Cove Wishlist
Terms of service and data processing addendum
Last updated 2026-10-22
These terms are an agreement between Stack Craft Digital (“we”) and the merchant who installs Cove Wishlist on a Shopify store (“you”). Installing or using the app means you accept them.
1. The service
The app adds wishlists to your Shopify store: save buttons, a wishlist page, a page in customer accounts, imports, alert emails sent on your behalf, and Shopify Flow triggers. Features depend on your plan, shown in the app before you subscribe.
2. Fees
Paid plans are billed by Shopify on our behalf, in line with Shopify’s billing terms. You can change or cancel your plan at any time in the app; cancelling stops future charges.
3. Your responsibilities
- Tell your shoppers about wishlists in your own privacy notice and collect any consent your local law requires, including consent to marketing messages sent through Shopify Flow.
- If you turn on alert emails about saved items, they go only to customers subscribed to your email marketing in Shopify; you are responsible for that consent. Back-in-stock emails a shopper asks for with “Notify me when available” are sent on that request, once.
- Only import files you have the right to use, and do not use the app for anything unlawful or to harm the app or other merchants.
4. Availability and warranty
We work to keep the app available and secure but provide it “as is”, without warranties beyond those the law requires. We may change features; we will give notice in the app before removing a paid feature you rely on.
5. Liability
To the extent the law allows, our total liability for any claim is limited to the fees you paid us in the 12 months before it arose, and neither party is liable for indirect or consequential loss. Nothing limits liability that cannot be limited by law.
6. Ending the agreement
You can end it at any time by uninstalling the app. We can end it with 30 days’ notice, or immediately if you breach these terms. Data is then deleted as set out in the addendum below.
7. Changes and law
We may update these terms and will tell you in the app at least 14 days before material changes take effect. These terms are governed by the law of England and Wales, whose courts have jurisdiction.
Data processing addendum
This addendum applies where we process personal data of your shoppers on your behalf, under the GDPR, the UK GDPR and similar laws. You are the controller; we are the processor.
| Subject matter and purpose | Providing wishlist features in your store, as you configure them. |
|---|---|
| Data subjects | Your store’s shoppers, signed in or guest. |
| Personal data | Shopify customer IDs, hashed guest identifiers, saved product and variant IDs, list names, timestamps, and for wishlist sales the order, line item and product IDs, quantities and amounts. Email addresses only for alert emails: a guest’s address from “Notify me when available”, stored encrypted until the alert is sent (at most 180 days), and signed-in customers’ addresses, read from Shopify at send time and not stored. Emails in imported files are processed in memory only and not stored. |
| Duration | While the app is installed, then until deletion as below. |
We will:
- Process the data only on your documented instructions, which are these terms and your app settings.
- Keep it confidential and limit access to people who need it to run the app.
- Protect it with appropriate technical and organisational measures: encryption in transit and at rest, two-factor authentication, access logging and least-privilege access to your store (read-only scopes).
- Use only the subprocessors listed in our privacy policy (currently Railway Corporation, Lettermint B.V.), and give you 30 days’ notice of a new one, during which you may object by uninstalling.
- Help you answer shoppers’ rights requests, which reach us through Shopify’s customer data request and redaction webhooks.
- Tell you without undue delay, and within 72 hours of confirming it, about a personal data breach affecting your store.
- Delete your store’s data when Shopify sends the shop redaction request after uninstall (about 48 hours), removed items after 90 days, and alert requests (with any guest email) when the alert is sent, when the shopper unsubscribes or after 180 days, whichever is first.
- Make available the information you reasonably need to show compliance with this addendum.
Data is stored in the European Union (Amsterdam, Netherlands). Where it is transferred outside the UK or EEA, we rely on the applicable standard contractual clauses or the UK international data transfer addendum.
Contact
Stack Craft Digital, 66 Paul Street, London, EC2A 4NA, United Kingdom, contact@stackcraftdigital.co.uk.