1. Operator and contact details
NexLevel Apps is operated by Jurate Pasekaite under the NexLevel Apps name, Piazza del Borgo 13/A, 62017 Porto Recanati (MC), Italy.
Privacy questions and rights requests can be sent to federika.paseke@gmail.com.
2. Our role
Shopify merchants normally act as controller or business for store information processed on their instructions. NexLevel Apps normally acts as their processor or service provider for that information.
NexLevel Apps acts as controller for website enquiries, app subscriptions, billing records, security logs, support correspondence, and its own legal and business records.
3. Website and support information
Our hosting provider may process standard request information such as IP address, browser type, requested page, timestamp, and security or diagnostic logs. Support forms process the name, email address, Shopify shop domain, topic, and message you choose to send.
We use Google Analytics 4 to understand website visits and performance. Analytics storage is denied by default and is enabled only if you select “Allow analytics.” Your preference is stored in browser local storage and can be changed through “Analytics preferences” in the footer.
4. Shopify app information
Our Shopify apps may process the shop domain, authorised merchant and product information, app configuration, subscription status, import or activity records, and the minimum technical data required to provide, secure, and support the selected feature. The exact data depends on the app and permissions approved during installation.
Shopify data is used only to operate, secure, support, and improve the relevant app. We do not sell Shopify merchant or customer information.
5. Import Pilot
Import Pilot processes supplier product URLs submitted by merchants who confirm they own, license, or are authorized to use the product information. This may include titles, descriptions, images, vendor, product type, prices, currency, options, variants, SKUs, and barcodes. It also stores merchant-scoped import history, status, error details, and resulting Shopify product identifiers.
Source products are used to prepare merchant-reviewed Shopify drafts. Import Pilot does not require credentials for the source website. Optional AI tools may improve or translate copy, but they do not invent prices, variants, SKUs, barcodes, or other product facts.
6. AI Receptionist
If AI Receptionist is enabled, the service may process shopper questions, relevant Shopify catalogue information, merchant-approved guidance, conversation context, and support handoff details needed to provide the feature. Relevant content may be sent to the configured AI provider to generate an answer.
Merchants control the source information and should not include passwords, payment-card data, or unnecessary sensitive information in approved guidance.
7. Providers and international transfers
Providers may include Shopify for app installation, APIs, and billing; Vercel for website and app hosting; Neon for production database services and backups; OpenAI for AI Receptionist when enabled; Google Analytics for consent-based website measurement; and email infrastructure for support delivery.
Providers may process information in the European Economic Area, United States, or other countries where they or their subprocessors operate. Where required, transfers rely on an adequacy decision, the EU-US Data Privacy Framework for participating organisations, or appropriate contractual safeguards.
8. Purposes and legal bases
- To install apps, deliver selected features, manage subscriptions, and provide support: performance of our contract with the merchant.
- To secure, troubleshoot, monitor, and improve the service: our legitimate interests in operating a reliable business service.
- To measure website usage through Google Analytics: consent, which remains denied unless allowed.
- To answer privacy requests and retain required records: compliance with legal obligations.
9. Retention and deletion
- App configuration and merchant-scoped operational records are retained while needed to provide the service.
- Shopify app data is deleted or anonymised following uninstall and applicable Shopify privacy requests, subject to limited legally required retention.
- Support correspondence is normally retained for up to 24 months after the last substantive contact.
- Security and diagnostic logs are normally retained for no more than 90 days unless needed to investigate an incident.
- Financial records may be retained for the period required by applicable Italian law.
10. Security and merchant choices
We use HTTPS, encrypted production secrets, access controls, signed webhook validation, tenant-scoped data operations, and restricted production access. No internet service can guarantee absolute security. Never send passwords, API secrets, payment information, or unnecessary customer information in a support message.
11. Your rights
Depending on applicable law, you may have rights to access, correct, delete, restrict, or object to processing and to receive a portable copy. You may lodge a complaint with the Garante per la protezione dei dati personali or another competent authority.
12. Changes
We may update this policy as our Shopify apps, providers, or legal requirements change. Material changes will be communicated through the website, app, or another appropriate channel.