Legal

Privacy Policy

Last Updated: July 20, 2026

This Privacy Policy explains how Re Gallery ("Company," "we," "us," or "our") collects, uses, discloses, and safeguards information in connection with the Re Gallery Shopify application (the "App"), and any related websites, dashboards, or support services (collectively, the "Service"). This Privacy Policy applies to merchants who install the App on their Shopify store ("Merchant," "you") and, where applicable, to visitors and customers of a Merchant's store who interact with galleries created through the App.

By installing, accessing, or using the App, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with the practices described here, please do not install or use the App.

1. Introduction

Re Gallery is a Shopify application that enables Merchants to build and manage image galleries, video galleries, lookbooks, and product showcase displays; organize and customize visual content; apply AI-powered media enhancements; and review gallery engagement analytics. To provide these features, the App interacts with certain data made available through the Shopify platform, as well as data generated through use of the App itself.

We are committed to handling personal data responsibly and in accordance with applicable data protection laws, including the General Data Protection Regulation ("GDPR"), the UK GDPR and Data Protection Act 2018, the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA/CPRA"), and Shopify's own privacy and API requirements for partner applications.

This Privacy Policy is designed to be read alongside Shopify's own Privacy Policy and Terms of Service, which govern the Shopify platform independently of the App.

2. Definitions

For the purposes of this Privacy Policy:

• "Personal Data" means any information relating to an identified or identifiable natural person.
• "Merchant" means the Shopify store owner or authorized user who installs and configures the App.
• "Customer" or "Visitor" means an end user who browses or interacts with a Merchant's storefront, including any gallery, lookbook, or showcase created using the App.
• "Processing" means any operation performed on Personal Data, including collection, storage, use, disclosure, or deletion.
• "Service Provider" or "Sub-processor" means a third-party vendor engaged by us to support the operation of the App.
• "Shopify APIs" means the Admin API, Storefront API, and related interfaces through which the App reads or writes store data with Merchant authorization.

3. Information We Collect

We collect information in three general categories: (a) information obtained from Shopify with the Merchant's authorization, (b) information generated automatically through use of the App, and (c) information the Merchant or its authorized users may provide to us directly, such as through support requests. We do not require Customers or store Visitors to create an account with us, and we do not knowingly collect Personal Data directly from Customers outside of what is necessary to render gallery content and record aggregate engagement metrics described below.

We collect only the categories of data reasonably necessary to deliver the features a Merchant has enabled, consistent with Shopify's data minimization expectations for App Store listings.

4. Information Collected from Shopify

When a Merchant installs the App and grants the relevant permissions, we may access the following data through Shopify's APIs:

Store Information

• Store name
• Store URL / domain
• Shopify subscription plan
• Merchant account email address

Product Information

• Product titles
• Product images and media
• Product descriptions
• Product collections and associated metadata

We request only the access scopes required for the specific features a Merchant has enabled within the App. We do not request or use permissions unrelated to gallery creation, media display, customization, or the analytics functions described in this Policy. Merchants can review the specific scopes requested by the App on the App's permission screen at the time of installation and within the Shopify admin.

5. Information Collected Automatically

Usage Information

• App configuration and settings
• Gallery layout and configuration data
• Installation date and uninstallation date
• Feature usage analytics (e.g., which gallery types or tools are used)

6. How We Use Information

We use the information described above to:

• Operate, maintain, and provide the core functionality of the App, including gallery creation, media display, and customization tools;
• Provide AI-powered media enhancement features requested by the Merchant;
• Communicate with Merchants regarding support requests, service updates, billing, or changes to the App;
• Monitor, diagnose, and resolve technical errors and maintain the security and stability of the Service;
• Comply with legal obligations, enforce our terms, and protect the rights, property, or safety of the Company, our Merchants, or others;
• Improve and develop the App's features based on aggregated, de-identified usage trends.

We do not use Merchant or Customer data to build advertising profiles, and we do not use Customer data for our own marketing purposes.

