Blink One — App Privacy Policy

Last updated: 13.10.2026

Effective date: 13.10.2026

Who we are: Blink One ("Blink", "we") is a Shopify app operated by Noam David Elbaz, a licensed dealer (osek murshe; sole proprietor) in Israel, business ID 322313735, Ramat Motsa 30, Jerusalem, Israel. Contact: schoolblinkecom@gmail.com · privacy: schoolblinkecom@gmail.com.

This policy explains what Blink processes when a merchant installs it on a Shopify store, why, for how long and who else is involved. It does not replace the store's own privacy policy toward its shoppers.

1. Our role

• Merchant data (account, settings, business details, billing): we decide how it is used — we are the controller (Israeli law: the database controller).
• Shopper data passing through Blink (cancellation form, review, experiment visitor id, order data): we act for the merchant and on its instructions — processor. The merchant remains responsible to its shoppers. Terms are in the Data Processing Addendum (DPA).

2. What we process

2.1 From Shopify, about the store and merchant

• Store identity and access: shop domain, the access token Shopify issues at install, granted scopes and — only if Shopify includes them in a staff session — the staff member's name, email and admin language, to keep the session working.
• Theme information (read_themes): which theme is live and which Blink parts are on. Theme files are never changed.
• Products (read_products, only when a tool needs it): titles, images, prices and unit cost — for pickers, Profit, Reviews and Blink Optimizer.
• Plan: the plan handle Shopify returns. Payment details never reach us.

2.2 Orders — financial fields only (Profit, impact measurement, Optimizer; optional)

Only when the merchant turns on a tool that needs it and grants read_orders (Shopify protected customer data, Level 1, orders only; reasons: App functionality + Analytics):

• Order id and number, dates, currency, totals, tax, refunds, discounts, gateway names, line items (product, variant, SKU, quantity, price, cost), test/cancelled flags, and the order's position in the customer's history (e.g. "1st order").
• Never the customer's name, email, phone, address, notes, IP address or customer id.
• Retention: about 13 months (Profit, impact); deleted when the tool is turned off or on uninstall.

2.3 Data the merchant enters

• Business details used to prefill documents: store and legal name, entity type and number, VAT status, address, website, support email and phone, WhatsApp, hours, delivery and return terms, accessibility-coordinator and privacy-officer contacts, owner name.
• Tool settings, a setup activity log, costs for Profit, legal publications.
• Brand profile for Optimizer: audience, promise, tone, words to avoid, and text extracted from an uploaded brand book (up to ~60,000 characters). The file itself is not stored — only the text.

2.4 Shopper data collected on the merchant's storefront

• Cancellation / return requests — only if the merchant places the cancellation form. Stored: name, email, phone, order number, items, reason, last 4 digits of an Israeli ID number (never the full number), request type, status and consent time. Deleted automatically after 24 months.
• Review submissions — display name, rating, title, text and media. No email, no IP. If the shopper is logged in, Shopify passes a numeric customer id, kept in a separate link table (never on the published review) so the merchant sees that customer's reviews on the Shopify customer page. Approved reviews are stored in the merchant's Shopify store (app-owned metaobjects), not on our servers. Pending submissions: until approved/rejected (pruned after ~90 days).
• Thank-you page — "how did you hear about us" answer and discount code, keyed by order id only.
• WhatsApp — daily counts per page type and product, no identifiers, ~13 months.
• Hidden cart markers (impact measurement) — underscore-prefixed properties holding a short code or a date only.
• Blink Optimizer (A/B experiments) — only if the merchant turned it on, and only after the visitor gave analytics consent (Shopify Customer Privacy API or Blink's cookie banner). Without consent the visitor sees the normal store and nothing is stored about them.
  • First-party browser cookies: _blink_vid (random id) and _blink_ab (which version was shown), up to 180 days; a copy of the id in localStorage. Withdrawing consent deletes them at once.
  • On our server: the id hashed (salted SHA-256), device type (mobile/desktop), the version shown, and whether the visitor added to cart, reached checkout or completed an order. To attribute an order to a version we keep the order id and money fields (no customer fields).
  • Blink's web pixel (blink-opt-pixel) is loaded by Shopify only with analytics consent and sends two events: "checkout started" and "checkout completed" (with the order id).
  • Price tests: a log of each version's price per product (not per shopper) for the "lowest price in the last 30 days" warning.
  • The versions a visitor is in (random id + version numbers, no personal details) also travel with the cart as a hidden cart attribute and hidden line property _blink_ab, so the checkout can charge the price that was shown; they appear on the order in the merchant's Shopify admin.
  • Retention: visitor rows deleted 30 days after an experiment is decided; experiment order rows of an order are deleted on customers/redact; everything else on uninstall.
• In the shopper's browser only (not sent to us): accessibility preferences, cookie choice, dismissed bars.
• Abuse protection: IP addresses of storefront form requests are used in memory for rate limiting and not stored.

