Privacy Policy

Last updated: 28 August 2026

Priorly keeps a history of your catalog so you can put it back. It never sees your customers, it sells nothing to anyone, and everything it stores is a copy of content you already own. The rest of this page is the detail behind those three sentences.

It covers what happens when a merchant installs the app and when anyone writes to us at support@veristock.app.

1. The short version

Priorly requests access only to the catalog content it keeps history of — products, collections, pages, and blog posts — and the permission to write that content back when a merchant restores an earlier version. It does not request access to Shopify customer, order, checkout, or payment data, and cannot read them.

It processes limited personal data about the merchant’s staff — the name and email Shopify supplies for the account that installs the app — and the technical information needed to run and secure the service.

We do not sell personal data, share it for cross-context behavioural advertising, or use it to train AI models. There is no third-party analytics, advertising, or session-replay provider anywhere in the app. We keep a short record of our own of which parts of the app a shop used — described in 3.5 — and it goes no further than our database.

2. Our role and the merchant’s role

For catalog content processed on a merchant’s instructions — the saved versions of products, collections, pages, and blog posts, and the records of what was restored — the merchant decides why it is processed. The merchant is the controller; Priorly is its processor.

We act as an independent controller only for what we process for our own purposes: administering the installation, operating and securing the service, responding to support requests, and complying with law.

3. What we process

3.1 Merchant and installation

• the shop’s myshopify.com domain;
• Shopify shop and installation identifiers;
• the name, email address, and Shopify user ID of the staff account that installs the app, as supplied by Shopify;
• an access token issued by Shopify, used only for the approved scopes;
• app session and authentication records;
• which paid plan, if any, the shop is on;
• anything a merchant chooses to send us by email;
• if — and only if — a shop turns on any of the email notices: the address it asked us to write to, which notices it asked for, the moment it asked, the language the app was being used in at the time, and when each kind was last sent.

3.2 Catalog history

• the state of each product, collection, page, and blog post at the moment it changes — titles, descriptions, prices, image references, collection membership, publication state, and the rest of what the merchant wrote into their own catalog;
• when each change happened and how we learned of it;
• periodic snapshots of the whole catalog, taken to catch changes a notification never arrived for, and honest records of the windows where something may have been missed;
• records of restores: what was put back, when, and the values it replaced, so a restore can itself be undone.

This is the merchant’s business content. It becomes personal data only where a merchant has written personal information into their own catalog — a founder’s story on a page, a name in a blog post — and Priorly stores it exactly as written, for the merchant, and for nothing else.

3.3 Logs and error reports

Our hosting provider keeps a short record of each request — which page was asked for, whether it worked, and how long it took.

When the server hits an error, a report goes to Sentry: the error, its stack trace, the route, and the environment name. Sentry is configured not to collect the extras it can — no IP address, no user identity — and performance tracking is switched off entirely. There is no Sentry SDK in the browser at all — so no session replay, no screenshots, and no breadcrumbs are collected from a merchant’s browser.

3.4 Email we send

Priorly sends four kinds of email, each of which a shop asks for separately, and none of which is sent to a shop that has asked for nothing: that Priorly stopped recording and some versions were missed; a weekly summary of what changed; a notice before older versions reach the end of the plan's window and are removed; and a notice that a run of changes was recorded, with a link to the period it covers. There is no newsletter, no product news, and no other message of any kind.

All of it is off until someone turns it on from the app’s dashboard, where the address is theirs to enter and correct and each kind is a separate choice. Every message carries a link that stops them without signing in, and turning them off inside the app does the same. Each kind has its own limit — at most one a day, one a week, or one every few hours, depending on what it is about — however much happens.

We do not track whether an email was opened or a link in it was clicked. There is no tracking pixel, no rewritten link, and no image of any kind in the message.

3.5 Which parts of the app are used

We keep a short record of what happens inside the app: the shop domain, a word for the thing that happened — the app was opened, a screen was viewed, a file of history was downloaded, a plan was chosen or cancelled, a request was refused — when it happened, and a few numbers such as how many rows a download came to. It is written to our own database and sent to no analytics service.

It is how we can tell that a shop installed Priorly, never opened a single version, and left — which is the difference between fixing something and guessing. Where a merchant was turned away because their plan does not include what they asked for is recorded for the same reason.

It holds no product name, no field value, nothing typed into the app, and nothing about a person. Nothing is recorded about the catalogue itself here: the saved versions and restore records described above already hold that, and this record is not a copy of them. It is deleted with the rest of the shop’s data when the app is uninstalled.