7. Legal Basis for Processing (GDPR)

Where the GDPR or UK GDPR applies, we rely on the following legal bases to process Personal Data:

• Performance of a contract — processing necessary to provide the App's functionality to the Merchant under the applicable terms of service;
• Legitimate interests — processing necessary for App security, fraud prevention, diagnostics, and service improvement, provided such interests are not overridden by the rights of the data subject;
• Consent — where required, such as for certain analytics or cookie-based technologies, we rely on consent obtained by us or, where applicable, facilitated by the Merchant on the storefront;
• Legal obligation — processing necessary to comply with applicable law, such as tax or regulatory recordkeeping.

Where we act as a processor on behalf of a Merchant (who acts as the data controller for their store's Customer data), our processing is governed by our terms of service and, where applicable, a data processing addendum available upon request.

8. Cookies and Analytics

The App may use cookies, local storage, or similar tracking technologies within the Shopify admin interface and, where a Merchant enables gallery analytics, within the storefront gallery widget itself. These technologies are used to:

• Maintain App session state within the Shopify admin;
• Measure gallery engagement and performance, as described in Section 5;
• Support error monitoring and diagnostic tooling.

We may use reputable third-party analytics and error-monitoring providers to help us understand App usage and stability. Where storefront-facing cookies require Visitor consent under applicable law, the Merchant is responsible for ensuring appropriate consent mechanisms are in place on their store, and we provide reasonable technical support to facilitate compliant configurations. For more information about managing cookies generally, Visitors may consult resources such as www.allaboutcookies.org.

9. Data Sharing and Service Providers

We do not sell Merchant data or Customer data, and we do not share Merchant information with third parties for their own independent marketing purposes.

We may share data with trusted Service Providers who perform functions on our behalf, subject to appropriate confidentiality and data protection obligations, including:

• Cloud infrastructure and storage providers (e.g., Amazon Web Services) for hosting App data and media;
• Content delivery and security providers (e.g., Cloudflare) for performance and protection against malicious traffic;
• Shopify, as the platform through which the App operates and which independently processes data under its own privacy policy;
• Analytics providers, to help us understand aggregate App usage;
• Error monitoring and diagnostic services, to help us identify and resolve technical issues.

We may also disclose information where required to comply with applicable law, respond to lawful requests from public authorities, enforce our agreements, or protect the rights, property, or safety of the Company, our Merchants, or others, and in connection with a merger, acquisition, or sale of assets, subject to continued protection under a substantially similar privacy policy.

10. International Data Transfers

We and our Service Providers may process and store data in countries other than the Merchant's or Customer's country of residence, including the United States and other jurisdictions in which our infrastructure providers operate. Where Personal Data originating from the European Economic Area, the United Kingdom, or Switzerland is transferred to a country without an applicable adequacy decision, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses or equivalent transfer mechanisms, to ensure a comparable level of protection.

11. Data Security Measures

We implement administrative, technical, and organizational safeguards designed to protect Personal Data against unauthorized access, alteration, disclosure, or destruction, including:

• Encryption of data in transit using industry-standard protocols (e.g., TLS/HTTPS);
• Encryption of sensitive data at rest where supported by our infrastructure providers;
• Role-based access controls limiting internal access to Personal Data to authorized personnel with a legitimate business need;
• Routine monitoring, logging, and vulnerability management practices;
• Secure development practices for App updates and features.

No method of electronic transmission or storage is completely secure, and we cannot guarantee absolute security. We encourage Merchants to promptly report any suspected security concerns to us using the contact details in Section 22.

12. Data Retention

We retain Merchant and Customer data only for as long as necessary to provide the Service and fulfill the purposes described in this Privacy Policy, or as required by applicable law.

Unless a longer retention period is required for legal, tax, accounting, or dispute-resolution purposes, we delete or anonymize Merchant data and associated App configuration and gallery data within 30 days following App uninstallation. Aggregate or de-identified data that does not identify a Merchant or Customer may be retained for analytical or product improvement purposes beyond this period.

13. Merchant Rights

Merchants have the right to:

• Access the categories of Personal Data we hold in connection with their store and App usage;
• Correct inaccurate or incomplete data;
• Export their App configuration and gallery data in a portable format, where technically feasible;
• Delete their data, subject to the retention exceptions described in Section 12;
• Object to or restrict certain processing activities, where applicable law provides such a right.

Requests may be submitted using the contact information in Section 22. We will respond within the timeframes required by applicable law.

