Privacy policy
Locora is a Shopify app by LooLon that adds a store locator to a store: a map and list of the merchant's shops, stockists or dealers. This policy explains what data Locora processes for merchants and for shoppers.
Shoppers
- No personal data is stored. Locora doesn't store names, emails, IP addresses or positions of shoppers, and has no access to the store's orders or customers.
- Searching – when a shopper searches for a town or postcode, the text is sent to our server to find the place on the map. We count searches per day by the place found (for example “Leeds”), so the merchant can see where shoppers look. The words typed and anything about the shopper are not kept.
- Near me – the browser asks the shopper before sharing their position. The position is used in the browser only, to sort stores by distance, and is never sent to us.
- Maps – map pictures are loaded from OpenFreeMap (tiles.openfreemap.org) and the map library from unpkg.com, like any web page loads images. These services see the shopper's IP address as part of a normal web request.
- Locora sets no cookies and uses no advertising or tracking.
Merchants
- When a merchant installs Locora, we store the shop domain, the store name and contact email, the access token Shopify gives the app, the locations the merchant adds (names, addresses, phone numbers, websites, opening hours of their business locations) and the locator design.
- Addresses of the merchant's locations are looked up with Photon (komoot) or Nominatim (OpenStreetMap) to place them on the map.
- Billing for Locora is handled by Shopify. We receive no card or bank details.
Where data is processed
Locora's server runs in the European Union (Germany). Emails are sent through Google Workspace.
Security
- All traffic uses HTTPS (TLS). Daily backups are encrypted (AES-256), kept for 30 days and then deleted.
- Only the Locora team can access store data, for support. Every such access is logged. Server access uses SSH keys only.
Security incidents
If we learn of a security incident that affects personal data, we contain it immediately, investigate it and notify the affected merchants without undue delay, within 72 hours at the latest.
Deletion
- When a merchant uninstalls Locora, the app loses access immediately and the locator stops showing. All data for the store is deleted after Shopify's shop-redact request, 48 hours after uninstalling.
- Customer data requests and deletions need no action, because Locora keeps no customer data.
Your rights
Anyone can write to contact@loolon.com with a privacy question.