ListShield Privacy Policy

Last updated: July 6, 2026

ListShield ("the App") is a Shopify app provided by Concordance Labs ("we", "us"). It helps merchants add EU GPSR product-safety compliance information to their store. This policy explains what data the App accesses, why, and how it is handled.

What we access and store

• Store data via the Shopify Admin API — products, and the compliance records you create (manufacturers, EU responsible persons, and product safety metafields). This data is stored in your own Shopify store as metaobjects and metafields; we read and write it only to provide the App's features.
• Session/authentication tokens — an offline access token and session record (keyed to your shop domain) so the App can stay connected to your store. These are stored in our database.

What we do NOT collect

• We do not collect, store, or process your customers' personal data.
• We do not access order or customer records.
• We do not handle payment information — billing is processed by Shopify.

Sub-processors

• Shopify — platform and hosting of your store data.
• Vercel — application hosting.
• Neon — database hosting for session records.

Data retention & deletion

Session records are deleted when you uninstall the App. We also honor Shopify's mandatory GDPR webhooks: customers/data_request and customers/redact (we hold no customer data, so there is nothing to return or redact) and shop/redact (we delete your shop's session records). Compliance metaobjects/metafields live in your Shopify store and are removed with your store data by Shopify.

Your rights

You can request access to, correction of, or deletion of the limited data we hold (session records) at any time by contacting us. Uninstalling the App removes our stored session data.

Changes

We may update this policy; the "last updated" date reflects the latest version. Material changes will be communicated where appropriate.

Contact

Questions about this policy or your data: terry@concordancelabs.com.

ListShield is a tool that helps you meet EU GPSR requirements. It does not constitute legal advice and does not certify legal compliance.