Privacy policy — Lilya: POS Gift Receipts

This policy describes how Lilya: POS Gift Receipts (“the app”) handles data when a Shopify merchant installs and uses it. The app is made by Lilya Work. Contact: support@lilya.work.

Who this applies to

The app is used by merchants and their staff in the Shopify admin and in Shopify POS. It prints gift receipts for POS orders on the store’s receipt printer. It does not store personal data about the merchant’s customers.

Data the app accesses

When you install the app you grant it the Shopify permissions read_orders and write_files. With them the app:

• Reads an order when staff print gift receipts for it: the order number, order date, order ID and its line items (product title, variant title and quantity). It does not read prices, customer names, addresses, e-mail addresses or payment details.
• Reads your store name and time zone, to print them and to date the receipt.
• Uploads the logo you choose in the app settings to your store’s Files, so it can be printed on the receipt.

Data entered in POS

Staff can type an optional recipient name and gift message for each receipt. They are sent to the app only to draw that receipt, printed, and then discarded. The app does not save them and does not write them to its logs.

Data the app stores

• Your store’s myshopify.com domain and the access token Shopify gives the app.
• Your plan and trial status, and the number of gift receipts printed per month (for the free plan limit).

Your receipt settings (texts, return deadline, barcode option, logo address) are saved in your own Shopify store as app data, not on our servers. The logo stays in your store’s Files.

How the data is used

Only to provide the app’s features: printing gift receipts, keeping your settings, and applying your plan. We do not sell data, use it for advertising, or share it with third parties other than the service providers below.

Service providers

• Cloudflare, Inc. runs the app and stores its data (Workers and D1 database, Western Europe). Error logs contain your store domain and are kept by Cloudflare for a few days.
• Shopify processes billing through Shopify App Pricing. The app asks Shopify’s Partner API which plan your store is on.

Retention and deletion

• When you uninstall the app, its access token is deleted and the app stops working in your store.
• 48 hours after you uninstall, Shopify asks us to erase your store’s data (shop/redact) and the app deletes its plan and usage records for your store. If you reinstall within those 48 hours, they are kept.
• Shopify removes the app’s settings data from your store when the app is uninstalled. Your logo stays in Files until you delete it.
• Shopify’s customer data requests (customers/data_request and customers/redact) are answered, but there is nothing to return or delete because the app stores no customer data.

Security

Admin requests are authenticated with Shopify session tokens and POS requests with POS session tokens. Data is sent over HTTPS only. A receipt can only list items that are on the order, because the app reads the order again from Shopify before printing.

Your rights

You can ask for a copy of the data the app holds about your store, or ask us to delete it before you uninstall, by writing to support@lilya.work. You can also complain to the data protection authority where you live.

Changes

If we change this policy we update the date at the top of this page.