Privacy Policy
This policy explains what personal data Lyrakart Customer Mobile App collects, why, how long we keep it and who we share it with. Lyrakart Customer Mobile App is a service that builds branded iOS and Android shopping apps for Shopify stores operated by PRS CLOUD TECH PRIVATE LIMITED (CIN U62013DC2026PTC474428), Jain Road, Jai Jawala Mandir, Near Hanuman Properties, Delhi 110059, India ("we", "us"). It covers the Lyrakart Customer Mobile App app for Shopify stores, its merchant dashboard in the Shopify admin, and the shopping apps built and published for a merchant with it.
Who this applies to
- Merchants: Shopify stores that install Lyrakart Customer Mobile App, and their staff users.
- Shoppers: people who use a merchant's shopping app. The merchant is responsible for their shoppers' data; we process it on the merchant's behalf and only on their instructions.
Data we collect
| Data | Source | Why we use it |
|---|---|---|
| Store details: shop domain, store name, store owner email, currency, time zone, plan, access token | Shopify, when the app is installed | To connect the store, show its products in the shopping app and contact the merchant |
| Catalogue: products, variants, collections, inventory, discounts, markets, languages, store content | Shopify | To show the merchant's catalogue in the shopping app and keep stock and prices current |
| App design settings: app name, logo, colours, screens, navigation, store listing text | The merchant | To build and publish the merchant's shopping app |
| Staff user name, email, role, login and change history | The merchant and Shopify | To provide accounts, apply roles and approvals, and keep an audit trail |
| Shopper email (stored as a one-way hash), Shopify customer ID, customer tags, marketing-consent flag, number of orders, total spent, last order date | Shopify (customer records and customer webhooks) | To build audiences for push notifications, run automations such as welcome and win-back flows, and link an app install to a customer |
| Orders: order number, totals, currency, payment and fulfilment status, discount codes, app attribution, linked customer ID | Shopify (order and refund webhooks) | To show which orders came from the app or a push notification, report revenue, and trigger order-status messages |
| Shopper email, name and phone number when a shopper signs in, books an appointment, requests a quote or sends a contact or newsletter form | The shopper, in the shopping app | To provide that feature for the merchant. Email addresses on newsletter and contact forms are stored encrypted |
| Cart contents, wishlist, recently viewed products, gift registry | The shopper, while using the app | To keep the cart and wishlist between visits and to send abandoned-cart or back-in-stock messages the shopper has agreed to |
| Device details: install ID, platform, model, OS and app version, language, country, time zone, push token, notification permission | The shopper's device | To deliver push notifications the shopper has allowed, to show the right language, and to fix app problems |
| App activity: screens viewed, taps, searches, push opens, links opened | The shopper's device | To give the merchant analytics about their app and to measure campaigns |
| Optional shopper content: community posts and comments, live-show chat messages, shopping-assistant questions, uploaded prescription files (only for merchants who switch these features on) | The shopper, in the shopping app | To provide the feature for the merchant. Shopping-assistant questions are sent to an AI model provider only when the merchant has turned the assistant on |
| Billing: plan, subscription status and charge records | Shopify | To charge for the app through Shopify billing. We never see card details |
We use this data only to provide Lyrakart Customer Mobile App to the merchant. We do not sell personal data, do not use it for advertising, and do not make automated decisions about shoppers that have legal or similar effects.
Payments are taken by Shopify's own checkout. We never see or store card or bank details. Shoppers can turn off notifications at any time in their phone's settings. Merchants decide which of the optional features above are on for their app.
Who we share it with
- Shopify, which runs the store, the customer account, the checkout and billing.
- Apple and Google, which deliver push notifications and publish the merchant's app in their stores.
- Our hosting provider, which runs the servers the app uses, and our email delivery provider, which sends account and notification emails.
- Services the merchant connects (for example a reviews, loyalty or email-marketing tool, or an export destination the merchant sets up). Data is sent only to the services the merchant chooses.
- An AI model provider, only for merchants who switch on the shopping assistant or AI writing help. We send the question and the product context needed to answer it.
- Authorities, only where the law requires it.
How we protect it
- All traffic between the apps, our servers and Shopify uses HTTPS (TLS).
- Staff access to the merchant dashboard is limited by role, and sensitive actions can require approval. Changes are written to an audit log.
- Store access tokens and other credentials are kept in an encrypted secret store, and the dashboard session is encrypted.
- Shopper email addresses used for matching are stored as one-way hashes. Contact-form and newsletter emails are stored encrypted.
- Personal data in Shopify webhook messages, appointment bookings, quotes and contact messages is encrypted by the application before it is stored. Backups are encrypted and a copy is kept on a second server. The server disk itself is not encrypted. Staff reads of customer personal data are recorded in the audit log.
- Test and development work never uses production data.
How long we keep it
- Shopper data is kept while the merchant uses the app. Order history stays in the merchant's Shopify store; we keep only the summary fields listed above.
- A shopper who deletes their account in the shopping app has their data removed from our systems straight away, apart from commercial records that are made anonymous (for example quotes and appointment slots).
- Raw Shopify webhook messages, which can contain customer details, are kept for 30 days and then deleted.
- When a merchant uninstalls the app we stop syncing, and delete the store's data 30 days later. Copies the merchant has exported to their own tools or destinations are in the merchant's hands and cannot be recalled by us.
- When a shopper asks a merchant to erase their data and Shopify sends us a redaction request, we delete or anonymise that shopper's personal data within 30 days, unless the law requires us to keep it.
- When a merchant uninstalls the Shopify app, Shopify sends us a shop redaction request 48 hours later, and we then delete that store's Shopify data within 30 days.
- Merchants can ask us to delete their account and data at any time by writing to the address below.
Your rights
Shoppers can ask for a copy of their data, a correction or deletion. The quickest route is to contact the store whose app you use, or delete your account inside the app; we will help the merchant answer the request. Merchants and their staff can contact us directly. We reply within 30 days.
Children
Lyrakart Customer Mobile App is not meant for children under 18. We do not knowingly collect data from children. If you believe a child has used it, write to us and we will delete their data.
Changes
If we change this policy we will update the date above. Significant changes will be shown in Lyrakart Customer Mobile App before they take effect.
Contact and grievances
PRS CLOUD TECH PRIVATE LIMITED
Email: info@lyrakart.com
H-65, Sector 63, Noida, India 201301