Privacy Policy

Last updated: October 1, 2026

Prior versions of this notice are available on request. The version in effect on the date you entered into an agreement with us governs that agreement.

1. About this notice

Harris Digital (“Harris Digital,” “we,” “us,” or “our”) respects the privacy of the people whose personal information we handle. This notice explains what personal information we collect, why we collect it, how we use and share it, how long we keep it, and the rights and choices you have.

This notice applies to:

  • our website at harrisdigital.io and any other website or landing page we operate that links to this notice;
  • our marketing, sales, and support communications, including email and SMS;
  • the software applications and extensions we publish and distribute through ecommerce platform marketplaces, including the Shopify App Store and the Adobe Commerce (Magento) Marketplace (each such application, an “App”; each such platform and its marketplace, a “Platform”).

This notice does not apply to:

  • personal information we process on behalf of a client while delivering services under a signed statement of work or master agreement. In those engagements we act as a service provider or processor and handle personal information only on the client’s documented instructions. That processing is governed by our agreement with the client, including any data processing addendum, and by the client’s own privacy notice.
  • websites, platforms, applications, or services operated by third parties that we link to or integrate with. Those are governed by their own privacy notices, which we encourage you to review.

2. Our role

Whether we act as a “controller” (a “business” under U.S. state law) or as a “processor” (a “service provider”) depends on the activity:

Activity Our role
Our website, marketing, and sales communications Controller / business
Merchant account, configuration, support, and billing for our Apps Controller / business
Store, order, and buyer data accessed through a merchant’s store using a Platform’s APIs Processor / service provider, acting on the merchant’s instructions
Client data handled under a statement of work Processor / service provider, governed by the client agreement

3. Information we collect

3.1 Website visitors

Information you provide. Name, business name, job title, email address, telephone number, and the content of any message you send us, submitted through contact forms, quote requests, newsletter sign-ups, surveys, event registrations, and SMS opt-in.

Information collected automatically. IP address, browser type and version, operating system, device type, referring URL, pages viewed, time spent on pages, approximate location derived from IP address, and cookie and pixel identifiers.

We do not intentionally collect special category or sensitive personal information through our website, and we ask that you do not submit it through our forms.

3.2 Merchants who install our Apps

When a merchant installs one of our Apps from a Platform marketplace, we receive from the Platform or collect directly:

  • store identifiers and settings: store domain, store or shop ID, store name, subscription plan, primary locale, currency, time zone, and country;
  • merchant contact details: store owner or staff name, email address, and telephone number;
  • configuration and settings the merchant enters into the App;
  • billing and subscription records. App charges are processed through the Platform’s own billing system. We do not receive, process, or store payment card numbers;
  • support correspondence, including any screenshots or files you send us;
  • application logs: API requests and responses, timestamps, error traces, and originating IP addresses.

3.3 Data accessed through Platform APIs

Our Apps request only the access scopes and permissions necessary for the App to function. The scopes requested by each App are shown to the merchant at installation and listed at harrisdigital.io/apps/permissions/. Depending on the App, the Platform, and the permissions the merchant approves, this may include:

  • store configuration data, such as the store’s name, domain, and its configured markets, regions, and currencies.

Our Apps do not request access to customer records, orders, payment data, or shopper personal information. Where an App stores business information about a merchant’s retailers, stockists, or locations, that information is supplied by the merchant, not retrieved from the Platform.

We access this data only to deliver the features described in the App’s marketplace listing and to provide support. We do not use it to build advertising profiles, we do not sell it, and we do not disclose it except as described in section 6.

3.4 Buyers (a merchant’s customers)

We do not interact with buyers directly, and our Apps do not collect behavioral data about them. We do not use tracking pixels or analytics software in our storefront components, and we do not record what a shopper searches for or views.

Where an App renders a storefront component, such as a map, the shopper’s browser may contact third-party mapping and geocoding services directly in order to display it. In that case the shopper’s IP address and any search text they enter are received by that service under its own privacy policy, not by us. The services used for this purpose are listed in section 15. Merchants who enable such a component are responsible for reflecting it in their own privacy notice and cookie disclosures.

Where an App does process buyer personal information on a merchant’s behalf, the merchant is the controller of that information. Buyers who wish to exercise rights over their data should contact the merchant whose store they shopped at. If a buyer contacts us directly, we will forward the request to the merchant and assist the merchant in responding.

3.5 Protected and restricted customer data

Some Platforms classify certain merchant and buyer information as protected or restricted, and require an app to be separately approved before it may access that information. Our Apps do not request or access protected or restricted customer data on any Platform. If that changes, we will seek the approval the relevant Platform requires, update this notice, and apply the safeguards described in section 11 to that data.

