolve disputes, establish or defend legal claims, or enforce our agreements.

We implement appropriate technical and organizational security measures to protect your personal information from unauthorized access, disclosure, alteration, or loss. However, no method of transmission over the internet or electronic storage is completely secure. While we make every reasonable effort to safeguard your information, we cannot guarantee the absolute security of your personal information.

7. Your Rights

Depending on your jurisdiction, you may have the right to:

Access, correct, or delete your personal information.
Restrict or object to certain processing activities.
Data portability — receive your data in a structured, machine-readable format.
Withdraw consent at any time (where processing is consent-based).
Lodge a complaint with your local data-protection authority.

To exercise any of these rights, contact us at hi@nexfal.com.

8. International Data Transfers

Your information may be transferred to and processed in countries outside your own, including India, United States. We ensure appropriate safeguards are in place in compliance with applicable data-protection laws.

9. Cookies and Tracking Technologies

Our websites and SaaS dashboards use cookies, local storage, and similar technologies for authentication, analytics, and preference storage. You can manage cookie preferences through your browser settings. Disabling cookies may limit certain features.

10. Children’s Privacy

Our Services are not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If we learn that we have collected data from a child, we will promptly delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or an in-app notification. Continued use of the Services after the updated policy is posted constitutes acceptance.

12. Data Subject Rights Under the GDPR (EU/UK)

If you are located in the European Economic Area (EEA) or the United Kingdom, you have certain rights under the General Data Protection Regulation (GDPR) and the UK GDPR regarding your personal information.

Right to Access: You have the right to request access to the personal information we hold about you and receive a copy of that information.

Right to Rectification: You may request that we correct or update any inaccurate or incomplete personal information we process about you.

Right to Withdraw Consent: Where we rely on your consent to process your personal information, you may withdraw that consent at any time. This does not affect the lawfulness of any processing carried out before your consent was withdrawn.

Right to Data Portability: You may request a copy of your personal information in a structured, commonly used, and machine-readable format. Where technically feasible, you may also request that we transfer your data directly to another organization.

Right to Object: You have the right to object to the processing of your personal information where we rely on our legitimate interests as the legal basis. We will stop processing your information unless we have compelling legitimate grounds to continue or the processing is required for the establishment, exercise, or defense of legal claims.

Right to Restrict Processing: You may request that we restrict the processing of your personal information in certain circumstances, including where:

You believe the information is inaccurate while we verify its accuracy.
The processing is unlawful, but you prefer restriction instead of deletion.
We no longer need the information, but you require it for legal claims.
You have objected to processing while we assess your objection.

Right to Erasure (Right to be Forgotten): You may request that we delete your personal information where permitted by applicable law. We may retain certain information where necessary to comply with legal obligations, resolve disputes, enforce our agreements, or establish, exercise, or defend legal claims.

To protect your privacy, we may ask you to verify your identity before processing your request. If we are unable to fulfill your request, we will explain the reasons, subject to any legal restrictions.

If you believe your rights under the GDPR or UK GDPR have been violated, you have the right to lodge a complaint with the relevant data protection authority. In the EEA, you may contact the supervisory authority in the Member State where you live, work, or where the alleged infringement occurred. In the UK, you may lodge a complaint with the Information Commissioner's Office (ICO).

13. Contact Us

If you have any questions about this Privacy Policy, please contact us:

Entity: Nexfal
Email: hi@nexfal.com
Address: 8th Floor, Mahek IT Park, 801-811, nr. Kiran Hospital, Naginawadi, Katargam, Surat, Gujarat 395004