Privacy, without the fog.

Who is responsible

Emberex is an independent UK software business and trading name. A Shopify merchant determines why customer review data is used and acts as controller. Emberex acts as processor when handling that data to provide Emberex Review Carousel. Emberex is responsible for website enquiries, security, support and service-operation data processed for its own legitimate business purposes.

Website information

We do not use advertising trackers, analytics scripts, cookies or browser storage on this website. Railway processes ordinary technical request information needed to deliver and protect it. If you submit the contact form, we process your name, email address, selected topic and message so we can respond. Resend transmits the message to a private Microsoft-hosted inbox; the website does not store the message in its own database or log its contents.

Emberex Review Carousel data

Merchant and app data

We process the Shopify shop domain, installation sessions, app settings, plan state, product mappings, source-connection state and merchant-approved publication decisions.

Imported reviews

When a merchant connects Etsy or imports a CSV, Emberex processes the review content and source metadata the merchant authorises. The Etsy integration does not use Etsy buyer email or Etsy sales data and does not alter source review content.

Storefront and verified-order reviews

A merchant-enabled storefront review can include a reviewer-supplied name and email, rating, title, review text and product selection. Email is used for submission management and redaction and is never published.

For a verified-order review, Emberex checks the Shopify order, customer identifier and purchased product. It does not request or store the customer's Shopify name, email, postal address or phone. The public attribution is Verified buyer. A keyed pseudonymous customer reference is retained only so a later Shopify redaction request can locate the review.

Why we process this data

• Import, organise, moderate and publish merchant-selected reviews.
• Verify that an order review concerns a product the customer purchased.
• Prevent duplicate, abusive or excessive submissions.
• Secure, operate, troubleshoot and audit access to the service.
• Meet Shopify privacy, deletion and legal obligations.

Retention and deletion

Verified order identifier

Retained for up to 90 days after submission, then removed automatically.

Pseudonymous customer key

Retained while the associated review exists, solely to support customer redaction.

Review content and public attribution

Retained until the merchant deletes it, Shopify requests customer redaction, or the app is uninstalled.

Administrative access audit

Retained for 365 days, then removed automatically.

Submission rate-limit records

Retained for no longer than 48 hours.

Shop-owned app data

Deleted on uninstall and finalised when Shopify sends the shop-redaction webhook.

Website enquiries

Contact messages are normally kept for no longer than 12 months after the conversation ends, unless needed for an unresolved dispute, security investigation or legal obligation.

Sharing and international processing

Shopify supplies store and order context. Railway hosts the website, application, private database, logs and encrypted backups. Etsy supplies review data only when a merchant authorises that connection. Resend and Microsoft process contact enquiries. These providers can process data outside the United Kingdom under their applicable contractual transfer safeguards.

Security and access

Application data is encrypted in transit and at rest by the hosting platform. Production and development data are separated, database access uses private networking, secret and email fields are redacted from application logs, and review-management access is recorded using a pseudonymous staff key rather than a raw Shopify staff identity.

Your rights and requests

Customers should normally contact the Shopify merchant that controls the review. Emberex processes Shopify's mandatory customer-data request and redaction webhooks and supports merchant deletion. Depending on the circumstances, UK data protection law may also give you rights to access, correct, erase or restrict your personal information, object to processing, and receive portable information. Use the privacy contact form to make a request.

You may also complain to the UK Information Commissioner's Office. We encourage you to contact us first so we can try to resolve the issue.