2.5 Reviews imported by the merchant

• From a file (CSV/Excel): the reviewer display names, ratings, dates, texts and photos in the file are written into the merchant's store.
• From a supplier's product-page link (Max plan): only rating, text, date, country and photos (photos are off by default). Buyers' names are not imported — each such review shows the generic name "Buyer" and always carries the label "Review from the supplier's marketplace". The app contacts the supplier's site only at the merchant's request, identifies itself (BlinkOne-ReviewImport), respects robots.txt and is rate-limited.
• Before every import the merchant confirms it has the right to use the content; the confirmation is kept as an evidence record (see section 6).

2.6 Connected services and AI

• Meta (Facebook): if the merchant connects — an access token encrypted with AES-256-GCM, the ad accounts it can read, the accounts selected and daily spend. ads_read only; we cannot change ads.
• Anthropic (Claude API, server-side, Blink's key):
  • *Optimizer:* product title, description and product-page texts, aggregate review count and rating, and the brand profile (including brand-book text; a scanned PDF may be sent whole for text extraction) — to write test versions.
  • *Review translation:* the review texts being translated, only when the merchant presses Translate.
  • No shopper personal data, orders or visitor data are sent. Under Anthropic's commercial terms, API content is not used for model training and is retained for a short period.
• Claude connection (MCP, Blink Booster): if the merchant connects — pairing/auth codes and tokens stored only as SHA-256 hashes, and an audit log (tool name, outcome, duration; no content, no IP), 90 days. What Claude does with data it reads is governed by the merchant's own agreement with Anthropic.

3. Purposes and legal bases

Blink does not sell personal data, does not use it for advertising, does not build cross-store shopper profiles and does not use merchant or shopper data to train AI models.

4. Sub-processors and recipients

We update this list before adding a sub-processor and notify merchants as the DPA describes.

5. International transfers

Data is hosted in Frankfurt (EU; the EU and Israel recognise each other as adequate). Transfers to the USA (Anthropic, Meta, Shopify) rely on the providers' contractual commitments (e.g. EU Standard Contractual Clauses and/or the EU-US Data Privacy Framework where the provider is certified) and on Israel's Privacy Protection (Transfer of Data to Databases Abroad) Regulations, 2001.

6. Retention and deletion

• Uninstall (app/uninstalled): all of the shop's data is deleted from our database — settings, module data, orders, costs, connections, logs, experiments, brand profile and pending submissions. Shopify itself removes the storefront parts and the app-owned review metaobjects.
• shop/redact (48 hours after uninstall): everything is deleted again, as a second guarantee.
• Exception — consent (evidence) records: the Terms of Service acceptance (shop domain, terms version, language, a hash of the accepted text, time, and the Shopify user id when provided) and the rights confirmations before review imports (same fields + product id) are not deleted on uninstall. They are business data about the merchant (not about customers), kept for up to 7 years to prove the agreement and defend legal claims, then deleted.
• customers/redact: thank-you, impact, Profit and Blink Optimizer records for the listed orders, every cancellation request matching the customer's email or phone, and review-to-customer links are deleted. The review itself stays under its display name with no link to the customer.
• customers/data_request: logged in the merchant's activity log with the number of cancellation requests from that customer, so the merchant can provide them.
• Fixed limits: orders ~13 months · WhatsApp counts ~13 months · pending reviews ~90 days · cancellation requests 24 months · Claude audit log 90 days · experiment visitors 30 days after a decision · expired codes and tokens pruned.
• Backups:

7. Security

TLS everywhere; connected-service tokens encrypted at rest (AES-256-GCM); Claude-connection secrets stored only as hashes; Shopify webhooks HMAC-verified; storefront endpoints behind Shopify's signed app proxy and rate-limited; visitor ids hashed; production access limited to support needs.

8. Your rights

• Merchants: access, export (where offered), correct and delete your data in the App or at schoolblinkecom@gmail.com; uninstalling deletes it.
• Shoppers: contact the store you bought from — it controls your data and can act through Shopify's privacy tools; we assist it. If you write to us, we forward your request to the store.
• Israel (Privacy Protection Law incl. Amendment 13, in force since 14.08.2025): the right to inspect your data, ask to correct or delete data that is inaccurate, incomplete, unclear or outdated, and to complain to the Privacy Protection Authority.
• EEA / UK (GDPR): access, rectification, erasure, restriction, portability, objection, withdrawing consent at any time, and complaining to your supervisory authority.
• California: we do not sell or share personal information for cross-context behavioural advertising.

We answer within 30 days.

9. Children

The App is for businesses. We do not knowingly collect data from children.

10. Changes

We post updates here with a new effective date and notify merchants in the App of material changes.

11. Contact

Noam David Elbaz (licensed dealer, Israel) · Business ID 322313735 · Ramat Motsa 30, Jerusalem, Israel · schoolblinkecom@gmail.com