Your data and the review workflow.

Who handles the information?

Rootmade is a trading name of Home Design Shops B.V., Edisonstraat 33, 2723 RS Zoetermeer, Netherlands. Registration: KvK 76250946. VAT: NL827745035B03.

For reviews and order-related customer information, the Shopify merchant determines why the information is processed. Rootmade processes that information to provide the merchant’s review service. Rootmade handles its own business contacts and support correspondence for account management and support.

What information is used?

• Store domain, installation and account information, selected settings and subscription status.
• Product and order identifiers, fulfilment or delivery information and the customer contact details needed for review invitations.
• Submitted ratings, review text, optional attribute scores, display name, photo/video uploads, merchant replies and product questions.
• Import files, exports, delivery statuses, moderation records and technical information needed to operate and protect the service.
• Information you choose to include in a support email.

Why is it used?

We use this information to operate review invitations, connect feedback to products, show approved reviews, handle imports and exports, manage subscriptions, respond to support and privacy requests, and protect the service from misuse. A merchant is responsible for having an appropriate basis for using customer information and sending invitations. Rootmade uses business-contact information to provide its service and support, manage its business and meet applicable obligations.

What is public?

Approved reviews can show the chosen display name, review content, ratings, media, replies and relevant product information. Customer email addresses, order records, private notes and provider credentials are not part of the public review display. Avoid putting private information in review text or media.

Photos and videos are stored in the merchant’s Shopify Files. Shopify serves these files through publicly accessible links, even before a review is approved. Moderation controls what the review widgets display, not whether a file link can be opened.

Services involved

Shopify provides the store connection and app billing. Default email delivery uses Resend. When you connect Klaviyo or an outgoing webhook, the information needed for that workflow is sent to the service you configure. Those services have their own terms and privacy notices.

If a merchant turns on optional AI assistance and connects their own OpenAI API key, review text is sent to OpenAI for moderation and classification. Recognisable contact details are removed first where detected. AI does not decide whether a review is published. OpenAI processes this under the merchant’s own OpenAI account and terms.

If a merchant opts in to app analytics, Rootmade sends Google Analytics a random identifier together with plan and subscription changes: the plan, the previous plan, the plan price and the billing state. No store domain, contact details or customer data are included. The merchant can withdraw this choice in the app at any time, and uninstalling withdraws it automatically.

The application and its stored data are hosted with TransIP and Supabase in the European Union.

Some service providers process information outside the country where you or your customers live. Applicable data-processing arrangements and transfer safeguards must be established for the services used. See Resend’s privacy notice for its processing details.

Retention and deletion

Reviews remain part of the merchant’s review records until removed or handled through a privacy request. The app’s configured cleanup period applies to operational records such as stored import files, exports and invitation data; its default is 365 days. This is not automatic deletion of all reviews after one year. Customer data exports expire after seven days.

While the app is installed, deleting a review or its media, or processing a privacy request, also removes the file from the merchant’s Shopify Files. After uninstalling, any remaining files stay in the store’s Shopify Files, where the merchant can remove them.

Rootmade processes Shopify customer and store redaction requests and provides merchant data-management tools. Deletion can require retrying remote storage cleanup. Provider records and legally required business records may follow separate retention requirements.

When a merchant uninstalls the app, the store’s data is erased after Shopify’s shop-erasure request, about 48 hours later, apart from the backup period described below.

Deleted data can remain in protected backups until they expire, within 7 days.

Your choices and rights

Contact the store for access, correction, deletion or other requests relating to its customer reviews. You may also contact Rootmade, and we will help route and handle the request. We may need to verify identity and the relevant store. Depending on applicable law, you may have rights to access, correct, erase, restrict or object to processing, receive a copy of information, or withdraw consent. You may complain to your local data-protection authority.

Website and security

This website currently does not load Google Analytics or place analytics cookies. We do not use advertising trackers. The Shopify App Store listing has its own consent controls and can report completed installations. Optional app analytics has a separate choice in the app and measures confirmed trial and subscription changes, not payment receipts. Website, listing and app measurements are not guaranteed to identify the same visitor. The hosting service may keep technical request logs. The Shopify app and its providers use the authentication and technical storage required to operate their services. Access controls, encrypted provider credentials and store separation are part of the application’s safeguards.

Changes and contact

We update this notice when the service or its processing changes. Contact hello@rootmade.app with questions.