Privacy Policy

This Privacy Policy describes how Wezy ("we", "us", or "our") collects, uses, and shares personal information when you install or use any of our Shopify applications, including but not limited to:

• Wezy Wholesale & Volume Discounts — B2B pricing, volume discounts, and checkout validation.
• Wezy Request Quote, Hide Price — Hide product prices, collect quote requests, negotiate with customers, and manage draft orders.
• Wezy Tax Exempt — EU VAT validation (VIES), US sales tax exemption certificates, and automated B2B checkout tax exemption.

By installing or using any Wezy Shopify application, you agree to the collection and use of information in accordance with this policy.

Support conversations

For Wezy Customer Voting support, you can email wesy@wezy.app or open our external Crisp messenger from the Jira Service Management support page. Crisp processes the messages, contact details and attachments you submit through its messenger so we can respond to your request. Crisp may also process connection and device information as described in its privacy policy.

The Forge app does not load Crisp or automatically send Jira requests, voting data or Atlassian account identifiers to Crisp. Support messages and files you choose to submit are processed separately from the app's Forge storage. Please remove private customer details from screenshots and do not send passwords, API tokens or complete data exports. Contact wesy@wezy.app for questions or requests concerning your support conversation.

Wezy Customer Voting for Jira Service Management

This section covers Wezy Customer Voting for Jira Service Management Cloud. Sections 1–11 below cover the separate Shopify products. The JSM Marketplace launch is in preparation; the installed version and edition determine available features.

Data and purposes

The app processes Atlassian account identifiers for customers, agents and administrators; Jira issue, project, service desk and organization identifiers; voting states and organization attribution; settings, segments, weights and scoring versions; event times, command references, revisions and technical processing metadata. These records are stored in the installation's Forge SQL database to manage authorized voting, reconstruct current state and available history, synchronize demand metrics, and process recovery and erasure.

The app checks current Jira Service Management request access and Jira project permissions. It reads request titles and statuses, request types, field metadata and eligible organizations for authorized app views and operations. An agent may register their account for organization reads on their behalf. Forge permissions also allow access and organization checks on a recorded user's behalf outside an active session, within Atlassian's authorization rules. These checks do not grant users additional Jira access or change request sharing.

Views, fields and exports

Portal customers see their own voting state, eligible organization choices and the voting counts made available for accessible requests. Agent views show authorized demand metrics and organization information. Advanced analytics may include organization segments, weights and available historical comparisons. Normal voting and analytical views do not display voter account identities.

Wezy writes only numeric demand metrics to its read-only Jira fields. Those fields follow Jira permissions and can be read through issue views, APIs, JQL and exports; aggregates can reveal demand patterns by inference. Customer account identifiers and organization names are not written to those numeric fields.

Authorized agents can download current or analytical CSV files according to their edition and access. Administrative recovery exports may contain account identifiers, organization identifiers, voting events, configuration and technical metadata. Permissions, licenses and request access are rechecked during delivery. Files are assembled in the recipient's browser; downloaded copies remain under their control and cannot be recalled by the app. Recipients should restrict access and delete copies when no longer needed.

Retention and automatic maintenance

Daily analytical snapshots are retained for 90 days in Standard and up to 365 days in Advanced, subject to available coverage and the documented 30-day recovery period after a confirmed downgrade. Current voting state, first-activation anchors and records needed for retained history can remain during the installation's lifetime unless an authorized erasure removes them. An upgrade does not recreate deleted history.

Automatic maintenance builds and verifies compacted archives before replacing eligible raw journal entries. The raw-event compaction target is 35 days, subject to processing checkpoints and complete coverage. Compaction is not erasure of all data older than 35 days. Retained copies, current state and minimal non-personal sequence headers can remain after compaction. Maintenance can require several runs and can be deferred when license, privacy, processing or capacity checks prevent safe progress. Uninstallation and hosted-data availability follow the applicable Atlassian Forge lifecycle; no indefinite restoration is promised.

Erasure and account reporting

The app periodically reports stored Atlassian account identifiers to Atlassian's privacy service. Closed or updated account responses queue account erasure. Authorized project administrators can request erasure of a request's or organization's Wezy data; authorized Jira administrators can request account erasure across projects. During an open erasure, affected Wezy views and exports are unavailable. Maintenance removes or rewrites affected source records and derived copies, then neutralizes and reads back the app's Jira numeric fields before reopening the project. Processing may need multiple runs. The Jira request itself is not deleted, and a previously published field value is not claimed to disappear instantly.

Hosting and support

Read our JSM security and data handling policy, also available in French.

App execution and stored voting data use Atlassian Forge. The current app manifest declares no external data egress. The app does not send Jira Service Management voting data to Shopify, advertising services or AI providers. The external email and Crisp support channels process information users choose to submit separately from Forge data, as explained in the support conversations notice. Please remove private details from screenshots and never send passwords, API tokens or complete customer exports.