4. Why we collect information, and our legal bases

Purpose Information used Legal basis (EEA/UK)
Operate our website and respond to your enquiries Contact details, message content Legitimate interests; steps prior to entering a contract
Provide, configure, and support our Apps Merchant and store data (3.2, 3.3) Performance of a contract
Process App subscription charges and invoicing Merchant and billing records Performance of a contract
Security, abuse monitoring, fraud prevention, and logging Technical and log data Legitimate interests
Improve and develop our products, including aggregate usage analysis Usage and log data Legitimate interests
Send marketing emails and SMS messages Contact details, engagement data Consent, or legitimate interests where permitted for existing business contacts
Analytics and advertising cookies and pixels Identifiers, browsing data Consent
Comply with legal, tax, and accounting obligations Transaction and billing records Legal obligation
Establish, exercise, or defend legal claims As relevant to the claim Legitimate interests

Where we rely on legitimate interests, we have assessed those interests against your rights and freedoms. You may object to that processing as described in section 9. Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

5. Cookies and similar technologies

We use cookies, tags, pixels, and similar technologies on our website. We group them into four categories:

  • Strictly necessary. Required for the site to function, including security and bot protection (Google reCAPTCHA). These cannot be switched off.
  • Functional. Remember your preferences and settings.
  • Analytics. Help us understand how the site is used. We use Google Analytics and Google Tag Manager.
  • Advertising. Used to deliver and measure advertising. We use Meta, LinkedIn, Google Ads, and Microsoft Advertising technologies. These partners may use the data for their own purposes under their own policies, which are linked in section 15.

Where required by law, we display a consent banner and set non-essential cookies only after you consent. You can change your choices at any time through Cookie Settings or through your browser settings.

Opt-out preference signals. We treat a Global Privacy Control (GPC) signal, or another opt-out preference signal recognized under applicable law, received through your browser as a valid request to opt out of targeted advertising and the sale or sharing of personal information for that browser. Because the signal is browser-specific, you will need to enable it on each browser and device you use.

Do Not Track. Generic “Do Not Track” browser headers are not standardized and we do not respond to them. We do honor GPC as described above.

6. How we share information

We do not sell personal information for money, and we do not rent or lease customer lists. Our use of the advertising technologies described in section 5 may constitute “selling” or “sharing” for cross-context behavioral advertising under some U.S. state laws. You can opt out at any time as described in sections 5 and 9. We do not knowingly sell or share the personal information of anyone under 16.

We disclose personal information to:

  • Service providers and subprocessors who perform work on our behalf under written contracts that limit their use of the data. Our Apps run on Amazon Web Services infrastructure in the United States, with the application and database in the us-east-1 region and encrypted offsite backups in us-west-2. App data is not sent to third-party error monitoring, logging, analytics, or email services. For our website and business operations we also use WordPress, email delivery, CRM and marketing automation, accounting and billing (NetSuite), and helpdesk and support ticketing providers. A current list of the subprocessors used by our Apps is available on request.
  • Mapping and geocoding providers. Where an App renders a storefront map, the shopper’s browser contacts the mapping provider the merchant selected, being OpenStreetMap including its Nominatim geocoding service, or Google Maps where the merchant enables it with their own key. Those providers receive the shopper’s requests directly and process them under their own privacy policies. We neither receive nor retain that information.
  • Platform operators, such as Shopify and Adobe, as necessary for our Apps to function and as required by that Platform’s partner agreement and API terms.
  • Professional advisors such as auditors, lawyers, accountants, and insurers, under duties of confidentiality.
  • Government authorities or other parties where required by law, subpoena, court order, or where necessary to protect the rights, safety, or property of Harris Digital, our clients, or others.
  • A successor in connection with a merger, acquisition, financing, reorganization, or sale of assets, subject to the protections in this notice.

7. How long we keep information

We keep personal information only as long as necessary for the purposes described in this notice, unless a longer period is required by law. Our standard retention periods are:

Information Retention period
Website form submissions and enquiries [24] months after last contact
Marketing contact records Until you unsubscribe. We retain a minimal suppression record indefinitely so we can continue to honor your opt-out.
Web server and access logs 14 days for our Apps. IP addresses are truncated before storage.
Merchant account, App configuration, and merchant-supplied business records Retained while the App is installed. Deleted when the Platform notifies us of uninstallation, which on Shopify is approximately 48 hours after the merchant uninstalls, or earlier on request.
Authentication tokens and session records Deleted at uninstallation.
Store configuration data read through Platform APIs Not retained. Read live from the Platform each time it is needed and discarded.
Order, customer, and buyer data Not applicable. Our Apps do not collect or store it.
Database backups Nightly. A copy is held on the application server for 14 days, and an encrypted offsite copy in AWS S3 for 30 days, after which it is deleted automatically. Deleted records persist in backups until the last backup containing them expires, which is up to 30 days after deletion.
Application and error logs 14 days. These contain no shopper identifiers.
Support tickets and correspondence Kept for as long as needed to provide support and maintain our records; not on an automatic deletion schedule. You may ask us to delete your correspondence at any time.
Billing, invoicing, and tax records [7] years, as required by tax and accounting law

Platform deletion and access requests. Where a Platform provides an automated mechanism for passing on data access and deletion requests, our Apps subscribe to it and act on the requests it delivers. When we receive a request for a copy of an individual’s data, we provide that data to the merchant so the merchant can respond to the individual. When we receive a deletion request, or when a merchant uninstalls an App, we delete or irreversibly anonymize the relevant data from our production systems, and from backups on the next scheduled backup rotation.

