# Privacy Policy — Bulk Product Image Manager

**Last updated:** 26/05/2026

## 1. Data controller

This Shopify application (« Bulk Product Image Manager », hereafter
« the App ») is published by:

WEST WEB AGENCY
150 Allée de l’Airial, 40150 Angresse
Company registration: 84248987400011
Contact: contact@west-web-agency.fr

## 2. Data processed

The App processes Shopify **store data only**. It does not access
any **end-customer data** (the store’s own customers, orders or
payments).

When in use, the App reads and writes the following data through
the Shopify Admin API:

– Product catalogue (titles, handles, descriptions, types, vendors, tags)
– Variants (SKUs, variant options)
– Product images and their ALT tags
– Product and variant metafields
– Collections and product memberships

The App stores the following data on its own servers:

– Shopify session (encrypted access token, shop identifier)
– Subscription state (current plan, status, key dates, Shopify
charge identifier)
– Monthly upload counter per shop (number of images uploaded)
– A technical language-preference cookie (`locale`)

## 3. Purposes

This data is processed for the following purposes:

– Providing the App’s features (bulk image upload, ALT-tag editing,
catalogue audit)
– Managing the paid subscription and enforcing monthly quotas
– Authenticating requests from the Shopify admin interface

## 4. Legal basis

Processing is based on the **performance of the contract** between
WEST WEB AGENCY and the merchant who installs the App (GDPR article
6.1.b).

## 5. Recipients

Data is not shared with any third party except the technical
sub-processors strictly necessary to operate the App:

– **Shopify Inc.** — intermediary for the Admin API and webhooks
– OVH — hosting provider for the App

No data is sold, monetised, or transmitted to marketing partners.

## 6. International transfers

Data may transit through Shopify infrastructure, which is hosted
partially outside the European Union. Shopify maintains GDPR-compliant
contractual safeguards for these transfers (standard contractual
clauses).

## 7. Retention

– **Active session**: for the entire duration of the App’s
installation on the store
– **Subscription and counter data**: for the entire installation period
– **After uninstallation**: Shopify triggers a `shop/redact` webhook
48 hours after final uninstall. The App then **irreversibly deletes**
all shop data (session, subscription, counters).

## 8. Merchant rights

In accordance with GDPR articles 15 to 22, merchants have the
following rights:

– Right of access to their data
– Right to rectification
– Right to erasure (« right to be forgotten ») — uninstalling the App
triggers automatic erasure within 48 hours
– Right to restriction of processing
– Right to object
– Right to data portability

These rights may be exercised by writing to contact@west-web-agency.fr.

## 9. Complaint

Merchants may lodge a complaint with the French Data Protection
Authority (CNIL — Commission Nationale de l’Informatique et des
Libertés, 3 place de Fontenoy, 75007 Paris, France, www.cnil.fr)
if they consider the processing of their data to be non-compliant
with regulations.

## 10. Cookies

The App sets only one technical cookie named `locale`, which stores
the merchant’s preferred interface language (French or English).
This cookie is strictly necessary for operation and is not used for
tracking purposes.

## 11. Security

Data is stored on secure servers. Shopify access tokens are
encrypted at rest. Communications with the Shopify API and the
merchant’s browser use HTTPS exclusively.

## 12. Policy changes

This policy may be updated to reflect legal or functional changes.
The last-updated date appears at the top of the document. Merchants
are encouraged to review it periodically.

## 13. Contact

For any question regarding this policy or the processing of your
data: contact@west-web-agency.fr