Rothbright Inc Privacy Policy

Information Collection and Use

When you create a Rothbright account or contact us through the website, we may require you to provide us with certain personally identifiable information, including but not limited to your name, email address, phone number, and postal address. The information that we collect will be used to contact or identify you.

Installing BrightScore from the Shopify App Store does not create a Rothbright account and does not ask you for any of the above. What that app receives instead is set out in the next section.

BrightScore for Shopify

BrightScore scores your storefront by loading its public pages the way a shopper or a search engine does. It adds nothing to your theme and it does not read your store’s private data.

What we receive from Shopify. When you install BrightScore, Shopify issues us an access token for your store. Using it, we read exactly five fields from the Shopify Admin API, at install and when you reopen the app:

• your store’s name;
• your permanent myshopify.com domain;
• your primary storefront domain — the site we scan and score;
• your store’s currency;
• the store owner’s email address, as recorded in your Shopify settings.

BrightScore requests no access scopes at all. That is why Shopify shows you no permission prompt when you install it, and it means there is no category of store data we are authorised to read beyond the five fields above.

What we never receive. We do not request, receive, or store your customers’ personal information. That includes their names, email addresses, postal addresses, order history, and payment details. We also do not receive your products, inventory, or order records.

How we use it. Each field is used for one thing: the primary storefront domain tells us which website to scan; the store name names your Rothbright workspace; the currency exists so that a subscription is charged in your own currency rather than ours; the myshopify.com domain identifies your installation; and the store owner’s email address is used to send you an alert when your score drops, which is a paid-plan feature. We do not send marketing email to that address, and we do not use any of this data for advertising, profiling, or training artificial intelligence or machine learning models.

What else we store about your store. Alongside those fields we keep the results of each scan — your score, your six pillar scores, and the findings behind them — which describe your public website rather than any person. We also keep your Shopify subscription identifier and the plan it grants, so that we can bill you and honour what you have paid for, and an encrypted copy of the Shopify access token. Tokens are never stored in plain text.

Erasing it. When you uninstall BrightScore, we immediately erase the stored access token and the store owner’s email address; holding contact details for a store that has removed the app serves no purpose. Shopify then sends a shop erasure request 48 hours after uninstall, and on receiving it we delete the installation record outright. We also answer Shopify’s two mandatory customer data requests — a customer data request and a customer redaction request — by confirming that we hold no customer data for your store, which is true of every store that installs BrightScore.

Log Data

We want to inform you that whenever you visit our Service, we collect information that your browser sends to us that is called Log Data. This Log Data may include information such as your computer’s Internet Protocol (“IP”) address, browser version, pages of our Service that you visit, the time and date of your visit, the time spent on those pages, and other statistics.

Cookies

Cookies are files with small amount of data that is commonly used an anonymous unique identifier. These are sent to your browser from the website that you visit and are stored on your computer’s hard drive.

Our website uses these “cookies” to collection information and to improve our Service. You have the option to either accept or refuse these cookies, and know when a cookie is being sent to your computer. If you choose to refuse our cookies, you may not be able to use some portions of our Service.

BrightScore for Shopify sets no cookies of its own. It runs inside the Shopify admin, where it authenticates each request with a short-lived token issued by Shopify rather than with a browser cookie.

Behavioural Advertising

We use information collected on the rothbright.com website to show you advertisements for products and services that may be of interest to you. We do not use data from BrightScore for Shopify, or any data obtained through the Shopify APIs, for this purpose.

You can opt out of targeted advertising through the Digital Advertising Alliance at https://optout.aboutads.info, the Network Advertising Initiative at https://optout.networkadvertising.org, or, in Europe, the European Interactive Digital Advertising Alliance at https://www.youronlinechoices.eu. You can also manage your choices at any time through the privacy controls in the footer of our website.

Google User Data

Connecting Google Analytics to Rothbright is entirely optional. If you choose to connect it, we ask Google for a single read-only permission (“analytics.readonly”) and use it for one purpose: to read the visit and engagement totals for the Google Analytics property you select, so that the impact we report for each issue in your Brightscore is based on your site’s real traffic instead of an industry estimate.

Specifically, we:

• read the list of Google Analytics properties your account can access, and the website address each one measures, so we can identify the property that belongs to the site being scored;
• read aggregate totals — sessions, users, engagement rate and average session duration — for that one property;
• store the resulting figures, and an encrypted credential that lets us refresh them, against your workspace.

