Privacy Policy

Last updated: December 17, 2025

1. Introduction

PassportPro ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Shopify application for creating and managing Digital Product Passports in accordance with EU Regulation 2024/1781 (Ecodesign for Sustainable Products Regulation - ESPR).

2. Information We Collect

When you install and use PassportPro, we collect the following types of information:

2.1 Shop Information

• Shopify Store Data: We collect and store your Shopify store domain, shop ID, access tokens (encrypted), and shop metadata necessary to provide authentication and service functionality.
• Subscription Data: We process billing information through Shopify's billing API including subscription status, trial periods, and payment history. We do not directly store credit card information.

2.2 Product Passport Data

• Product Information: We store product identifiers, variant details, product images (resized to 150×150 WebP format), and links to your Shopify products.
• Digital Product Passports: We store all information you enter into product passports including manufacturer details, material composition, substances of concern, environmental footprint data, durability metrics, repairability information, recyclability data, compliance certifications, and any other fields you populate.
• Print Run Snapshots: We create and permanently store immutable snapshots of product passports at the time of QR code generation for traceability purposes. These snapshots are retained indefinitely to ensure printed QR codes continue to resolve correctly.
• Amendment Records: We maintain append-only correction records for any updates made to print runs, including field-by-field change history with timestamps.

2.3 Library Records

• Manufacturers: Company names, legal identifiers (GLN), addresses, contact information, geographic coordinates, and any uploaded certifications or documentation.
• Materials: Material names, types, sustainability attributes (recycled content, bio-based percentages), origin countries, and certification information.
• Substances: Chemical names, CAS numbers, EC numbers, hazard classifications, and safe handling instructions.

2.4 Usage and Analytics Data

• Application Usage: We may collect anonymized data about feature usage, page views within the admin interface, and general application performance metrics to improve our service.
• Public Resolver Access: When consumers scan QR codes and access public passport pages on pp-code.org, we may collect standard web server logs including IP addresses, browser types, access timestamps, and referring URLs. This data is used solely for security, fraud prevention, and service improvement.
• QR Code Scans: We do not track individual consumer identities or create user profiles from QR code scans. Scan analytics are aggregated and anonymized.

2.5 Customer and End-User Data

• No Personal Information of End Consumers: PassportPro does not collect, store, or process personal information about your customers or end consumers who scan QR codes. The public passport pages are informational only and do not require registration, login, or submission of personal data.

3. How We Use Your Information

We use the collected information for the following legitimate business purposes:

• Service Provision: To provide and maintain the core functionality of PassportPro, including passport creation, library management, print run generation, QR code hosting, and the public resolver system.
• Authentication and Authorization: To authenticate your Shopify store, validate your subscription status, and enforce access controls.
• Billing and Subscription Management: To process subscription payments, manage trial periods, handle cancellations, and communicate billing-related information through Shopify's billing system.
• Data Integrity and Compliance: To maintain immutable print run snapshots ensuring that printed QR codes always resolve to accurate, traceable information as required by EU regulations.
• Service Improvement: To analyze usage patterns (anonymized), identify bugs, improve performance, develop new features, and enhance user experience.
• Customer Support: To respond to your support requests, troubleshoot technical issues, and provide product assistance.
• Legal Compliance: To comply with applicable laws, regulations, legal processes, and enforceable governmental requests.
• Security: To detect, prevent, and respond to fraud, abuse, security incidents, and other harmful activities.

4. Data Sharing and Disclosure

We do not sell, rent, or trade your personal data or business information to third parties for their marketing purposes. We may share your information only in the following limited circumstances:

4.1 Service Providers and Vendors

• Shopify: As a Shopify embedded application, we share necessary data with Shopify to integrate with their platform, process authentication, manage billing, and synchronize product data.
• Database and Hosting Providers: We use Supabase (PostgreSQL) for secure data storage and Vercel for application hosting. These providers operate under strict data processing agreements and confidentiality obligations.
• Map Services: Geographic coordinates for manufacturer locations may be processed through mapping services (e.g., Mapbox) to display interactive maps on public passport pages.
• Infrastructure Services: We may use additional third-party services for monitoring, error tracking, and performance optimization. All such providers are bound by confidentiality agreements and process data only as instructed by us.

4.2 Legal Requirements

We may disclose your information if required to do so by law or in good faith belief that such action is necessary to:

• Comply with legal obligations, court orders, or governmental requests
• Investigate potential violations of our policies
• Protect the safety, rights, or property of PassportPro, our users, or the public
• Defend against legal liability or claims

4.3 Business Transfers

In the event of a merger, acquisition, reorganization, bankruptcy, or sale of assets, your information may be transferred as part of that transaction. We will notify you via email or prominent notice in the application before your information becomes subject to a different privacy policy.

4.4 With Your Consent

We may share your information with other third parties when we have your explicit consent to do so.

5. Public Data and Passport Information

Important Notice: Digital Product Passports created with PassportPro are intended to be publicly accessible to comply with EU ESPR regulations. When you create a passport and generate a QR code, the following information becomes publicly available at pp-code.org:

• All product passport fields you populate (manufacturer, materials, environmental data, etc.)
• Print run snapshots and amendment histories
• Product images you associate with passports
• Manufacturer, material, and substance information linked to public passports

Do not include confidential, proprietary, or sensitive business information in passport fields that you do not wish to be publicly disclosed. While passsport data is necessary for regulatory compliance, you control what specific details you enter.

