1. Introduction

Logbase Technologies LLP. ("Logbase," "we," "us," or "our") is committed to protecting privacy and helping individuals understand how their Personal Information is collected, used, disclosed, and safeguarded when they visit our website, use our Shopify applications, or otherwise interact with our services (collectively, the "Services").

This Privacy Policy applies to all Logbase websites, applications, and services unless a separate privacy notice is provided for a specific service.

In this Privacy Policy, "you" refers to any individual whose Personal Information we collect, including Merchants using our Services, customers of those Merchants ("Merchant Customers"), website visitors, and other business contacts.

By accessing our website or using our Services, you acknowledge that your Personal Information will be handled in accordance with this Privacy Policy. Your use of our Services is also governed by applicable Terms of Service and other contractual terms.

We collect Personal Information from the following categories of individuals:

• Merchants using our Services
• Merchant Customers
• Website visitors
• Business partners, service providers, and other individuals who interact with us

Our Services are primarily intended for business use. Where our Services involve the processing of Personal Information relating to Merchant Customers, Logbase typically acts on behalf of the relevant Merchant. In such cases, the Merchant is responsible for ensuring that its use of the Services complies with applicable privacy and data protection laws. Merchant Customers with questions about the processing of their Personal Information should contact the relevant Merchant directly. Where the Merchant's store is hosted by a third-party commerce platform, such as Shopify, you should also review that platform's privacy practices.

Where Logbase processes personal data on behalf of Merchants as a data processor, such processing is governed by our Data Processing Addendum (DPA), which forms part of our Terms of Service.

2. Information We Collect

2.1 Information from Merchants

When Merchants install, access, or otherwise use our Services, we collect certain Personal Information and related business information that is necessary to provide, administer, maintain, and improve the Services.

Such information includes:

• Merchant name
• Email address
• Store name, store domain and store basic details like location, timezone.
• Billing and subscription information
• Account settings, preferences, and application configuration data created or managed within our Services
• Records of communications with our support, sales, or customer success teams

2.2 Data Obtained from Shopify

When a Merchant installs, accesses, or uses one of our applications, Logbase accesses information from the Shopify platform through Shopify APIs in connection with providing the Services.

Depending on the permissions authorized by the Merchant, the specific application installed, and the features used within the Services, such information includes categories of store data such as:

• Product and catalog information
• Inventory information
• Order information and transaction-related details
• Shipping, delivery, and fulfillment information
• Customer information necessary to provide the functionality of the Services

The specific information accessed varies depending on the application installed and the features enabled by the Merchant. Logbase accesses and processes such information only as necessary to operate, maintain, support, and improve the Services and in accordance with the permissions granted by the Merchant through the Shopify platform. We access Shopify data only after the Merchant authorizes the required permissions during the installation of the application. Unless otherwise stated, data is stored only as required to support the functionality of the application.

Application Data & Functionality

Different Logbase applications access and process Shopify store data based on the functionality provided by each application. The specific data collected, accessed, retrieved, stored, and the purposes for such processing vary depending on the application installed and the features enabled by the Merchant.

Detailed information about the application functionality, app-specific data collected, purposes of access and retrieval, and storage practices is available in our Application Data & Functionality document.

2.3 Information Processed from Merchants' Customers

Our Services process certain information relating to customers of Merchants who use our applications ("Merchant Customers"). This information is made available to us through the Shopify platform or through interactions with the Services and is processed only to provide the functionality of the Services.

Depending on the application installed and the features enabled by the Merchant, such information includes:

• Customer name
• Email address
• Phone number
• Shipping or delivery address
• Order information and transaction details
• Purchase history or order activity
• Reservation, booking, or scheduling information where applicable

Logbase processes Merchant Customer information solely on behalf of the Merchant and only to the extent necessary to operate and provide the Services.

For such data:

• The Merchant acts as the data controller, determining the purposes and means of processing the personal data of its customers.
• Logbase acts as a data processor, processing Merchant Customer data only as necessary to provide the Services and in accordance with the Merchant's instructions, applicable agreements, and relevant data protection laws.

Merchant Customers who have questions about how their personal data is collected, used, or disclosed should contact the relevant Merchant directly.

Where required by applicable law, Logbase assists Merchants in responding to requests from individuals seeking to exercise their privacy rights in relation to Merchant Customer data.

2.4 Usage and Technical Data

When users interact with our website or Services, we automatically collect certain technical and usage-related information to help us operate, maintain, secure, and improve the Services.

