Privacy Policy — Google Reviews by Am2pm
Last updated: 10 August 2026 Data controller: Am2pm GmbH, Switzerland · info@am2pm.ch
This policy describes what the Shopify app Google Reviews by Am2pm ("the App") collects,
why, and how long it is kept. Publish it at https://review.am2pm-app.ch/privacy (or your
website) and link it from the Shopify App Store listing — a reachable privacy policy URL is
mandatory for listing.
1. The short version
The App does not collect, request, or store any personal data belonging to your customers.
It holds three things: your store's domain and settings, the Google business location you
connect, and the public Google reviews for that location. It requests a single Shopify
permission, read_themes, and no customer-data scopes whatsoever.
2. What the App stores
From your Shopify store
| Data | Why | Retained |
|---|---|---|
Store domain (example.myshopify.com) |
Identifies your account | Until 48h after uninstall |
| Shopify access token | Authenticates API calls on your behalf | Deleted immediately on uninstall |
| Widget settings (layout, colours, filters, language) | Renders your widget | Until 48h after uninstall |
| Custom CSS you enter | Applied to your widgets | Until 48h after uninstall |
| Free-installation requests you submit | Lets our support team help you | 12 months |
From Google
| Data | Why | Retained |
|---|---|---|
| Google Place ID, business name, address | Identifies the location you connected | Until you disconnect or uninstall |
| Overall rating and total review count | Shown in the widget header | Refreshed on each sync |
| Review text, star rating, publication date | Displayed in your widget | Until you delete them or uninstall |
| Reviewer's public display name and profile photo URL | Attribution, as Google requires | Same as above |
Reviewers' names and photos are already public on Google Maps and Google Search. The App displays them exactly as Google publishes them, with attribution and a link back to Google. It performs no enrichment, profiling, tracking or cross-referencing of reviewers.
Reviews you add yourself. If you enter reviews manually or import a CSV, you are the controller of that content and are responsible for having a lawful basis to publish it. Such reviews are always labelled with their own source and are never presented as Google reviews.
3. What the App does not do
- It does not request or receive Shopify protected customer data. It holds no customer
names, emails, addresses, or order data. The Shopify mandatory
customers/data_requestandcustomers/redactwebhooks are implemented and, correctly, return nothing — there is nothing to return. - It does not place cookies on your storefront or in the admin.
- It does not track, fingerprint or profile your shoppers. The storefront widget makes one request for review data and nothing else.
- It does not sell, rent or share data with third parties for advertising.
4. Who else processes this data
| Processor | Purpose | Location |
|---|---|---|
| Hetzner Online GmbH | Hosting the application and database | Finland (EU) |
| Google LLC (Maps Platform) | Source of review data | Global |
| Shopify Inc. | The platform the App runs on | Global |
There are no analytics, advertising or session-recording services in the App.
5. Where data is stored
On servers in Finland, inside the EU. Data is encrypted in transit (TLS 1.2+). Google refresh tokens, if you connect a Google Business Profile, are encrypted at rest with AES-256-GCM. Backups are retained for 14 days.
6. Retention and deletion
Uninstalling the App deletes your access token immediately and marks the account inactive;
review syncing stops at once. Shopify then sends a shop/redact request 48 hours later, at
which point every remaining record for your store is deleted.
The 48-hour window exists so that a reinstall — common after a plan change or theme migration — restores your widgets and collected reviews instead of losing your configuration.
To delete everything sooner, email info@am2pm.ch and we will erase your data within 7 days.
7. Your rights
Under GDPR and the Swiss FADP you may request access to, correction of, or deletion of your data, ask for a portable copy, or object to processing. Email info@am2pm.ch; we respond within 30 days.
If a reviewer wants their review removed from your widget, the fastest route is deleting it on Google — it disappears from the widget on the next sync. You can also hide any individual review immediately from the App's Reviews tab.
8. Changes
Material changes will be announced in the App at least 14 days before taking effect. The "last updated" date above always reflects the current version.
9. Contact
Am2pm GmbH · info@am2pm.ch