Passport pages are indexed by search engines and accessible to anyone with the QR code link. This is by design and necessary for consumer transparency and regulatory compliance.

6. Data Security

We implement industry-standard security measures to protect your information from unauthorized access, alteration, disclosure, or destruction:

• Encryption: Data in transit is encrypted using TLS/SSL protocols. Sensitive data at rest, including access tokens, is encrypted in our database.
• Access Controls: Access to systems and databases is restricted to authorized personnel only, using role-based access controls and multi-factor authentication.
• Secure Infrastructure: We use reputable cloud providers (Vercel, Supabase) that maintain SOC 2 Type II compliance and implement comprehensive security programs.
• Regular Security Audits: We conduct regular security reviews and apply security patches promptly.
• Immutable Audit Trails: Print run snapshots and amendments are stored in an append-only structure to prevent tampering and ensure data integrity.

While we strive to protect your information using commercially reasonable means, no method of transmission or electronic storage is 100% secure. We cannot guarantee absolute security.

7. Data Retention

We retain different types of data for varying periods based on legitimate business needs:

7.1 Active Subscription Data

While you maintain an active subscription, we retain all shop information, library records, passports, and print runs to provide continuous service.

7.2 Canceled or Uninstalled Accounts

When you cancel your subscription or uninstall the app, you will be offered a one-time $99 Archive Fee option to preserve your published passports and print run QR codes for continued operation. This archive option:

• Keeps all published passports and print run snapshots active indefinitely
• Ensures QR codes on physical products continue to resolve correctly
• Prevents "dead links" for products already in the market
• Provides read-only access to archived data (no editing capabilities)

7.3 Data Deletion (If Archive Fee Is Declined)

If you choose not to pay the archive fee upon subscription cancellation or app uninstallation, all your data will be permanently deleted after 30 days from the cancellation date:

• Complete Data Deletion: All shop information, library records (manufacturers, materials, substances), product passports, print runs, and associated data will be permanently deleted.
• QR Code Resolution: After deletion, QR codes will no longer resolve and will display an error message indicating the passport is no longer available.
• Grace Period: The 30-day period allows you time to export any data you wish to retain or reconsider the archive option.
• No Recovery: Once data is deleted after the 30-day period, it cannot be recovered.

7.4 Backup and Legal Hold

Deleted data may persist in backup systems for up to 90 days. Data subject to legal holds, ongoing investigations, or disputes is retained until the matter is resolved.

8. Your Privacy Rights

Depending on your jurisdiction, you may have certain rights regarding your personal information:

8.1 GDPR Rights (EU/EEA/UK Users)

If you are located in the European Union, European Economic Area, or United Kingdom, you have the following rights under the General Data Protection Regulation (GDPR):

• Right of Access: Request confirmation of what personal data we hold about you and obtain a copy.
• Right to Rectification: Request correction of inaccurate or incomplete data.
• Right to Erasure ("Right to Be Forgotten"): Request deletion of your personal data in certain circumstances. Note: This right does not apply to print run snapshots, which must be retained for regulatory compliance and consumer protection.
• Right to Restriction of Processing: Request that we limit how we use your data in certain situations.
• Right to Data Portability: Receive your data in a structured, machine-readable format and transmit it to another controller.
• Right to Object: Object to processing of your data based on legitimate interests or for direct marketing purposes.
• Right to Withdraw Consent: Where processing is based on consent, withdraw that consent at any time.
• Right to Lodge a Complaint: File a complaint with your local data protection authority.

8.2 CCPA Rights (California Residents)

If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA):

• Right to Know: Request information about the categories and specific pieces of personal information we've collected, sources, purposes, and third parties we share it with.
• Right to Delete: Request deletion of your personal information (subject to exceptions for print run data).
• Right to Opt-Out: We do not sell personal information, so no opt-out is necessary.
• Right to Non-Discrimination: You will not receive discriminatory treatment for exercising your privacy rights.

8.3 Exercising Your Rights

To exercise any of these rights, please contact us using the contact information in Section 11 below. We will respond to verified requests within the timeframes required by applicable law (typically 30 days for GDPR, 45 days for CCPA).

We may need to verify your identity before processing requests. For merchants, we verify identity through your Shopify store credentials.

9. International Data Transfers

PassportPro operates globally and may transfer and process your information in countries outside your country of residence, including the United States and European Union. These countries may have data protection laws that differ from those in your jurisdiction.

When we transfer data internationally, we ensure appropriate safeguards are in place, such as:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Processing within countries deemed to provide adequate protection under GDPR (e.g., EU member states)
• Compliance with applicable data protection frameworks

10. Children's Privacy

PassportPro is a business-to-business application intended for use by Shopify merchants and their authorized staff. Our service is not directed to individuals under the age of 16, and we do not knowingly collect personal information from children. If we become aware that we have inadvertently collected information from a child under 16, we will take steps to delete it promptly.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or service features. When we make material changes, we will:

• Update the "Last updated" date at the top of this policy
• Notify you via email to your registered shop contact email
• Display a prominent notice in the PassportPro admin interface

12. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

• Email: support@velvetdevelopment.com
• In-App Support: Use the support channel provided in the PassportPro admin dashboard
• Data Protection Officer: For GDPR-specific inquiries, contact support@velvetdevelopment.com