For data requests or questions, contact wesy@wezy.app. Product guides are available in English and French.

1. Information We Collect

1.1 Store & Merchant Information

When you install a Wezy app, we access information from your Shopify store through Shopify's API, including:

• Store name, domain, and contact email
• Product and collection data (titles, prices, tags, vendors)
• Order and draft order information
• Current Shopify plan information

1.2 Customer Information

When end-customers interact with our storefront widgets (e.g., quote request forms, tax exemption forms, VAT validation fields), we may collect:

• Name, email address, phone number
• Company name, business registration, and shipping/billing address
• Tax identification numbers (EU VAT numbers, US state tax exemption IDs, resale certificate numbers)
• Messages and custom form field responses
• Uploaded files and documents (tax exemption certificates, resale permits, quote documents)

1.3 Automatically Collected Data

• Browser type and IP address (for spam protection via Cloudflare Turnstile)
• App usage data (features used, pages visited within the admin interface)

2. How We Use Your Information

We use the information we collect to:

• Provide and maintain our services — processing quote requests, managing pricing rules, validating VAT numbers, managing tax exemption certificates, creating draft orders, and sending notifications.
• Tax exemption validation & compliance — validating EU VAT numbers via official EU VIES services, verifying and storing US tax exemption certificates, and applying appropriate tax exemptions at checkout.
• AI-powered features — our AI Lead Scoring feature analyzes quote request data (message content, form completeness, email patterns) to generate a lead quality score. This processing is automated and does not involve human review of individual submissions.
• Negotiation Portal — storing conversation history between merchants and their customers for price negotiation purposes.
• Communication — sending transactional emails (quote confirmations, certificate approvals/rejections, renewal reminders, status updates) on behalf of the merchant.
• Spam protection — verifying form submissions using Cloudflare Turnstile.
• Improve our services — understanding usage patterns to enhance app features and performance.
• Billing — managing subscriptions through Shopify's billing system.

3. Data Sharing & Third Parties

We do not sell, rent, or trade your personal information. We may share data with:

• Shopify — as required to operate within the Shopify platform (API calls, billing).
• European Commission VIES — for real-time validation of European VAT numbers.
• Cloudflare — for Turnstile anti-spam verification and Cloudflare R2 secure encrypted cloud storage for uploaded documents and certificates.
• Email delivery services — to send transactional email notifications configured by the merchant (SMTP providers selected by the merchant).
• Webhook endpoints — if the merchant configures CRM integrations (e.g., Zapier, Make), data is sent to endpoints defined and controlled by the merchant.
• AI processing — quote data may be processed by third-party AI services for lead scoring. No personally identifiable information is retained by these services beyond the processing request.

4. Data Retention

We retain merchant and customer data for as long as the app is installed on the store. When a merchant uninstalls a Wezy app:

• All store-specific data (rules, quotes, form configurations, email templates, validations) is permanently deleted within 30 days.
• Uploaded files and certificates associated with uninstalled stores or redacted customers are permanently deleted in compliance with Shopify GDPR webhook protocols.
• Anonymized, aggregated analytics data may be retained for service improvement purposes.

5. Data Security

We implement industry-standard security measures to protect your data, including:

• HTTPS encryption for all data in transit
• Secure, encrypted database connections
• Shop-scoped data isolation (merchants can only access their own data)
• HMAC-SHA256 signed webhook payloads
• Input validation and XSS protection on all user inputs

6. GDPR & Your Rights

If you are located in the European Economic Area (EEA), you have the following rights:

• Right of access — request a copy of your personal data.
• Right to rectification — request correction of inaccurate data.
• Right to erasure — request deletion of your personal data.
• Right to restrict processing — request limitation of data processing.
• Right to data portability — request your data in a structured, machine-readable format.
• Right to object — object to processing based on legitimate interests.

Our apps include an optional GDPR consent checkbox on storefront forms, allowing merchants to comply with local privacy regulations. Merchants are responsible for enabling this feature as required by their jurisdiction.

To exercise any of these rights, please contact us at support@wezy.app.

7. CCPA (California Residents)

If you are a California resident, you have the right to know what personal information we collect, request its deletion, and opt out of its sale. We do not sell personal information.

To make a request, contact us at support@wezy.app.

8. Cookies

Our Shopify applications do not use tracking cookies. Session data required for app functionality is managed through Shopify's authentication system. If Cloudflare Turnstile is enabled, it may set cookies necessary for bot detection.

9. Children's Privacy

Our services are not intended for use by individuals under the age of 16. We do not knowingly collect personal information from children.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify merchants of significant changes through the app dashboard or via email. Continued use of our apps after changes constitutes acceptance of the updated policy.

11. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us: