1. Who we are
MakeApproved is a Shopify app that helps merchants send product proofs to their customers, collect feedback and approvals, and manage production. It is operated by Oleksii Shyshkov, an individual based in California, United States (“MakeApproved”, “we”, “us”).
This policy covers makeapproved.com, the MakeApproved app inside Shopify admin, the interactive demo, and the customer review pages we host for merchants (together, the “Service”). Questions and requests: contact@makeapproved.com.
2. Our role: business or service provider
We act in two different roles, and which one applies depends on whose information it is:
- For merchants’ customers (people who receive a proof, open a review link, upload a reference file or buy artwork), we process information on behalf of the merchant. The merchant decides which orders, files and contact details to use with MakeApproved, and the merchant’s own privacy policy governs how they handle your information. Under US state privacy laws we act as the merchant’s “service provider” or “processor”, and under laws such as the GDPR as a “processor”.
- For merchants, their staff and website visitors, we decide how information is used to run our business, so we are the “business” or “controller”.
3. Information we collect
From Shopify and merchants
- Store and account details: store domain and name, installation and authentication records, authorized staff identifiers, names and email addresses, app settings, team assignments, plan and subscription status, and usage counts.
- Orders and draft orders: order identifiers and numbers, products and line items, quantities, amounts and currencies, payment and fulfillment status, tags, and proof or production status. What we can read depends on the permissions the merchant grants the app.
- Customer contact details that the merchant uses to send a proof, artwork invoice or reminder, such as a customer’s name and email address.
From proof reviews
- Artwork and other uploaded files, filenames, proof versions, comments, approval or change-request decisions, names entered with decisions, checklist answers, timestamps and activity history (for example, when a review link was opened).
- Reference files a customer chooses to upload. Files and free-text comments may contain personal information that the merchant or customer chose to include.
Communications and support
- Email recipients, message content, and delivery and engagement events for transactional emails sent through the Service.
- Anything you send us when you contact support or give feedback.
Technical information
- Our hosting and security providers process IP addresses, browser and device details, request times, and error and access logs so they can deliver and protect the Service.
We do not receive or store full payment card details. Shopify handles app subscription billing and checkout payments.
We do not knowingly collect sensitive personal information as defined by US state privacy laws (for example, government ID numbers, precise geolocation or health data). Please don’t upload it unless it is part of the artwork to be produced.
4. How we use information
We use information to:
- authenticate merchants and staff and keep their accounts secure;
- show orders, store and deliver proofs, record feedback and approvals, and manage production;
- sync proof and approval status back to Shopify;
- send the transactional emails and reminders merchants ask us to send;
- administer plans, usage limits and Shopify billing;
- provide support, fix bugs and improve how the Service works;
- detect and prevent fraud, abuse, malware and security incidents;
- meet legal obligations and respond to privacy requests.
We use customer information only to provide the merchant’s workflow. We do not sell personal information, “share” it for cross-context behavioral advertising, or use customer artwork, comments or email addresses for advertising or to train AI models.
6. How long we keep information
We keep store settings, proof files, versions, decisions and related workflow records while the merchant uses the Service, unless they are deleted earlier through a privacy request.
- After uninstall: uninstalling the app stops our access to the store. About 48 hours later, Shopify sends us a shop-deletion request, and that starts removal of the store’s app data and private files.
- Customer reference uploads are scheduled for deletion after 30 days. Unfinished uploads expire after two hours.
- Privacy exports expire after seven days and can be generated again while the request is open.
- Support emails, security logs and records needed for legal or billing reasons are kept only as long as those purposes require.
Deletion runs as scheduled background jobs, so data may stay for a short time after it expires. Provider backups and logs are deleted when the provider’s own retention cycle ends. We may keep a minimal, non-identifying record that a request was handled so we don’t process it twice.
8. Security
We protect information with access controls, private file storage, encrypted (HTTPS) connections, hard-to-guess review link tokens, and encryption of sensitive fields such as stored email recipients and privacy-request payloads. Access to production systems is limited to what is needed to run and support the Service.
No online service is completely secure. If a security incident affects your information, we will notify affected merchants and, where the law requires, affected individuals and regulators.
9. Your privacy rights
Depending on where you live, you may have the right to:
- know what personal information we hold about you and get a copy of it;
- correct inaccurate information;
- delete your information;
- opt out of the sale or sharing of personal information, targeted advertising and profiling (we do none of these);
- limit the use of sensitive personal information (we don’t collect it on purpose);
- appeal if we deny your request;
- not be discriminated against for using any of these rights.
How to make a request
If you are a merchant’s customer, please contact the merchant first. They can find your order and send the request to us through Shopify. We support Shopify’s customer data request, customer redact and shop redact workflows. You can also email us at contact@makeapproved.com, and we will work with the merchant.
If you are a merchant or a website visitor, email contact@makeapproved.com.
We will verify your request, for example by confirming it with the store or the email address involved. You may use an authorized agent if you give them signed permission. We respond within 45 days, as the California Consumer Privacy Act (CCPA) requires, or sooner if another law requires it. Deleting information from MakeApproved does not delete the merchant’s Shopify order or files the merchant has already downloaded.
To appeal a decision, reply to our response with “Appeal” in the subject line. If you’re not satisfied with the result, you may contact your state attorney general or, outside the US, your local data protection authority.
California notice
In the last 12 months we collected the categories described in “Information we collect”: identifiers (such as names, email addresses and IP addresses), commercial information (order details), internet activity (logs and review events), and the content of files and comments. We used and disclosed them for the business purposes in this policy. We have not sold or shared personal information, and we have no actual knowledge of selling or sharing information of anyone under 16. California’s “Shine the Light” law does not apply because we don’t disclose personal information to third parties for their own direct marketing.
10. International users
MakeApproved is operated from the United States, and our providers may process information in the US and other countries where they operate. Those countries may have different privacy laws than yours. Where the law requires, we rely on our providers’ approved transfer mechanisms, such as Standard Contractual Clauses. If you use MakeApproved from the EU, UK or another region, you may have rights under your local law. You can make requests the same way described above.
11. Children
The Service is meant for businesses and is not directed to children under 13. We don’t knowingly collect personal information from them. If you believe a child has given us information, contact us and we will delete it.
12. Changes to this policy
We may update this policy as the Service or the law changes. The effective date at the top shows the current version. If we make a material change, we will tell merchants in the app or by email before it takes effect.
13. Contact
Oleksii Shyshkov, operator of MakeApproved, California, United States. Email: contact@makeapproved.com.