14. Customer Privacy Rights

Where the App processes limited, non-identifying engagement data relating to storefront Visitors (Section 5), the Merchant remains the data controller responsible for that store's Customer relationships. Customers wishing to exercise privacy rights regarding their interactions with a specific store should first contact that Merchant. We will support Merchants in fulfilling verified Customer requests relating to data processed through the App, consistent with our role as a service provider/processor.

15. GDPR Rights

If you are located in the European Economic Area, the United Kingdom, or another jurisdiction where the GDPR or UK GDPR applies, you have the right to:

• Request access to your Personal Data and information about how it is processed;
• Request rectification of inaccurate or incomplete Personal Data;
• Request erasure of your Personal Data ("right to be forgotten"), subject to legal exceptions;
• Request restriction of processing in certain circumstances;
• Request data portability, where technically feasible;
• Object to processing based on legitimate interests;
• Withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of prior processing;
• Lodge a complaint with your local data protection supervisory authority.

To exercise these rights, contact us at support@regallery.team. We may request information to verify your identity before fulfilling a request.

16. CCPA / CPRA Rights

If you are a California resident, you have the right, subject to certain exceptions, to:

• Know what categories of Personal Information we have collected, used, disclosed, or sold (we do not sell Personal Information);
• Access specific pieces of Personal Information collected about you;
• Delete Personal Information we have collected, subject to legal exceptions;
• Correct inaccurate Personal Information;
• Opt out of the sale or sharing of Personal Information — we do not sell or share Personal Information as those terms are defined under the CCPA/CPRA;
• Limit the use of sensitive Personal Information, to the extent applicable;
• Non-discrimination for exercising any of these rights.

To exercise these rights, contact us at support@regallery.team with the subject line "CCPA/CPRA Request." We will verify your identity using reasonable methods before processing your request and will respond within the timeframe required by law.

17. Data Deletion Requests

Merchants and, where applicable, Customers may request deletion of Personal Data at any time by contacting us at support@regallery.team. Upon a verified request, we will delete the relevant data within 30 days, except where retention is required to comply with a legal obligation, resolve disputes, enforce agreements, or as otherwise permitted by applicable law. Data is also automatically deleted within 30 days of App uninstallation, as described in Section 12.

18. Shopify Mandatory Webhooks Compliance

In accordance with Shopify's requirements for App Store applications, we implement and respond to Shopify's mandatory GDPR/compliance webhooks, including:

• customers/data_request — when a store's Customer requests access to their data, we will provide any relevant data held by the App to the Merchant or Shopify as required;
• customers/redact — when a request is received to delete a Customer's data, we will delete any corresponding Personal Data held by the App, subject to applicable legal retention requirements;
• shop/redact — 48 hours after a Merchant uninstalls the App (or as otherwise specified by Shopify), we will delete or anonymize the Merchant's store data held by the App, subject to the retention exceptions described in Section 12.

These webhook processes operate independently of, and in addition to, the direct deletion request process described in Section 17.

19. Children's Privacy

The App and Service are intended for use by Merchants operating commercial Shopify stores and are not directed at children. We do not knowingly collect Personal Data from individuals under the age of 16 (or the relevant age of digital consent in their jurisdiction). If we become aware that we have inadvertently collected such data, we will take reasonable steps to delete it.

20. Third-Party Services

The App may rely on or integrate with third-party infrastructure and service providers, including but not limited to Amazon Web Services (AWS), Cloudflare, Shopify, analytics providers, and error-monitoring services, to deliver core functionality, security, and performance. These providers process data on our behalf under contractual confidentiality and security obligations and do not independently use Merchant or Customer data for their own purposes beyond providing services to us. This Privacy Policy does not govern third-party services accessed independently by the Merchant or Customer, including Shopify's own platform, which maintains its own privacy policy.

21. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the App's features, or applicable law. Material changes will be indicated by an updated "Last Updated" date at the top of this page, and, where required by law, we will provide additional notice to Merchants. Continued use of the App after changes take effect constitutes acceptance of the revised Privacy Policy.

22. Contact Information

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

Re Gallery

Support inquiries: support@regallery.team

We aim to respond to all privacy-related inquiries within the timeframes required by applicable law.