Size Chart privacy policy

Effective date: 7 September 2026. This is the published policy for the Size Chart Shopify app and its Online Store 2.0 theme app extension.

Operator: Benetti Corporation, a Texas C-Corporation
Contact email: benettimedia@gmail.com
Mailing address: Benetti Corporation, 1401 Lavaca Street #40044, Austin, TX 78701, USA
Governing jurisdiction: Texas, USA

1. Scope

This policy covers information processed when a merchant installs or uses Size Chart, creates or imports charts, assigns charts to products or collections, exports charts, or uses Shopify-managed billing. It also covers chart content rendered on a merchant’s storefront.

The theme extension does not contain a shopper input form, browser storage, analytics call, or network request in the audited JavaScript. Its script only opens and closes the chart dialog. The Liquid block reads a merchant-selected chart and renders title, measurements, units, and fit note.

2. Information the app processes

• Shop and session information — shop domain; session identifier and state; granted scopes; token and refresh-token fields; Shopify-supplied expiry; and, for online sessions, merchant-user fields such as user ID, name, email, locale, and account flags. Used to authenticate the shop and call Shopify APIs.
• Size-chart content — title, handle, fit note, units, labels, and measurement cells. Stored in the merchant’s Shopify store as an app-owned metaobject.
• Product and collection information — resource IDs, handles, titles, and the Size Chart assignment metafield.
• Public storefront setup check — an anonymous GET of one assigned product page on the merchant’s own public storefront. The app inspects the HTML only for the size-chart block’s public markup. The app does not request read_themes, does not read theme files, and reads no customer data. The HTML is inspected in process memory and discarded; a conclusive result may be reused for five minutes in process memory and is not written to Firestore or to the session store.
• Managed-pricing information when pricing enforcement is enabled — shop ID and domain; billing period; trial and cycle dates; cancellation state; plan handle, amount, currency, and active state. Read from Shopify; cached in process memory for 30 seconds, capped at 1,000 shops.
• Compliance-webhook audit information — webhook ID, shop domain, topic, disposition, timestamps, and a TTL-eligibility timestamp. The audited persistence code does not store the webhook payload.
• CSV request information — selected CSV contents, a SHA-256 preview digest, a short request identifier, parsed fields, and validation results. Held in request memory. The audited routes do not write the upload to app-managed persistent storage.
• Application error information — Shopify SDK warning/error text after redaction, and a generic name for an unexpected CSV-import failure.

Configured scopes are read_metaobject_definitions, write_metaobject_definitions, write_metaobjects, and write_products. The audited code does not query Shopify customer records. It still implements the three mandatory privacy webhooks: customers/data_request, customers/redact, and shop/redact.

The billing path checks Shopify-managed subscription status. It does not contain a card-number or bank-account form.

3. How the information is used

• authenticate the merchant’s Shopify shop and maintain the app session;
• create, read, update, delete, import, export, and render size charts;
• assign or unassign charts to products and collections;
• verify whether the size-chart block is visible on the merchant’s own public storefront;
• verify Shopify-managed plan access when pricing enforcement is enabled;
• process uninstall, scope-update, and privacy-compliance webhooks;
• diagnose failures using the limited logging described below.

4. Where information is stored or sent

Shopify

Chart content and assignment references live in the merchant’s Shopify store. When managed-pricing enforcement is enabled, the app also reads subscription details from Shopify.

Google Cloud Firestore

In production, Shopify sessions and compliance-webhook audit records are stored in Google Cloud Firestore in Google Cloud project benetti-shopify-prod, database (default), location nam5 (United States multi-region). Session documents store shop domain, session fields, an update timestamp, and expiresAt only when Shopify supplies an applicable expiry. Audit documents store the Section 2 audit fields including required expiresAt.

Local development and tests use Prisma with SQLite instead of production Firestore. SQLite does not provide the production TTL service.

Google Cloud Run and Cloud Logging

The app runs as the Cloud Run service size-chart in region us-central1 of the same project. Cloud Run request logs and the application’s own diagnostic output are routed to the Cloud Logging bucket size-chart-runtime and are retained for 1 day. A log-sink exclusion keeps those entries out of the project’s 30-day _Default bucket, so 1 day is the effective runtime-log retention. Google Cloud administrative-activity audit logs, which record configuration changes made by the operator rather than merchant activity, are retained by Google for 400 days in the _Required bucket and cannot be shortened. Access to all of the above is controlled by Google Cloud IAM on the benetti-shopify-prod project, which is used by this app only.

Request memory

CSV import content is held in request memory. Export responses use Cache-Control: no-store.

Support email

Support and privacy correspondence goes to benettimedia@gmail.com, a Google-operated mailbox read only by Benetti Corporation. There is no ticket system, chat widget, or support database, and no Size Chart code path connects to that mailbox. A message stays in it until the operator deletes it, and a sender can ask for their correspondence to be deleted using the same address.

5. Storefront chart content

When the merchant enables the theme app extension, the selected chart can appear on product pages. Product assignment is checked first; a collection assignment can be used as a fallback. Merchants should not put personal information or secrets into chart fields because those fields are intended for public display. The app does not automatically detect such content.

Home setup step 4 is an anonymous GET of one assigned product page on the merchant’s own public storefront. Finding the block marker proves a shopper sees the chart. The app does not request read_themes and reads no customer data for this check.

6. Retention and deletion

Firestore time-to-live policies are provisioned on the expiresAt field of both the shopify_sessions and shopify_compliance_audits collection groups, so Google Cloud deletes a document after the timestamp the app wrote. A document with no expiresAt deliberately does not expire; it is removed by the handlers described below.

• Charts and assignments remain under the merchant’s Shopify store lifecycle. Uninstall and shop-redaction handlers do not call Shopify to remove charts or assignments.
• Expiring sessions use Shopify-supplied expiry. The app does not invent a terminal session date. Uninstall deletes sessions for the shop. shop/redact deletes and verifies them again.
• Ordinary compliance receipts expire 90 days after original receipt. Retries do not extend that date.
• Shop-redaction completion receipt expires 30 days after original receipt, with the shop field replaced by a redacted marker.
• Runtime logs are deleted by Google Cloud 1 day after they are written.
• CSV has no app-managed persistent upload store.

Chart deletion requires the merchant to type the exact handle and a fresh exhaustive scan that finds zero assignment references. The app does not perform partial cleanup.

7. Requests and merchant choices

Merchants can export charts and assignments to CSV, edit a chart, unassign it, or delete it. Shopify sends the three mandatory privacy webhooks to the configured compliance endpoint. For customer topics, the current handler records that the app holds no Shopify customer record to furnish or erase.

For a manual privacy or data request, contact benettimedia@gmail.com. The operator answers such a request within 30 days. The rights that apply to a given request depend on the law of the requester’s jurisdiction.

8. Security-relevant controls evidenced by code

Admin routes authenticate through Shopify. Webhook requests are authenticated before dispatch. Declared scopes are limited. Production sessions are stored in a durable backend and deleted on uninstall. Recognized Shopify identifiers and credentials are redacted in the SDK logging path. This is not a certification or a claim about encryption, backups, region, or incident response.

9. Changes

If data categories, purposes, storage, providers, retention, or merchant controls materially change, this page is updated before or with that change, and the effective date at the top is moved forward.

10. Contact

Privacy and data requests: benettimedia@gmail.com
Mail: Benetti Corporation, 1401 Lavaca Street #40044, Austin, TX 78701, USA
Governing jurisdiction: Texas, USA