On the Shopify platform this mechanism is the set of mandatory compliance webhooks (customers/data_request, customers/redact, and shop/redact), to which each of our Shopify Apps subscribes on a signature-verified endpoint. Because our Apps hold no shopper personal data, there is nothing for us to return or erase in response to the first two. On receipt of shop/redact we immediately delete that store’s records, including its business records, account mapping, and authentication tokens, from our production database. Those records then persist only in rolling database backups until the backup containing them rotates out, as set out in the table above.

Merchants on Platforms that do not provide an equivalent automated mechanism may submit access and deletion requests to us using the contact details in section 14, and we will act on them within the periods set out in section 9.3.

8. Your rights and choices

8.1 If you are a resident of a U.S. state with a comprehensive privacy law

Depending on your state of residence, including California, Colorado, Connecticut, Virginia, and others with comparable laws, you have the right to:

  • confirm whether we process your personal information and access it;
  • correct inaccuracies in your personal information;
  • delete personal information you provided or that we obtained about you;
  • obtain a copy of your personal information in a portable format;
  • opt out of targeted advertising and of the sale or sharing of your personal information;
  • opt out of profiling in furtherance of decisions that produce legal or similarly significant effects;
  • limit our use and disclosure of sensitive personal information; and
  • not be discriminated or retaliated against for exercising any of these rights.

For California residents: the categories of personal information we collect, the sources we collect it from, the purposes for which we use it, and the categories of recipients we disclose it to are described in sections 3, 4, and 6. We retain each category for the periods described in section 7.

8.2 How to exercise your rights

Email us at accounting@harrisdigital.io, or write to us at the postal address in section 14. To protect your information we will verify your identity before acting, normally by confirming details we already hold or by corresponding with the email address on file. An authorized agent may submit a request on your behalf with written proof of authorization.

We will respond to requests under U.S. state privacy laws within 45 days, and we may extend that period by a further 45 days where permitted, in which case we will tell you why. We will respond to requests under the GDPR and UK GDPR within one month, extendable by a further two months for complex requests.

8.3 Appeals

If we decline your request, you may appeal by replying to our decision or by emailing accounting@harrisdigital.io with “Privacy Appeal” in the subject line. We will respond in writing within 45 days and explain the reasons for our decision. If we deny your appeal, we will provide a method for you to contact your state attorney general to submit a complaint.

8.4 Buyers who shopped at a merchant store using one of our Apps

Contact the merchant whose store you shopped at. The merchant controls that data and is responsible for responding. If you contact us instead, we will forward your request to the merchant and support the merchant in fulfilling it.

9. Marketing communications and SMS

Email. Every marketing email includes an unsubscribe link. You can also email accounting@harrisdigital.io to be removed. Unsubscribing from marketing does not stop service, billing, security, or transactional messages relating to an active engagement or App installation.

SMS. By opting in to SMS through a web form or other medium, you agree to receive SMS messages from Harris Digital, including conversational messages. Message frequency varies. Message and data rates may apply. Reply HELP for help and STOP to any message to opt out. We do not share SMS opt-in consent or telephone numbers with third parties for their own marketing purposes.

10. Security

We maintain administrative, technical, and physical safeguards appropriate to the risk, including:

  • encryption of data in transit using TLS on all endpoints, and encryption of data at rest using managed volume encryption on our cloud infrastructure
  • role-based access control on a least-privilege basis, and multi-factor authentication on administrative systems
  • logging, monitoring, and alerting on our infrastructure;
  • due diligence on vendors and subprocessors before engagement; and
  • periodic review of access rights, retention periods, and security controls.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a breach affecting your personal information, we will notify you, the affected merchant, and the relevant supervisory authorities as required by applicable law and by our contracts. For our Apps, we will notify affected merchants without undue delay.

11. Children

Our website and our Apps are intended for business users and are not directed to children. We do not knowingly collect personal information from children under 16. If we learn that we have inadvertently collected personal information from a child under 13, we will delete it promptly or obtain verifiable parental consent as required by the Children’s Online Privacy Protection Act.

12. Changes to this notice

We may update this notice from time to time. When we do, we will post the revised notice on this page and update the “Last updated” date and version number at the top. Where changes are material, we will provide additional notice, such as by email or an in-App notification, before the changes take effect. Prior versions are available on request.

13. Contact us

If you have questions about this notice or about how we handle personal information, contact us:

Harris Digital
172 Amity Rd, Woodbridge, CT 06525, United States
Email: accounting@harrisdigital.io
Telephone: 203-535-1631

14. Third-party policies referenced in this notice