Contact Me! Privacy Policy
Effective date: 2 November 2026 Provider: Fancylab, a California, USA company ("Fancylab", "Contact Me!", "we", "us", or "our") Contact: support@fancylab.com
This policy explains how Contact Me! processes information when a Shopify merchant installs or uses the app, and when a person submits a form displayed on a merchant's storefront. This is a product notice, not legal advice. Merchants remain responsible for their own notices, lawful bases, consent, retention, and responses to people who submit forms.
Roles
For merchant account, installation, billing, support, and app-operation information, Fancylab is generally the controller or independent business. For customer submissions, the merchant decides why and how information is collected; the merchant is generally the controller or business and Fancylab processes the data to provide Contact Me!. Shopify operates its platform under its own terms and privacy documentation.
Information processed
We may process:
- shop domain, shop name, shop email, Shopify IDs, installation status, scopes, OAuth sessions, billing status, support messages, and technical logs;
- form definitions, field labels and options, notification settings, email header/footer settings, and theme configuration;
- customer-submitted names, email addresses, phone numbers, free text, choices, dates, URLs, and other fields selected by the merchant;
- file metadata such as file name, type, and size. The current file-field implementation does not upload or retain file bytes;
- storefront page URLs, referrers, UTM values, advertising click identifiers, and attribution data where the merchant enables attribution;
- request metadata, including an IP address as observed by the app infrastructure, for short-lived rate limiting and abuse prevention. IP addresses are not stored in the submission record by the app.
Forms, submissions, settings, and app analytics are stored in Shopify metaobjects or shop metafields. MySQL stores Shopify OAuth sessions.
Purposes
We use information to authenticate merchants; provide forms, storefront rendering, submissions, inbox, analytics, and settings; validate submissions; prevent spam and abuse; send enabled transactional notifications; process bounces and spam complaints; provide support; maintain security and reliability; enforce agreements; comply with law; and process billing through Shopify.
We do not sell customer submissions or use them to build advertising profiles or send marketing campaigns for Fancylab.
Third parties
| Recipient | Purpose | Data |
|---|---|---|
| Shopify | Platform, authentication, Admin API, metaobjects, metafields, billing, storefront delivery | Merchant data, forms, submissions, settings, and configuration |
| Postmark | Transactional email delivery and bounce/spam-complaint events | Recipient address, rendered message, sender/reply-to details, shop identifier, delivery events |
| Hosting/infrastructure providers | Application runtime and OAuth-session storage | Sessions, logs, and request metadata |
We may disclose information when required by law, legal process, or a valid governmental request, or to protect rights, safety, security, or the service. Service providers may process information outside the person's country; where required, we use an applicable transfer mechanism and safeguards. [Insert specific countries and transfer details after legal review.]
Retention and deletion
Information is retained only as needed for the purposes above, the merchant's instructions, security, disputes, and legal obligations. Shopify-stored forms and submissions remain until the merchant deletes them, the app is uninstalled, a Shopify redaction workflow runs, or law requires otherwise. OAuth sessions are deleted on uninstall or shop-redaction processing. Email-provider records, suppression lists, and backups may remain for the provider's or security-related retention period before deletion.
Merchants can delete forms and submissions in the app. For a customer request about a submission, contact the merchant that collected it first. The merchant or customer may also contact support@fancylab.com; we may verify the request and coordinate with the merchant or Shopify.
Rights
Depending on applicable law, a person may have rights to access, correct, delete, restrict, object to, or receive a copy of personal information, withdraw consent, or complain to a regulator. Customer-submission requests should normally be made through the merchant; requests about information Fancy Lab controls directly may be sent to the contact above.
Security, children, and changes
We use HTTPS/TLS, Shopify authentication and signed app-proxy requests, scoped API permissions, validation, rate limiting, access controls, and deletion workflows. No system is completely secure. Contact Me! is not directed to children, and merchants must not knowingly collect children's information unlawfully.
We may update this policy when the service or law changes. The effective date will be updated. Questions may be sent to support@fancylab.com or [insert Fancylab's complete California postal address].