Such information includes:

• Internet Protocol (IP) address
• Browser type and version
• Device information and operating system
• Time zone settings
• Date and time of access
• Pages viewed or actions performed within the Services
• Referring website or source
• Application usage metrics and diagnostic data
• System logs and performance data

When you visit our website, we also collect certain information about your device and browsing activity, including information about your web browser, IP address, time zone, and cookies installed on your device.

We collect this information using technologies such as:

• Cookies, which are data files placed on your device and often include an anonymous unique identifier
• Log files, which track actions occurring on the website and collect information such as IP address, browser type, internet service provider, referring or exit pages, and date/time stamps
• Web beacons, tags, and pixels, which are electronic technologies used to record information about how users browse the website or interact with the Services

This information helps us monitor system performance, analyze usage trends, detect and prevent fraudulent or unauthorized activity, troubleshoot technical issues, and improve the functionality and user experience of our website and Services.

Where possible, such usage data is aggregated or anonymized so that it does not directly identify individuals.

2.5 Cookies and Tracking Technologies

We use cookies and similar tracking technologies to support the operation of our website and Services, remember user preferences, analyze website traffic, and improve overall user experience.

Cookies and similar technologies are used for purposes such as:

• Session management
• Authentication
• Performance monitoring
• Analytics and usage analysis
• Remembering user preferences

Users can control or disable cookies through their browser settings. However, disabling cookies affects the functionality of certain parts of the website or Services.

For more information about cookies, including how to manage or disable them, users can refer to publicly available resources such as allaboutcookies.org.

2.6 Data Minimization

Logbase follows the principle of data minimization. We collect and process only the personal data that is necessary to provide, operate, maintain, and improve our Services.

We limit the collection, access, and retention of personal data to what is reasonably required for the purposes described in this Privacy Policy.

Where appropriate, data is aggregated, anonymized, or de-identified so that it can no longer be used to identify an individual.

Logbase also implements appropriate safeguards designed to ensure that personal data collected through our Services is handled in accordance with applicable data protection laws.

3. How We Use the Information

We use the information we collect for a variety of purposes related to providing, operating, maintaining, and improving our Services. These purposes include:

• Providing, operating, and maintaining our Services and applications
• Delivering the features and functionality requested by Merchants
• Processing subscriptions, billing, and other financial transactions related to the Services
• Managing merchant accounts and application configurations
• Providing customer support and responding to inquiries or support requests
• Communicating with Merchants about updates, product features, service announcements, or changes to the Services
• Monitoring system performance, reliability, and security
• Detecting, preventing, and investigating fraud, abuse, security incidents, or unauthorized activities
• Analyzing usage trends and improving the functionality, usability, and performance of our apps
• Complying with applicable legal, regulatory, and contractual obligations

Where applicable, information may also be used in aggregated or anonymized form to better understand how our Services are used and to improve our products and user experience.

3.1 AI-Powered Features

Certain Logbase applications use artificial intelligence or machine learning technologies to provide features such as automated responses, product recommendations, visualizations, or virtual try-on functionality.

These AI-powered features process information provided through the Services, such as product data, store information, or user-uploaded content, solely for the purpose of generating the requested functionality.

Logbase does not use merchant data or user-uploaded content for training any AI or machine learning models. Such data is processed only to provide the requested functionality of the Services. Any processing performed by AI systems is limited to providing the functionality of the relevant application.

4. Legal Basis for Processing (GDPR)

Where the General Data Protection Regulation (GDPR) or similar data protection laws apply, Logbase processes personal data only when a lawful basis exists. Depending on the circumstances, we rely on one or more of the following legal bases:

Contractual Necessity

We process personal data when it is necessary to perform our contractual obligations to Merchants or to provide the Services requested by them. This includes activities such as:

• Creating and managing merchant accounts
• Providing application functionality
• Processing subscriptions and billing
• Delivering customer support

Legitimate Interests

We process personal data where it is reasonably necessary for our legitimate business interests, provided that such interests are not overridden by the rights and freedoms of individuals. This includes:

• Improving and optimizing our Services
• Monitoring system performance and reliability
• Detecting and preventing fraud, abuse, or unauthorized activities
• Maintaining the security and integrity of our systems

Consent

In certain situations, we process personal data based on an individual's consent. Where consent is required by applicable law, individuals can withdraw their consent at any time.

Legal Obligations

We process personal data where necessary to comply with applicable legal, regulatory, or governmental requirements, including obligations relating to taxation, accounting, and legal compliance.

Processing on Behalf of Merchants

When processing information relating to Merchant Customers, Logbase acts as a data processor and processes personal data on behalf of the Merchant, who acts as the data controller. In such cases, the Merchant determines the legal basis for processing the personal data of its customers. This processing is governed by our Data Processing Addendum (DPA), which outlines our obligations as a processor and is available at https://logbase.io/dpa

5. Data Sharing and Disclosure

Logbase does not sell personal data. However, we disclose personal information in certain circumstances where it is necessary to operate our business, provide the Services, comply with legal obligations, or protect our rights.

Personal data is shared or disclosed in the following situations:

Analytics and Website Usage

We use analytics tools to better understand how users interact with our website and Services. These tools help us analyze website traffic, measure product usage, and improve the performance and functionality of our Services.

We use Google Analytics to help us understand how our customers use our website, our apps. You can read more about how Google uses your Personal Information at google.com/intl/en/policies/privacy.

You can also opt out of Google Analytics at tools.google.com/dlpage/gaoptout.

Marketing and Advertising

We use your Personal Information to provide you with marketing communications such as product updates, newsletters, or announcements about our services that we believe will be of interest to you. These communications relate to our products, updates, promotions, or services.

Shopify Platform

Our applications operate within the Shopify platform. As a result, certain data is accessed from or transmitted through Shopify in connection with the operation of the Services.

Merchants using our applications are also subject to Shopify's terms, privacy policies, and platform requirements.

Business Transfers

Personal information also may be shared with a company that acquires our business, whether through merger, acquisition, bankruptcy, dissolution, reorganization, or other similar transaction or proceeding. If this happens, we will post a notice on our home page.

Legal Requirements and Protection of Rights

We also share your Personal Information to comply with applicable laws and regulations, to respond to a subpoena, search warrant, or other lawful requests for any information we receive, or to otherwise protect our rights.

We also disclose personal information where we reasonably believe such disclosure is necessary to:

• Comply with applicable laws, regulations, or legal processes
• Enforce our agreements, policies, or terms
• Protect the security and integrity of our Services
• Protect the rights, property, or safety of Logbase, our users, or others

Where legally permitted, Logbase will notify affected users or Merchants before disclosing personal data in response to legal requests, unless such notification is prohibited by law or legal process.

6. Service Providers and Subprocessors

Logbase engages trusted third-party companies and individuals ("Service Providers" or "Subprocessors") to support the operation of our Services and assist us in providing, maintaining, and improving the Services.

These Service Providers perform services such as:

• Cloud hosting and infrastructure services
• Data storage and database management
• Application monitoring and diagnostics
• Email delivery and communication services
• Customer support systems
• Analytics and usage monitoring

These Service Providers have access to personal data only to the extent necessary to perform these tasks on our behalf and are contractually obligated to protect the confidentiality and security of such information. They are not permitted to use personal data for their own purposes.

Logbase implements appropriate safeguards when engaging Service Providers to ensure that personal data is processed securely and in accordance with applicable data protection laws.

Below is a list of the primary subprocessors that process personal data on behalf of Logbase in connection with the Services. We update this list from time to time as our infrastructure or service providers change.

6.1 Common Subprocessors

6.2 App-Specific Subprocessors

AI Processing: Where AI service providers are used, Personal Data is processed only as necessary to provide the relevant application functionality. Logbase does not use merchant data or user-uploaded content for training any AI or machine learning models. Such data is processed only to provide the requested functionality of the Services. Any processing performed by AI systems is limited to providing the functionality of the relevant application.

7. Data Retention

Logbase retains personal data only for as long as necessary to provide the Services and fulfill the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by applicable law.

The retention period varies depending on the type of information, the application used, and the purpose for which the data was collected.

In general:

Merchant account information is retained for as long as the Merchant maintains an active account or continues to use the Services.

Application configuration and settings data is retained for the duration of the Merchant's use of the Services and for a reasonable period thereafter to support service continuity, troubleshooting, and compliance with legal obligations.

Merchant Customer data processed through the Services is retained only as required to support the functionality of the relevant application and the Merchant's use of the Services.

Usage and technical data may be retained for a limited period for analytics, monitoring, security, and service improvement purposes.

Where possible, personal data will be anonymized, aggregated, or de-identified so that it can no longer be used to identify an individual.

When a Merchant uninstalls an application and a valid deletion request is received, applicable Personal Data is deleted or anonymized from Logbase's active systems upon receipt of the relevant Shopify GDPR webhook, unless retention is required for legal, regulatory, or security purposes.

Deleted Personal Data remains temporarily in encrypted backup systems for up to 30 days and is automatically deleted or overwritten as part of Logbase's normal backup retention and rotation processes.

