Privacy Policy — Change Radar: Catalog Alerts
Last updated: 10 November 2026
1. Who we are
"Change Radar: Catalog Alerts" (the "App") is a Shopify app provided by Dobeo, operated by Ricardo Carapeto, Rua Zamenhof 4 2 dto, 2830-325 Barreiro, Setúbal, Portugal. For the data described here we act as a processor on behalf of the merchant who installs the App, and as a controller for the account and billing data we need to run the service.
Contact: support@dobeo.com. Emergency contact: +351 961288048.
2. Summary
- The App reads products and variants only, with the Shopify
read_productspermission. It never changes your store. - It does not access orders or customers and does not request Protected Customer Data.
- We do not sell data, do not show ads and do not use your data to train AI or machine-learning models.
3. Information we collect
3.1 From your Shopify store (through Shopify APIs and webhooks)
| Data | Purpose | Retention |
|---|---|---|
| Catalog data: product and variant IDs, titles, handles, status, publication date, vendor, product type, tags, options, SKUs, barcodes, prices, compare-at prices, inventory policy, taxable flag, total inventory, media count. For descriptions and media, only their length or count and a fingerprint, never the text or files | Detect changes, show the change history, keep the last known data of deleted products | Last state: while the App is installed. Deleted products: your plan's history period |
| Change history (old value → new value, rule, severity, time) | Timeline, alerts, digests, CSV export | Your plan's history period (Starter 30 days, Pro 365 days), purged daily |
| Store domain, time zone, plan and subscription status | Identify your store, send digests at 8:00 local time, provide your plan | While the App is installed |
| Shopify access and refresh tokens | Read your catalog | Encrypted (AES-256-GCM) while the App is installed; deleted on uninstall |
3.2 From you
| Data | Purpose | Retention |
|---|---|---|
| Email addresses of the alert recipients you add (members of your team, not your customers) | Send alerts, digests and test emails | Until you remove them or your store's data is deleted. Unsubscribed addresses are kept as "unsubscribed" so they are not emailed again |
| Alert settings (rules, thresholds, digest frequency) | Run the alerts the way you chose | While the App is installed |
3.3 Automatically
| Data | Purpose | Retention |
|---|---|---|
| Email log: kind of email, number of recipients and changes, delivery status. Never the body or the addresses | Daily limits and diagnostics | 90 days |
| Hashed IP address (salted) on the unsubscribe page | Rate limiting | 24 hours |
| Technical logs of our hosting provider (no tokens, no email addresses) | Security and debugging | Up to 7 days |
4. Information we do not collect
Orders, customers, buyers' personal data, payment data, staff accounts, themes, discounts or store settings. The App does not use cookies of its own and has no analytics or advertising trackers.
5. How we use information
Only to provide the App: detect catalog changes, keep the history, send the emails you configured, apply your plan's limits and support you. Not for profiling, advertising or AI training.
6. Sharing and service providers (sub-processors)
| Provider | Service | Data |
|---|---|---|
| Shopify | Platform, billing | Data received from Shopify; subscription status |
| Cloudflare, Inc. | Hosting (Workers), database (D1), queues | All data in §3 |
| Resend | Email delivery | Recipient address, email content (change summaries) |
We do not sell or rent data. We may disclose data if required by law.
7. International transfers
Our providers may process data outside your country, including in the United States, under the Standard Contractual Clauses (SCCs) and other contractual safeguards those providers offer.
8. Retention and deletion
- History is purged daily according to your plan. Email logs are kept for 90 days. Technical logs are kept for up to 7 days.
- Uninstall: processing stops immediately and the Shopify sessions are deleted.
- 48 hours later, when Shopify sends the
shop/redactrequest, every record of your store is deleted from our database. If you reinstall the App before that request arrives, your data is kept. - You can ask for earlier deletion at support@dobeo.com.
9. Security
Encrypted tokens at rest (AES-256-GCM), HMAC-verified webhooks, signed one-click unsubscribe links, least-privilege permissions (read_products only), secrets kept out of the code.
10. Your rights
Depending on where you live (for example under the GDPR or the CCPA), you can ask for access, correction, deletion, restriction or portability of your data, and object to processing. Write to support@dobeo.com. You can also complain to your data-protection authority, including the Comissão Nacional de Proteção de Dados (CNPD) in Portugal.
We are established in Portugal, in the European Union, so we do not appoint a separate EU representative under Article 27 of the GDPR.
11. Customers of merchants
The App does not process data of your store's customers. Shopify's customers/data_request and customers/redact requests are answered with no data, because there is none.
12. Emails
Every email says why it was sent, links to this policy and has a one-click unsubscribe link (RFC 8058).
13. Children
The App is for businesses and is not directed at children.
14. Changes to this policy
We will update the date above and, for material changes, tell merchants in the App or by email.
15. Contact
Dobeo, operated by Ricardo Carapeto
Rua Zamenhof 4 2 dto, 2830-325 Barreiro, Setúbal, Portugal
Email: support@dobeo.com
Emergency contact: +351 961288048
See also the Terms of Service.