1. Operator and contact details
NexLevel Apps is operated by Jurate Pasekaite under the NexLevel Apps name, Piazza del Borgo 13/A, 62017 Porto Recanati (MC), Italy.
Privacy questions and rights requests can be sent to federika.paseke@gmail.com.
2. Our role
Shopify merchants normally act as controller or business for store information processed on their instructions. NexLevel Apps normally acts as their processor or service provider for that information.
NexLevel Apps acts as controller for website enquiries, app subscriptions, billing records, security logs, support correspondence, and its own legal and business records.
3. Website and support information
Our hosting provider may process standard request information such as IP address, browser type, requested page, timestamp, and security or diagnostic logs. Support forms process the name, email address, Shopify shop domain, topic, and message you choose to send.
We use Google Analytics 4 to understand website visits and performance. Analytics storage is denied by default and is enabled only if you select “Allow analytics.” Your preference is stored in browser local storage and can be changed through “Analytics preferences” in the footer.
4. Shopify app information
Our Shopify apps process the shop domain, authorised merchant account data made available by Shopify, product and collection data needed for the selected feature, app configuration, subscription status, and operational records such as import, migration, activity, delivery, or error records. The exact data depends on the app and permissions approved during installation.
Shopify data is used only to operate, secure, support, and improve the relevant app. We do not sell Shopify merchant or customer information. Import Pilot does not request access to customer or order data.
5. Import Pilot
Import Pilot processes supplier product URLs submitted by merchants who confirm they own, license, or are authorized to use the product information. This may include titles, descriptions, images, vendor, product type, prices, currency, options, variants, SKUs, barcodes, inventory availability, delivery quotes, and resulting Shopify product identifiers. It stores merchant-scoped import, favorite-monitoring, activity, queue, and error records needed to operate the app.
When a merchant connects an AliExpress Dropshipping account, Import Pilot stores the authorised account identifier, account label, expiry information, and encrypted OAuth access and refresh tokens. These credentials are used only to retrieve supplier data and delivery quotes requested by that merchant. Import Pilot never collects an AliExpress password.
For Shopify-to-Shopify migration, Import Pilot stores a short-lived connection record between the source and destination shop and processes the selected source products, collections, metafields, inventory settings, and translation data needed to create merchant-reviewed drafts in the destination shop. Source products are used to prepare merchant-reviewed Shopify drafts; Import Pilot does not publish products automatically.
Optional AI copy improvement and translation send the product text and merchant-provided brand guidance selected for that request to OpenAI. We retain the minimum usage and token-accounting information required to enforce the merchant's AI credit allowance. AI tools do not invent prices, variants, SKUs, barcodes, or other product facts.
6. AI Receptionist
If AI Receptionist is enabled, the service may process shopper questions, relevant Shopify catalogue information, merchant-approved guidance, conversation context, and support handoff details needed to provide the feature. Relevant content may be sent to the configured AI provider to generate an answer.
Merchants control the source information and should not include passwords, payment-card data, or unnecessary sensitive information in approved guidance.
7. Providers and international transfers
Providers may include Shopify for app installation, APIs, billing, and mandatory privacy webhooks; AliExpress for the merchant-authorised supplier connection and requested supplier data; Vercel for website and app hosting; Neon for production database services and backups; OpenAI for optional AI features in Import Pilot and AI Receptionist; Frankfurter for currency-rate conversion; Google Analytics for consent-based website measurement; and email infrastructure for support delivery.
Providers process information only to provide their services to us. They may process information in the European Economic Area, United States, or other countries where they or their subprocessors operate. Where required, transfers rely on an adequacy decision, the EU-US Data Privacy Framework for participating organisations, or appropriate contractual safeguards.
8. Purposes and legal bases
- To install apps, deliver selected features, manage subscriptions, and provide support: performance of our contract with the merchant.
- To secure, troubleshoot, monitor, and improve the service: our legitimate interests in operating a reliable business service.
- To measure website usage through Google Analytics: consent, which remains denied unless allowed.
- To answer privacy requests and retain required records: compliance with legal obligations.
9. Retention and deletion
- App configuration and merchant-scoped operational records are retained only while needed to provide the service.
- When Import Pilot is uninstalled, we delete its merchant-scoped operational records, queued migration data, saved supplier records, encrypted AliExpress OAuth credentials, Shopify connection records, delivery settings, billing and usage records, and app sessions from our production database.
- We also delete applicable shop data when Shopify sends a mandatory shop-redaction request. Import Pilot does not store customer or order records; authenticated customer-data requests and customer-redaction requests are acknowledged without retrieving customer data.
- Support correspondence is normally retained for up to 24 months after the last substantive contact.
- Security and diagnostic logs are normally retained for no more than 90 days unless needed to investigate an incident. Financial records may be retained for the period required by applicable Italian law.
10. Security and merchant choices
We use HTTPS, encrypted production secrets, encryption for stored AliExpress OAuth credentials, access controls, signed Shopify webhook validation, tenant-scoped data operations, and restricted production access. No internet service can guarantee absolute security. Never send passwords, API secrets, payment information, or unnecessary customer information in a support message.
11. Your rights
Depending on applicable law, you may have rights to access, correct, delete, restrict, or object to processing and to receive a portable copy. You may lodge a complaint with the Garante per la protezione dei dati personali or another competent authority.
12. Changes
We may update this policy as our Shopify apps, providers, or legal requirements change. Material changes will be communicated through the website, app, or another appropriate channel.