Privacy Policy

This Privacy Policy explains how Out of the Box Systems ("Obox", "we", "us") handles information in connection with the Obox 3D Jewelry Configurator app for Shopify (the "App") and the website jewelshop.ai (the "Site"). It is written to be read alongside our Terms of Service.

1. The short version

The App is a storefront display widget. It requests no Shopify permission scopes and does not collect, store, or transmit personal data about shoppers. A shopper who rotates a ring or switches its metal and stone does so entirely in their own browser — those choices are not sent to us. The only information we store is what is needed to run a paid subscription: which store installed the App and whether its subscription is active. We never see or store payment card details — billing is handled by Shopify.

2. Information we store

To operate the subscription and licensing for the App, we store store-level information:

• the store's Shopify domain (e.g. your-store.myshopify.com);
• the App subscription status (active / inactive) and plan;
• the website origin(s) authorised to display the configurator;
• a license identifier and the date the record was last updated.

This information relates to a store, not to an individual person. We do not store shopper names, email addresses, shipping or billing addresses, order contents, or payment information.

3. Information we do not collect

Because the App requests no data-access scopes, it has no access to your customers, orders, products, or checkout beyond displaying the configurator on a product page. Shopper interactions with the 3D viewer stay in the shopper's browser.

4. Payments

App subscriptions are billed exclusively through the Shopify Billing API. Payment is handled by Shopify under Shopify's own terms and privacy policy. We receive only the resulting subscription status (active or cancelled) — never card numbers or bank details.

5. GDPR / data-request webhooks

Shopify requires apps to respond to mandatory compliance webhooks. We honour them as follows:

• customers/data_request — we hold no customer data, so there is nothing to return.
• customers/redact — we hold no customer data, so there is nothing to delete.
• shop/redact — when a store uninstalls the App, we deactivate and remove its store-level license record.

Each webhook is verified by cryptographic signature before it is acted on.

6. The jewelshop.ai website

The Site is our marketing and documentation site. It uses privacy-friendly, cookieless traffic analytics to understand aggregate visits, and may use Google Analytics where enabled. Our servers keep standard technical logs (such as IP address and browser type) for security and reliability. The Site does not sell personal data.

7. Data retention

We retain a store's license record for as long as the App is installed. When the App is uninstalled, the record is deactivated and removed as described in Section 5. Technical logs are kept only as long as needed for security and operations.

8. Sub-processors

We rely on a small set of infrastructure providers to run the service — hosting for the App backend and Site, and Shopify for installation and billing. These providers process data only to deliver their service to us.

9. Your rights

Depending on where you are, you may have rights to access, correct, or delete personal data we hold about you. Because our App stores no shopper personal data, most such requests concern the merchant contact for a store. To exercise any right, contact us at the address below.

10. Changes to this policy

We may update this policy from time to time. When we do, we will revise the effective date at the top of this page. Material changes will be communicated where appropriate.

11. Contact

Out of the Box Systems
1621 Central Ave, Cheyenne, WY 82001, United States
[email protected]