Detailed application-specific retention practices are available in our Data Retention document.

7.1 Shopify GDPR Webhook Compliance

Logbase implements Shopify's GDPR-compliant webhook mechanisms to support data deletion and privacy requests.

shop/redact

• Shopify sends this event 48 hours after a merchant uninstalls the application.
• Upon receiving this event, Logbase automatically deletes or anonymizes applicable Personal Data associated with the merchant from its active systems, except where retention is required for legal, regulatory, or security purposes.
• Any residual copies remaining in backup systems are automatically deleted or overwritten within 30 days in accordance with Logbase's backup retention and rotation processes.

customers/redact

• Shopify sends this event 10 days after a customer requests deletion or when a merchant deletes a customer.
• Upon receiving this event, Logbase automatically deletes or anonymizes applicable Personal Data related to the specified customer from its active systems, where such data is identifiable and stored.
• Any residual copies remaining in backup systems are automatically deleted or overwritten within 30 days in accordance with Logbase's backup retention and rotation processes.

These processes ensure compliance with applicable data protection laws and Shopify platform requirements. Application-specific retention practices are available in our Data Retention document.

8. Data Security

Logbase implements appropriate technical and organizational measures designed to protect personal data from loss, misuse, and unauthorized access, disclosure, alteration, or destruction.

These safeguards are intended to ensure the confidentiality, integrity, and availability of the data processed through our Services.

Security measures include:

• Secure cloud infrastructure and data storage
• Encryption of data in transit and, where applicable, at rest
• Access controls and authentication mechanisms to restrict access to authorized personnel and systems
• Monitoring, logging, and auditing of system activities
• Regular security reviews and updates to protect against emerging threats

Access to personal data is limited to personnel and systems that require such access in order to perform their duties in connection with providing and maintaining the Services.

Users are responsible for maintaining the confidentiality of their account credentials and for protecting their devices from unauthorized access. This includes choosing strong passwords, keeping login credentials private, and signing out of shared devices after use. Logbase is not responsible for any loss, theft, or compromise of passwords or for any unauthorized activity resulting from compromised account credentials.

While we implement commercially reasonable safeguards to protect personal data, no method of transmission over the internet or method of electronic storage is completely secure. Therefore, we cannot guarantee the absolute security of personal data.

9. Security Incidents and Data Breaches

Despite our efforts to implement appropriate security safeguards, security incidents occur. In the event of a security incident or data breach that affects personal data, Logbase will take appropriate steps to investigate, mitigate, and respond to the incident in accordance with applicable data protection laws.

Where required by law, we will notify affected Merchants of a personal data breach without undue delay and, where feasible, within 72 hours of becoming aware of the breach. Where notification cannot be provided within 72 hours, we will provide it as soon as reasonably possible along with the reasons for the delay. Merchants are responsible for notifying their customers and relevant supervisory authorities where required by applicable law.

Logbase will work to contain and remediate the incident, assess potential risks to affected individuals, and implement measures designed to prevent similar incidents from occurring in the future.

Merchants are responsible for notifying their customers where required by applicable law, particularly where Logbase processes Merchant Customer data on behalf of the Merchant.

If you believe that your interaction with our Services has been compromised or that there has been unauthorized access to your account, please contact us immediately so that we can investigate and take appropriate action.

10. International Data Transfers

Logbase processes and stores personal data in countries other than the country in which the data was originally collected. These countries have data protection laws that differ from those in the user's jurisdiction.

In particular, the infrastructure and service providers used to support our Services operate in multiple jurisdictions. As a result, personal data may be transferred to and processed in countries outside the European Economic Area (EEA) or other regions with comprehensive data protection laws.

Where such transfers occur, Logbase implements appropriate safeguards to ensure that personal data remains protected in accordance with applicable data protection laws.

By using our Services, users acknowledge that personal data may be transferred to and processed in jurisdictions outside their country of residence, subject to the safeguards described in this Privacy Policy.

If you have questions about how personal data is transferred internationally or about the safeguards we implement, you can contact us using the contact information provided in this Privacy Policy.

11. Your Rights

Depending on your location and applicable data protection laws, you have certain rights regarding the personal data we process about you. These rights include the ability to access, correct, update, or delete your personal data, as well as other rights described below.

Where Logbase processes personal data on behalf of Merchants (such as Merchant Customer data processed through our applications), the Merchant acts as the data controller. In such cases, requests relating to that data should generally be directed to the relevant Merchant.

