Privacy Policy
Pollfold Multi-Store Survey — Privacy Policy Effective: 16 October 2026
Who we are. Pollfold Multi-Store Survey ("Pollfold") is operated by Lazy Labs (레이지 랩스), a sole proprietorship in Gyeonggi-do, Republic of Korea (business registration no. 289-24-02816). Privacy officer: Seunghyeok Im (임승혁), [email protected].
This policy covers two groups: buyers who answer a Pollfold survey on a merchant's store, and merchants who use Pollfold. For buyers, the merchant decides to use Pollfold and is responsible for its own privacy notice; we process survey data on the merchant's behalf.
What we collect and why.
| Who | Data | Purpose | Kept for |
|---|---|---|---|
| Buyers | Shopify order identifier, order amount and currency, selected answers, display language, timestamps, first or repeat purchase when Shopify provides it | Show the survey, link answers to orders, let the merchant compare approved stores, send Flow events the merchant turns on | Up to 12 months, then deleted |
| Buyers (optional) | A short comment (up to 200 characters) on an answer that allows one, such as "Other", after email addresses and phone numbers are masked | Let the merchant see answers that the listed choices don't cover. Shown to the merchant and in its CSV export only; never sent to Flow | Up to 12 months, then deleted |
| Merchants | Store identifiers and domains, store names, staff actions in the app, plan and billing status from Shopify, store group connections and approvals, recovery key confirmation | Run the app, control access between stores, billing access, security and integrity | While installed, then deleted as Shopify requires |
| Merchants (support) | Emails you send to [email protected] | Answer support requests | Up to 3 years, then deleted |
We don't ask buyers for names, email addresses, phone numbers or postal addresses.
Comments. Some answers let the buyer add a short comment. It's optional, and the survey asks buyers not to include contact details or other personal information. Before storing a comment, our servers replace email addresses and phone numbers written in common formats; the original text isn't stored or logged. Masking can't catch everything (for example a name or an address), so if a buyer writes personal details, they may remain in the comment. Comments are handled like other survey data: kept for up to 12 months, covered by access and deletion requests, and deleted after the merchant uninstalls, within the period Shopify requires. Shopify compliance notifications may contain customer details; we verify them, keep only the identifiers needed to handle the request, and don't store or log the original notification.
Choice. Answering is optional. The survey tells buyers that an answer is linked to their order and shared with the store, and an answer is sent only when the buyer selects one. The survey doesn't use cookies or store anything on the buyer's device, so it is shown whether or not the buyer has accepted analytics cookies.
What we don't do. We don't sell personal data, share it for cross-context behavioural advertising, use it for advertising, or combine it into cross-customer benchmarks.
Sharing. Store groups are for stores owned by the same business. Each store must approve its connection and confirm that ownership in its own Shopify admin; we rely on that confirmation and don't independently verify ownership. Within that store group, authorised users of the management store can see the survey results that connected stores share, shown as answer shares and order totals per store; removing a connection removes that access. We never combine or show one business's data to another business. We use these service providers: Shopify Inc. (app platform and billing), Hetzner Online GmbH (hosting, Germany), Cloudflare, Inc. (network delivery and email routing) and Google (support mailbox, merchant correspondence only). We disclose data to authorities only when the law requires it.
International transfers.
| Item | Detail |
|---|---|
| Data | Survey and merchant data above |
| Where | Stored in Germany (Hetzner). Backups, including any off-site copy, stay in Germany at Hetzner. Accessed by the operator from the Republic of Korea. Network delivery by Cloudflare's global network |
| When and how | Continuously over encrypted connections while the service runs |
| Purpose and retention | As in the table above |
| Basis | EU adequacy decision for the Republic of Korea, UK adequacy regulations, and contractual protections with our service providers |
| How to refuse | Merchants can uninstall the app. Buyers can skip the survey, or ask the store to access or delete their answers |
Retention and deletion. Survey answers and comments are kept for up to 12 months. Backups are kept for up to 7 days. Shopify privacy requests are handled within 30 days, and deletions are re-applied before any restored data becomes available. Privacy reports stay in the app's protected privacy inbox for 30 days unless a deletion request removes them sooner. Electronic data is deleted so it can't be recovered; nothing is kept on paper.
Security. Encryption in transit (TLS), an encrypted storage volume for the database and backups, encryption of any off-site backup copy before it leaves our server, restricted operator access, and access controls between stores.
Your rights. Depending on where you live, you may have rights to access, correct, delete, restrict or object to processing of your personal data, to data portability, and to withdraw consent. Buyers should contact the store they bought from; the store submits requests through Shopify and we act on them within 30 days. Merchants can write to [email protected]. You may also complain to your local data protection authority, or in Korea to the Personal Information Protection Commission (privacy.go.kr, 182).
Children. Pollfold is a business tool and isn't directed at children.
Changes. We'll post updates here with a new effective date and show a notice in the app for material changes at least 14 days before they apply.