Rateful privacy policy

Last updated: 2026-09-23

What we collect

When a merchant installs Rateful we store the shop domain, shop name and contact email, and an access token to call the Shopify API for that shop.

When an order is fulfilled we store the order number, the customer’s email and first name, and the products in the order, so we can send one review request email.

When a shopper writes a review we store the rating, text, the name they enter and, for review requests, their email.

How we use it

Only to collect, moderate and display reviews for the merchant’s store, and to send the review request emails the merchant turned on. We never sell data or use it for advertising.

Public reviews show the reviewer’s first name and last initial. Emails are never shown on the storefront.

Sub-processors

• Shopify (platform and billing)
• Our hosting and database provider, where data is stored
• Resend, which delivers review request emails

Retention and deletion

Shoppers can stop review requests with the link in every email. When Shopify tells us a customer asked to be forgotten we remove their name and email from reviews and delete their review requests. When a merchant uninstalls, all shop data is deleted 48 hours later when Shopify sends the shop redaction request.

Contact

Questions or data requests: contact the store you bought from, or email the address on our Shopify App Store listing.