11.1 How You Can Request Access, Deletion, or Updates

You can request access to, correction of, or deletion of your personal data by contacting us using the contact information provided in this Privacy Policy.

To help us process your request, you are asked to provide information that allows us to verify your identity and locate your records in our systems. This includes information such as your name, email address, or other details associated with your account.

In some cases, we may request additional information to verify your identity before fulfilling your request. If we are unable to adequately verify a request, we decline to process the request for security reasons.

Where Logbase processes personal data on behalf of a Merchant (for example, Merchant Customer data), requests to access, delete, or update such data should generally be directed to the relevant Merchant.

11.2 Withdrawing Consent

Where we rely on your consent to process personal data, you can withdraw your consent at any time by contacting us using the contact details provided in this Privacy Policy.

Withdrawing consent will not affect the lawfulness of any processing that occurred prior to the withdrawal.

Where personal data is processed on behalf of a Merchant, requests to withdraw consent should generally be directed to the relevant Merchant.

11.3 Do Not Track

Some browsers offer a "Do Not Track" ("DNT") feature that allows users to signal to websites that they do not want their online activities tracked.

There is currently no widely accepted standard for how websites should respond to DNT signals. As a result, our systems do not currently respond to Do Not Track browser signals. However, users control certain tracking technologies through their browser settings, including disabling cookies.

11.4 Rights for Individuals in the European Economic Area (EEA) and United Kingdom

If you are located in the European Economic Area (EEA) or the United Kingdom, you have the following rights under applicable data protection laws, including the General Data Protection Regulation (GDPR):

Right to be informed

You have the right to know how your personal data is collected, used, shared, and retained. This Privacy Policy is intended to provide that information.

Right of access

You have the right to request a copy of the personal data we hold about you.

Right to rectification

You have the right to request that we correct inaccurate or incomplete personal data.

Right to erasure ("Right to be forgotten")

Under certain circumstances, you can request that we delete your personal data.

Right to restrict processing

Under certain circumstances, you can request that we restrict the processing of your personal data.

Right to data portability

You can request to receive a copy of your personal data in a structured, commonly used, and machine-readable format.

Right to object

You have the right to object to certain types of processing of your personal data, including processing for marketing purposes.

Right to withdraw consent

Where processing is based on consent, you can withdraw that consent at any time.

11.5 How to Exercise Your Rights

If you wish to exercise any of the rights described above, you can contact us using the contact details provided in this Privacy Policy.

We need to verify your identity before responding to your request. Once verified, we will respond to your request within the timeframes required by applicable data protection laws.

Where applicable, individuals can also contact their local data protection authority if they believe their privacy rights have been violated.

12. Merchant Responsibilities

Merchants who install and use Logbase applications are responsible for ensuring that their use of the Services complies with applicable privacy and data protection laws.

In particular, Merchants are responsible for:

• Providing appropriate privacy notices to their customers regarding the collection and use of personal data
• Obtaining any required consents from customers before collecting or processing their personal data through the Merchant's store or through the Services
• Ensuring that the processing of customer data through Logbase applications complies with applicable data protection laws and regulations
• Responding to requests from their customers to access, update, delete, or otherwise exercise their privacy rights

Logbase processes Merchant Customer data only on behalf of the Merchant and in accordance with the functionality of the installed application. As such, the Merchant acts as the data controller for customer personal data processed through the Services, and Logbase acts as a data processor.

If a Merchant Customer contacts Logbase directly regarding their personal data, we redirect the request to the relevant Merchant, unless we are legally required to respond directly.

13. Children's Privacy

Our Services are intended for use by businesses and individuals who are at least the age of majority in their jurisdiction. The Services are not directed to children under the age of 13, and we do not knowingly collect personal data from children.

If we become aware that personal data has been collected from a child under the age of 13 without appropriate parental consent, we will take reasonable steps to delete such information as soon as possible.

If you believe that a child has provided personal data to us, please contact us using the contact information provided in this Privacy Policy so that we can investigate and take appropriate action.

Merchants using our Services are responsible for ensuring that their use of the Services complies with applicable laws relating to children's privacy and data protection.

14. Third‑Party Links

Our website or Services contain links to third-party websites, applications, or services that are not operated or controlled by Logbase.

This Privacy Policy does not apply to the privacy practices of such third-party websites or services. We encourage users to review the privacy policies of any third-party websites or services they visit.

Logbase is not responsible for the content, security, or privacy practices of any third-party websites or services.

15. Changes to This Privacy Policy

We update this Privacy Policy from time to time. When changes are made, the "Last Updated" date will be revised.

16. Contact Information

Logbase Technologies LLP