Redoubt Privacy Policy

Last Updated: January 20, 2025

Thank you for choosing Redoubt ("we," "us," or "our"). We are committed to protecting your personal information and respecting your privacy. This Privacy Policy describes how Redoubt collects, uses, discloses, and safeguards data—including data relating to customers of Shopify stores—that we obtain through our cybersecurity monitoring and backup services ("Services"). Our Services help secure Shopify webshops and back up key Shopify store data (e.g., customer and product data).

This policy complies with Shopify's Protected Customer Data Requirements and relevant data privacy regulations, including the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA).

1. Scope and Acceptance

By using our Services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with the practices described here, please do not use our Services. This Privacy Policy applies to data collected through:

• The Redoubt app on the Shopify App Store.
• Any related services, websites, or communications directly connected with Redoubt.

2. Information We Collect

We collect information to provide and improve our Services, including:

2.1 Shopify Store Data

When you install or use our App, we automatically connect to your Shopify store to access certain data, which may include:

• Store Information: Store name, domain, contact information, and settings required for our backup and security monitoring functions.
• Product Data: Product names, descriptions, images, pricing, variants, and inventory data.
• Customer Data: Customer names, email addresses, shipping addresses, order histories, and other customer-related information ("Protected Customer Data").
• Order Data: Order IDs, transaction details, line items, shipping methods, payment information (excluding full payment card details), and fulfillment status.
• Theme Data: Theme templates, layout files, customization settings, images, and other assets associated with your store's design and branding.

We only collect and store this information to the extent necessary to perform backups, provide security monitoring, and comply with our obligations under Shopify's Protected Customer Data Requirements.

2.2 Usage Data

When you interact with our Services, we collect certain technical information for security monitoring and analytics purposes, such as:

• IP address
• Browser type
• Operating system
• Date and time of access
• Log data and events related to our security monitoring services

2.3 Communication Data

If you contact us via email, support tickets, or other channels, we may keep a record of your communication and any personal data you provide therein.

3. How We Use Your Information

We use the data we collect for the following purposes:

• Backup Services: To perform secure backups of your Shopify store data, including product and customer information, so that it can be restored if needed.
• Security Monitoring: To detect, investigate, and prevent threats, breaches, or unauthorized access to your Shopify store.
• Improving Our Services: To understand how our Services are used, address performance issues, and enhance functionality.
• Communication: To provide you with updates, support, and other information related to our Services.
• Legal Compliance: To comply with applicable laws, regulations, and contractual obligations, and to respond to lawful requests from authorities when required.

4. Legal Basis for Processing (GDPR Purposes)

Under the EU General Data Protection Regulation (GDPR), our legal bases for processing customer data include:

1. Performance of a Contract: We process data to provide our backup and security services.
2. Legitimate Interests: We process data for fraud prevention, improving our Services, and security monitoring.
3. Consent: Where required by law or in certain marketing contexts, we may process your data based on your explicit consent.

5. How We Share Your Information

We do not sell or rent your personal information. We may share information as follows:

• Service Providers & Sub-Processors: We may share data with trusted third parties that perform functions on our behalf (e.g., cloud storage, analytics, security monitoring). We contractually require these third parties to safeguard personal data and use it only for purposes consistent with this Privacy Policy.
• Legal Obligations: We may disclose data if required by law, subpoena, or a valid governmental request. We will make reasonable efforts to notify you of such requests where permissible.
• Business Transfers: In the event of a merger, acquisition, or sale of assets, data may be transferred as part of the transaction, subject to confidentiality obligations.

6. Data Retention

We retain data as long as necessary to:

• Provide our Services (backups, security monitoring).
• Comply with legal obligations.
• Resolve disputes.
• Enforce our agreements.

If you uninstall our App or otherwise request deletion, we will securely delete your data in accordance with applicable laws and our internal data retention policy, unless we are legally required to retain it.

7. Data Security

We take the security of your information seriously. We use industry-standard measures to protect the data we handle, such as:

• Encryption at Rest and In Transit: We use TLS/SSL encryption to secure data in transit and employ industry-standard encryption protocols for data at rest.
• Access Controls: We limit access to databases and systems containing personal data to authorized personnel only, and we enforce strict role-based permissions.
• Secure Storage: Backups and other stored data reside on secure, monitored infrastructure with strong network-level protections.
• Ongoing Monitoring: We regularly review logs, perform vulnerability assessments, and update security configurations to address emerging threats.

While we implement robust security measures, no data transmission or storage system can be guaranteed to be 100% secure. We encourage you to also take steps to protect your data, such as limiting unauthorized access to your Shopify admin account.

8. International Data Transfers

We operate primarily within the European Economic Area, but some of our third-party providers or sub-processors may be located in other countries with data protection laws different from those of your country of residence. When we transfer data internationally, we do so under lawful transfer mechanisms (such as Standard Contractual Clauses) designed to ensure an adequate level of data protection.

9. Your Rights and Choices

Depending on your jurisdiction, you may have rights regarding your personal information, including:

• Right to Access: You can request a copy of the personal data we hold about you.
• Right to Rectification: You can ask us to correct any inaccurate data.
• Right to Erasure: You can request deletion of your data, subject to legal or contractual restrictions.
• Right to Object: You can object to the processing of your data under certain conditions.
• Right to Restrict Processing: You can request limitations on how we process your data in certain scenarios.
• Right to Data Portability: You can request a copy of your data in a structured, machine-readable format.

To exercise these rights, please contact us at info@redoubt.dk. We may request certain information to verify your identity before processing your request.

10. Children's Privacy

Our Services are not directed to children under the age of 16, and we do not knowingly collect or solicit personal information from children. If you believe a child under 16 has provided personal data through our Services, please contact us immediately.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we do, we will revise the "Last Updated" date at the top of this page. We encourage you to review this Privacy Policy periodically to stay informed about how we protect your data.

12. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us at:

• Email: info@redoubt.dk

We are committed to working with you to obtain a fair resolution of any complaint or concern about privacy. If, however, you believe that we have not been able to assist with your concern, you have the right to lodge a complaint with your local data protection authority.

By using Redoubt's Services, you consent to the collection, use, disclosure, and protection of information as described in this Privacy Policy.