This policy explains what personal data the EzEventz app processes when it is installed on a Shopify store, how and why we process it, how long we keep it, and how it is deleted.
EzEventz is operated by DiLight Entertainment UG (haftungsbeschränkt) ("EzEventz", "we", "us"). For questions about this policy or about the data we process, contact us at privacy@dilight.website.
When EzEventz is installed on a merchant's Shopify store, the merchant is the data controller for their customers' and attendees' personal data, and EzEventz acts as a data processor on the merchant's behalf, processing store data only to provide the app's features. For our own account, billing and audit records, we act as the controller.
EzEventz turns Shopify orders into event tickets, delivers those tickets, and checks attendees in at the door. To do that it reads and stores the minimum data needed:
.myshopify.com domain, the OAuth access token
issued at install (stored encrypted, never shown in plain text in the UI), your plan and billing status, and app
settings (event and ticket-tier mappings, seat maps and seat reservations, ticket design, delivery-channel and
check-in configuration).We do not process payment card details. Access to store data is limited to the Shopify scopes granted at
install: read_products, write_products, read_orders,
read_customers, read_inventory, read_locations.
Where the GDPR applies, we process data on the basis of performance of a contract (Art. 6(1)(b)) with the merchant and our legitimate interest (Art. 6(1)(f)) in providing and securing the service. For customer and attendee personal data, the merchant's own privacy policy and legal basis govern the underlying processing; we act only on the merchant's documented instructions.
We do not sell personal data. We share data only with the providers needed to run the service:
We keep store, order, ticket, attendee and check-in data only as long as needed to provide the service to the
merchant — for example so tickets stay valid, seats stay reserved, and check-in history and audit logs remain
available for the event and for reconciliation. Operational logs (audit and ticket-transition history) are capped
and rotated. When the app is uninstalled, or on a Shopify shop/redact request, we purge the store's
data as described below.
EzEventz implements Shopify's three mandatory compliance webhooks (all delivered to a single signed endpoint and dispatched by topic):
customers/data_request — we record the request so the merchant can fulfil the data-subject access
request; EzEventz cannot return store data inline.customers/redact — we remove the identified customer's personal fields from that store's
attendee and related records.shop/redact — sent by Shopify after the store uninstalls the app (~48h later); we purge all of
that store's data (orders, tickets, attendees, seat reservations, deliveries, settings and related records).Store customers and attendees should direct data-subject requests to the merchant (the controller). Merchants can reach us at privacy@dilight.website for assistance.
The app uses Shopify's OAuth for install, verifies every inbound webhook (including the GDPR compliance webhooks) with HMAC signatures, stores access tokens encrypted, and serves all traffic over TLS. The standalone door-scanner runs on its own top-level page authenticated by a short-lived scan token. Access to store data is scoped to the permissions granted at install.
The embedded admin relies on Shopify App Bridge session tokens rather than tracking cookies. These marketing pages may set a small preference cookie to remember your chosen language. We do not use advertising cookies.
We may update this policy as the app evolves. Material changes will be reflected on this page with a new "Last updated" date.
DiLight Entertainment UG (haftungsbeschränkt) · privacy@dilight.website · dilight.website