Your EveningsPrivacy notice: Your Evenings Shopify app pilot
Last updated 24 October 2026.
This notice covers the private pilot of our Shopify app, the EU Product Identifier Check app ("the app"), only. The pilot is for businesses. Most of what the app handles is product data, which isn't usually personal information. The personal information we handle is mostly about the people who run or work for a pilot store. The $49 Check has its own notice at yourevenings.com/check/privacy, and visits to our web pages are covered by yourevenings.com/privacy.
Who we are
Your Evenings Ltd is the controller. We're registered in England and Wales, company number 17185055. Registered office: 66 Paul Street, London, EC2A 4NA. Email: hello@yourevenings.com. ICO registration number: ZC183075.
What the app can access
When you install the app, Shopify asks you to approve one permission, write_products, which also lets the app read products. We use it to read your products and variants, their barcodes, the "Has no standardized identifier" declaration, and the HS code and country of origin on each item, and to record that declaration on the variants you confirm. The app doesn't ask for access to your customers or orders, and holds no customer, order or payment data.
What we collect
- Your store: your shop domain, and the access token Shopify gives the app so it can work in the background. We store the token encrypted.
- Product data: product and variant IDs, titles, SKUs, barcodes, HS codes, country of origin and readiness status from each scan.
- Runs and the audit log: each preview, apply and undo, what changed and when, and who confirmed it. We record the staff member by their Shopify staff user ID only, not their name or email address.
- Joining the pilot: the email address you reply from, your store name and URL, the terms version you agreed to and when.
- Emails and feedback: your email address, name, signature details, your messages and any feedback you give.
- Technical logs: Cloudflare keeps short-lived logs of requests to the app, such as the time, the page or action requested and any errors. These can include your shop domain.
Why we use it
| Purpose | Lawful basis (UK GDPR) |
|---|---|
| Running the checks, previews, ticks and undo you ask for | Contract, if you're a sole trader or partnership; otherwise legitimate interests in providing the app your business installed |
| Recording that your store agreed to the pilot terms before the bulk tick can be used | Legitimate interests: running the pilot safely and keeping a record |
| Keeping the audit log, so your business has a record of what was declared, when and by whom | Legitimate interests: a reliable record, and being able to investigate and reverse mistakes |
| Keeping the app secure and working, including the access token, the kill switch and technical logs | Legitimate interests: security and reliability |
| Answering questions, support and feedback, and improving the app | Legitimate interests |
| Quoting your feedback publicly with your store name, as the pilot terms say | Legitimate interests. We never publish your own name or email address with a quote, and we stop if you ask |
| Handling Shopify's privacy requests | Legitimate interests: meeting Shopify's rules for apps |
We don't send marketing emails.
Who we share it with
We use service providers ("processors") who handle information for us:
| Provider | What for | Where |
|---|---|---|
| Cloudflare (D1 database) | Storing everything the app holds for your store: access token, scans, runs, audit log and pilot sign-up record | European Union |
| Cloudflare (Workers, Queues, KV, logs) | Running the app's code, its background jobs, the kill switch and technical logs | Cloudflare's global network, so this may be outside the UK. Background jobs and kill-switch records hold your shop domain and internal IDs only |
| Cloudflare (Email Routing) and Cursor | Our hello@yourevenings.com mailbox, where your emails, sign-up and feedback arrive | United States |
| Zoho (EU service) | Our director's mailbox (matt@yourevenings.io), if you email it or reply to an email from it | EU (the Netherlands and Ireland). Zoho support staff in India may access it in rare cases |
| Cursor (Anysphere, Inc.), our AI assistant provider, which runs our work computer | Reading your emails and feedback, and supporting your store | United States |
| The AI model providers Cursor uses to run our AI assistants | Answering your questions and supporting your store | Outside the UK, including the United States |
Shopify isn't our processor. The app runs inside your Shopify admin, and Shopify's own handling of your store data is covered by Shopify's privacy policy. There are no payments in the pilot, so we don't use a payment provider for it.
We may also share information with our professional advisers, or with authorities where the law requires it. We don't sell personal information.
Transfers outside the UK: - Cloudflare stores the app's database in the EU, which UK law recognises as giving adequate protection. It runs the app's code, background jobs, kill switch and logs on its global network, and passes emails sent to hello@yourevenings.com on to our mailbox at Cursor, so it may handle them in the United States or other countries. Cloudflare's data processing addendum relies on the UK Extension to the EU-US Data Privacy Framework where it applies, and otherwise on the EU standard contractual clauses with the UK Addendum. - Zoho stores our director's mailbox in the EU. If Zoho's support staff in India need to access it, Zoho relies on standard contractual clauses. - Cursor and the AI model providers it uses hold our hello@ mailbox and process information in the United States, and may process it in other countries outside the UK. Cursor's privacy policy says it requires an adequate level of data protection when it transfers information outside the UK.
How long we keep it
- Scan results: deleted after 30 days. The app re-scans when you open it. The raw file Shopify gives us for a scan is deleted once we've read it.
- Runs, the audit log and your pilot sign-up record: kept while the app is installed, because they're your record of what was declared and when. You can download the log at any time.
- When you uninstall: Shopify sends us a deletion request 48 hours later ("shop/redact"). We then delete everything the app holds for your store, including the access token, the audit log, your sign-up record and your store's kill-switch records. Please download the log before you uninstall. Ticks already made stay in your Shopify admin.
- Technical logs: deleted by Cloudflare after 3 days.
- Emails, sign-up emails and feedback: deleted 12 months after the last message. Feedback we've quoted with your permission stays published until you ask us to remove it.
Shopify's privacy requests
We handle Shopify's mandatory privacy requests (customers/data_request, customers/redact and shop/redact). The app holds no customer data, so customer requests are logged and acknowledged. Shop deletion requests are carried out as described above.
Your rights
You can ask to access, correct or erase your personal information, or to restrict how we use it. Where we rely on contract, you can ask for a portable copy. We don't make decisions about you by automated means alone.
Your right to object: where we rely on legitimate interests, you can object at any time, including to being quoted. We'll stop unless we have compelling grounds to continue or need the information for a legal claim.
Email hello@yourevenings.com to use any right. We'll reply within one month, normally free of charge. You can also uninstall the app at any time, and we'll delete your store's data as described above.
We need a contact email and your store name and URL to run the pilot.
Security
We store the Shopify access token encrypted, and only the people who need your store's data to run the pilot can reach it. The bulk tick only works for stores that have agreed to the pilot terms, and we can switch it off for every pilot store at once. Our work computer is a separate virtual machine that other Cursor customers can't reach.
Complaints
Please tell us first at hello@yourevenings.com. You can also complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint
Changes
We'll update the date at the top if we change this notice, and tell pilot stores first if a change materially affects information they've already given us.