4. What we do not request from Shopify

At install, Priorly asks for four permissions and no others: to read and write products, and to read and write pages and blog posts — collections travel with products. It has no access to customer names, contact details, addresses, orders, checkouts, payment details, card information, or inventory levels.

The write permissions exist for one reason: restoring an earlier version means writing it back. Priorly writes to the catalog only when a merchant asks it to restore something, and never writes anywhere else.

If the scopes change, we will update this policy before using anything newly accessible for a new purpose.

5. Why, and on what legal basis

Where we act for a merchant, we process on that merchant’s instructions and the merchant identifies its own legal basis.

Where we act for ourselves, under the GDPR and UK GDPR we rely on performance of a contract for providing and administering the app, and on our legitimate interests in securing the service, preventing abuse, diagnosing faults, and defending legal claims. We do not rely on consent unless we ask for it.

6. Cookies

Priorly sets no cookies of its own. No advertising cookies, no cross-site tracking, no third-party tag, pixel, or analytics script. The app runs inside the Shopify admin and relies on Shopify’s own session cookies, described in Shopify’s documentation.

7. Who we share it with

This is the complete list of providers that process anything:

Beyond these, we disclose information only where required by law or a valid legal request, to protect the rights and safety of Priorly, merchants or users, or in connection with a sale of the business under appropriate safeguards.

We do not sell personal data, share it for cross-context behavioural advertising, use it for targeted advertising, or use merchant or catalog data to train AI models.

8. Where the data is

Priorly runs in the United States. Information from the EEA, the United Kingdom, Switzerland, or elsewhere is therefore transferred to and processed in the United States, whose data-protection laws differ from those where it came from.

Our hosting provider participates in the EU–US, UK, and Swiss–US Data Privacy Frameworks. Our providers publish data-protection terms for their services, including standard contractual clauses for transfers out of the EEA, the United Kingdom, and Switzerland.

If you need a data-processing agreement or details of the safeguards that apply to your own compliance work, write to support@veristock.app.

9. How long we keep it

When the app is uninstalled:

1. Shopify notifies us and we delete the access token and app sessions immediately;
2. about 48 hours later Shopify asks us to erase the shop’s data;
3. we delete everything remaining for that shop — every saved version, every restore record, and the history of what changed;
4. backup copies go with the 5-day rotation.

Priorly answers all three of Shopify’s mandatory compliance webhooks. Because it holds no Shopify customer data, the answer to the customer-related ones is that we hold none.

10. Security

• everything travels over an encrypted connection, and the database is encrypted where it is stored;
• messages that claim to come from Shopify are checked to be genuine before anything is acted on;
• the app writes to the catalog only when a merchant asks it to restore something, and every restore records what it replaced, so it can be undone;
• passwords and keys are held by the hosting platform, not written into the app;
• the app asks Shopify for the least it can work with, and holds no customer, order, or payment data to lose in the first place.

No internet service is completely secure and we cannot promise otherwise. If you think you have found a security problem, write to support@veristock.app.

11. Your rights

Depending on where you are, you may have the right to access your personal data, get a copy, correct it, have it deleted, restrict or object to processing, ask for portability, withdraw consent where consent was the basis, complain to a data-protection authority, and appeal a refusal.

To exercise any of them, write to support@veristock.app. We may need to verify who you are and what information you mean. Every request is read and answered by a person.

A merchant does not have to wait for us for the everyday case: uninstalling the app starts the deletion described in section 9.

We aim to answer within the period the law requires; under the GDPR and UK GDPR that is generally one month, with permitted extensions.

People in the EEA or the UK may complain to the data-protection authority where they live or work, or where they believe something went wrong.

12. United States

Where United States state privacy laws apply: we collect the categories in section 3, use them for the purposes in section 5, and disclose them to the recipients in section 7. We do not sell personal data, share it for cross-context behavioural advertising, process it for targeted advertising, or knowingly use sensitive personal data to infer characteristics. Eligible individuals may exercise access, correction, deletion, portability, opt-out, and appeal rights by writing to support@veristock.app. We will not discriminate against anyone for exercising a privacy right.

13. Automated decisions

Priorly does not profile anyone or make automated decisions with legal or similarly significant effects.

14. Changes

We will update the date at the top when this changes. Where a change materially affects how personal data is processed, we will tell merchants with the app installed.

15. Contact

For privacy, security, support, or data-rights requests: support@veristock.app