We do not modify anything in your Google Analytics account, do not read data from properties other than the one connected, and do not use Google user data for advertising, profiling, or training artificial intelligence or machine learning models. We do not sell it, and we do not transfer it to third parties except where required by law.

Rothbright’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

You can disconnect Google Analytics at any time from the Connectors page in your account. Disconnecting deletes our stored credential and the traffic figures derived from it, and revokes our access at Google. Your Brightscore continues to work; it simply returns to using an estimated traffic baseline.

SMS/Text Messaging

If you opt in to receive text messages from Rothbright, we collect your mobile phone number and consent record to send the messages you requested. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties. Information sharing to subcontractors in support services, such as customer service or messaging platform providers, is permitted. You can opt out at any time by replying STOP.

See our SMS Terms & Conditions for details about the program, message frequency, and how to opt in or out.

Service Providers

We may employ third-party companies and individuals due to the following reasons:

• To facilitate our Service;
• To provide the Service on our behalf;
• To perform Service-related services; or
• To assist us in analyzing how our Service is used.

We want to inform our Service users that these third parties have access to your Personal Information. The reason is to perform the tasks assigned to them on our behalf. However, they are obligated not to disclose or use the information for any other purpose.

The providers that support BrightScore for Shopify are our cloud hosting and database providers, which store the data described above; our transactional email provider, which delivers score-drop alerts; and Shopify itself, which processes every subscription charge through the Shopify Billing API. We do not process card details: your payment method stays with Shopify and we never see it.

Sharing Your Personal Information

We share your Personal Information with the service providers described above so that they can perform services for us, and we may share it to comply with applicable laws and regulations, to respond to a subpoena, search warrant or other lawful request for information we receive, or to otherwise protect our rights.

We do not sell your Personal Information, and we do not sell or share data obtained through the Shopify APIs with anyone.

Data Retention

We keep the information described in this policy for as long as it is needed to provide the Service to you, and afterwards only where a law, a tax obligation, or an unresolved dispute requires us to.

For BrightScore specifically: uninstalling the app immediately erases the stored Shopify access token and the store owner’s email address, and the installation record is deleted in full when Shopify sends the shop erasure request that follows an uninstall. Billing records are kept for as long as accounting and tax law requires. For a Rothbright account, you may ask us to delete your account and the personal information held against it at any time using the contact details below.

Your Rights

If you are a resident of the European Economic Area or the United Kingdom, you have the right to access the personal information we hold about you, to ask that it be corrected, updated, or erased, and to object to or restrict how we process it. You may also have the right to lodge a complaint with your local data protection authority. To exercise any of these rights, contact us using the details below.

Please note that your information will be transferred outside of Europe, including to the United States, where Rothbright Inc and its hosting providers operate.

If you are a Shopify merchant, you may also exercise these rights through Shopify by submitting a data request from your Shopify admin; Shopify forwards such requests to us and we act on them as described in the BrightScore section above.

Security

We value your trust in providing us your Personal Information, thus we are striving to use commercially acceptable means of protecting it. Access credentials we hold on your behalf, including Shopify access tokens, are stored encrypted rather than in plain text. But remember that no method of transmission over the internet, or method of electronic storage is 100% secure and reliable, and we cannot guarantee its absolute security.

Links to Other Sites

Our Service may contain links to other sites. If you click on a third-party link, you will be directed to that site. Note that these external sites are not operated by us. Therefore, we strongly advise you to review the Privacy Policy of these websites. We have no control over, and assume no responsibility for the content, privacy policies, or practices of any third-party sites or services.

Children’s Privacy

Our Services do not address anyone under the age of 13. We do not knowingly collect personal identifiable information from children under 13. In the case we discover that a child under 13 has provided us with personal information, we immediately delete this from our servers. If you are a parent or guardian and you are aware that your child has provided us with personal information, please contact us so that we will be able to do necessary actions.

Changes To This Privacy Policy

We may update our Privacy Policy from time to time. Thus, we advise you to review this page periodically for any changes. We will notify you of any changes by posting the new Privacy Policy on this page. These changes are effective immediately, after they are posted on this page.

Contact Us

If you have any questions or suggestions about our Privacy Policy, or if you would like to make a complaint or exercise any of the rights described above, contact us by email at [email protected] or by post at 2590 Welton Street, Suite 200 #1033, Denver, CO 80205, United States.