Privacy Policy

Effective date: 8 September 2026

This Privacy Policy describes how SN Labs (“we”, “us”, “our”) collects, uses, and shares information in connection with the Shopify application Bolt B2B Lock (listing name: Bolt B2B Lock, Password Protect), hosted at https://app.boltlock.pro.

Questions: support@boltlock.pro

1. Who this policy covers

Merchants install Bolt B2B Lock from the Shopify App Store or Shopify admin. We process merchant account and shop data to run the app.

Shoppers (customers and visitors on a merchant’s storefront) may have limited data processed so locks can evaluate access (for example customer tags, email, or country). We process shopper data on behalf of the merchant, using Shopify APIs and the merchant’s storefront.

Shopify is a separate controller for data on the Shopify platform. This policy covers our processing as the app developer.

2. Information we collect

From merchants (Shopify admin / OAuth)

Shop domain and Shopify shop identifiers
OAuth access tokens and session records (including staff name and email when Shopify provides them)
App settings you configure (messages, cookie TTL, fail-open/fail-closed, login URL)
Locks and checkout rules you create (names, product/collection/page targets, unlock conditions, error text)
Theme embed status (whether Bolt B2B Lock is enabled on the live theme)

From Shopify APIs (to operate locks)

Products, variants, collections, vendors, product tags — to target locks (read_products)
Pages, blogs, articles — to target content locks (read_content)
Themes — to detect if our theme app embed is on (read_themes; we do not write theme files)
Customers, customer tags, email, phone, segments — only as needed to evaluate unlock rules and checkout extra filters you configure (read_customers, Protected Customer Data)
Checkout validations — to publish cart validation rules (read_validations, write_validations)

We do not request write_customers or read_markets. Location unlock uses Shopify storefront country (Liquid localization), not GPS and not the Admin Markets API.

From storefront visitors (when a lock runs)

Whether the visitor is signed in, and Shopify customer id when present
Email, tags, company/location ids, cart contents, and similar fields you chose as unlock or checkout conditions
Country code from Shopify localization
IP address when you use an IP unlock rule, and to hash anonymous eval events
Passcode attempts submitted to our app proxy (compared to a stored hash)

Automatically

Hosting and request logs from our infrastructure provider (Railway)
Optional lock-evaluation records: decision, lock ids, page type, country, and a hashed visitor identifier — not used for an Insights dashboard
Copies of Shopify GDPR/compliance webhook payloads needed to fulfill those requests

We do not collect payment card numbers. The app does not charge merchants and does not process shopper payments.

3. How we use information

Authenticate the embedded admin and keep Shopify sessions
Compile and publish lock snapshots and checkout validation rules to the shop
Evaluate storefront access (hide price, hide products, overlays, passcodes, secret links)
Block matching checkouts via Shopify’s cart validation function
Respond to merchant support requests
Comply with Shopify mandatory webhooks and applicable law
Maintain security, debug outages, and prevent abuse

We do not sell personal information. We do not use shopper data to advertise to shoppers across other merchants’ stores. We do not run third-party advertising pixels in this app.

4. Cookies and similar storage

Merchant admin: Shopify session tokens / cookies required to keep you signed into the embedded app.

Storefront (on the merchant’s shop domain): if a shopper unlocks with a passcode or secret link, we set a first-party cookie (or equivalent) so the unlock can persist. Lifetime follows the merchant’s Visitor cookie TTL setting (default 30 days).

Secret links use a signed token in the URL query parameter access.

5. Passcodes and secret links

Merchant-configured passcodes are stored so the merchant can manage them in the app, and are hashed for storefront verification. Secret-link tokens are signed. We do not use shopper Shopify account passwords; login is handled by Shopify.

6. Sharing

We share information only:

Shopify — to read shop data you authorize and to write checkout validations / app-owned metafields needed for locks
Infrastructure — Railway (application hosting) and PostgreSQL (app database) under our account
The merchant — configuration and support; shopper data is processed to enforce rules the merchant created
Legal / safety — if required by law, Shopify policy, or to protect the app, merchants, or shoppers

We do not sell or rent personal information.

7. International processing

The app and database are hosted on Railway. Data may be processed in the United States and other regions where our providers operate. If you access the app from the EEA, UK, or similar jurisdictions, you instruct us to process shop and shopper data as needed to provide the app.

8. Retention

While installed: shop, lock, checkout-rule, session, and related records for as long as the app is installed and needed to operate it
App uninstall: we delete Shopify sessions and mark the shop uninstalled
Shopify shop/redact: we delete the shop record and remaining session rows for that shop
Shopify customers/redact: we delete customer access-request records matching that customer id or email
Eval events: operational logs of lock decisions with hashed visitor identifiers; not a merchant-facing analytics product

Backups of our database, if any, expire on our host’s backup cycle. Theme app embeds are removed by Shopify when the app is uninstalled; we do not leave ScriptTags or theme-file edits behind.

9. Shopify GDPR / compliance webhooks

We subscribe to Shopify’s mandatory topics, validate HMAC signatures on the raw request body, and return HTTP 200 promptly:

customers/data_request — we record the request and will provide relevant app-held data via support@boltlock.pro
customers/redact — we delete matching customer records we store
shop/redact — we delete shop and session data after uninstall, as Shopify requires
app/uninstalled — we delete sessions and mark the shop uninstalled

Invalid signatures receive HTTP 401.

10. Your rights

Merchants: you can access or update lock configuration in the app, uninstall the app, or email us to request deletion of app-held shop data (subject to Shopify’s uninstall/redact timing).

Shoppers: contact the merchant first. Shopify routes GDPR customer requests to installed apps; we honor customers/data_request and customers/redact. You may also email support@boltlock.pro with the shop domain and enough detail to locate records.

Depending on your location you may have rights to access, correct, delete, or restrict processing, or to lodge a complaint with a supervisory authority.

11. Children

The app is for Shopify merchants operating online stores. It is not directed at children under 16. We do not knowingly collect personal information from children.

12. Security

Access tokens are stored in our database and used only to call Shopify APIs for your shop. Admin access uses Shopify OAuth / session tokens. Passcodes are hashed for storefront checks. HTTPS is required for the app origin. No method of transmission or storage is 100% secure.

13. Changes

We may update this policy. The effective date above will change. Material changes will be reflected at https://app.boltlock.pro/privacy.

14. Contact

SN Labs
App: Bolt B2B Lock
Email: support@boltlock.pro
App URL: https://app.boltlock.pro