Mobile App (provisional name): Privacy Policy
Last updated: 10 November 2026
This notice explains how Made in Evolve S.r.l. processes personal data in connection with Mobile App (provisional name) (the Service), which creates the native iOS mobile app of a Shopify store. It is provided pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR). The use of the Service is governed by the Terms of Service. The Service is being launched: this notice will be completed before it is made available to the public.
1. Controller, processor and contact details
Made in Evolve S.r.l., Via Rosalba Carriera 26, 41126 San Damaso, Modena (MO), Italy, Tax Code and VAT no. 03497200364, REA MO-392876.
| Channel | Reference |
|---|---|
| Data protection email | privacy@madeinevolve.com |
| General email | hello@madeinevolve.com |
| Certified email (PEC) | madeinevolve@pec.it |
| Telephone | +39 059 788 0854 |
| Form for privacy requests | /policy/data-removal |
The Service involves two different roles:
| Data subjects | Data | Role of Made in Evolve |
|---|---|---|
| Merchant and its staff | Store domain, access credentials issued by Shopify, configuration of the mobile app (content of the home page, branding, settings), staff login sessions to the management panel, contact details of the people the Merchant indicates for the project and for support, billing data and, where the Offer provides for a commission, the total of the orders placed through the app. | Made in Evolve is controller |
| End Users | Data of their customer account with the store, if they log in (name, email, orders, favourites), read and written on Shopify; cart and checkout handled by Shopify; push token and profile (including anonymous) on the Merchant’s Klaviyo account, with the events “added to/removed from favourites”, “notification opened” and “order placed in app” (total and products, without addresses or phone number); content and sending of the push notifications and campaigns that Made in Evolve manages for the Merchant. | The Merchant is controller; Made in Evolve is processor |
If you are a customer using a store’s mobile app, the controller of your data is the store whose app you are using: its privacy notice, available in the app and on its website, tells you how your data are used and how to exercise your rights. Made in Evolve processes your data only on the store’s instructions, under the data processing agreement signed with the store.
The Controller has not appointed a Data Protection Officer (DPO), as the conditions of Article 37 GDPR are not met.
2. What the Service does
The Service creates the native iOS mobile app of the Merchant’s Shopify store. The catalogue and the home page of the app are managed by the Merchant on Shopify; customers of the store can browse products, save favourites, add products to the cart and complete the purchase through the checkout, and receive push notifications that the Merchant sends through its own Klaviyo account. The mobile app carries the Merchant’s name and brand and is used by its customers (the End Users).
The app is published on the Apple App Store under the Merchant’s Apple Developer account: the Merchant appears as the developer and is responsible for the privacy information Apple requires (the “privacy label”), which Made in Evolve prepares on its behalf on the basis of this notice. Made in Evolve accesses the account as a member of the Merchant’s team, only to publish and update the app.
3. Purposes and legal bases (Merchant data)
| Purpose | Legal basis |
|---|---|
| Setting up, publishing and operating the mobile app for the Merchant | Performance of the contract (Art. 6(1)(b) GDPR) |
| Managing plans and billing | Performance of the contract (Art. 6(1)(b)) and legal obligations (Art. 6(1)(c)) |
| Support and communications about the Service | Performance of the contract (Art. 6(1)(b)) |
| Security, error diagnosis and prevention of abuse | Legitimate interest (Art. 6(1)(f)) |
End User data are processed only to provide the functions of the mobile app on behalf of the Merchant. Made in Evolve does not use End User data for its own purposes, does not sell them, does not use them for advertising and does not use them to train artificial intelligence models.
4. How the app works for End Users
The mobile app communicates directly with Shopify (catalogue, cart, customer account, checkout) and with the Merchant’s Klaviyo account (push notifications): End User data do not pass through Made in Evolve’s servers; Made in Evolve only runs the server of the panel the store’s staff use to configure the app.
- Login: through the Shopify customer account (code sent by email); credentials stay in the phone’s keychain. Face ID, if enabled, is only used to unlock the app and recognition takes place on the phone.
- Favourites and searches: favourites are saved on the phone and, if the End User logs in, also in their customer profile on Shopify; searches stay on the phone.
- Payments: purchases are completed through Shopify’s checkout (Shopify Checkout Sheet Kit) and, where enabled, Apple Pay. Neither the app nor Made in Evolve receives or stores payment card data.
- No analytics or tracking: the app uses no analytics, crash reporting or advertising tools and does not track End Users across third-party apps or websites.
- Push notifications: the app registers the push token directly on the Merchant’s Klaviyo account, only if the End User allows notifications; the End User can turn them off at any time in the phone settings.
- Account deletion: the End User can ask from within the app to delete their customer account; the request is handled by the Merchant.
5. Retention
Merchant data are kept for the duration of the contract and then deleted within 30 days of its end, except for the data that must be kept to comply with legal obligations (accounting documents: 10 years, Article 2220 of the Italian Civil Code). Login sessions to the panel are deleted when they expire or at the end of the contract. End User data are kept on Shopify and on the Merchant’s Klaviyo account, according to the rules the Merchant sets; at the end of the contract Made in Evolve holds no End User data. Technical logs of the panel are kept for no longer than 12 months.
6. Recipients and sub-processors
| Party | Activity | Role |
|---|---|---|
| Shopify International Limited (Ireland) | Platform of the store: catalogue, customer accounts, cart and checkout | Independent controller / Merchant’s provider |
| Apple Distribution International Ltd. (Ireland) and Apple Inc. | Distribution of the app on the App Store, delivery of push notifications (Apple Push Notification service), Apple Pay where enabled | Independent controller |
| Klaviyo, Inc. (United States) | Registration of push tokens and sending of notifications and communications through the Merchant’s Klaviyo account | Merchant’s provider |
| DigitalOcean, LLC (United States, servers in the EU) | Hosting of the management panel server | Processor |
The up-to-date list of sub-processors is set out in the data processing agreement signed with the Merchant.
7. Transfers outside the European Economic Area
Some of the parties listed above (Apple, Klaviyo, DigitalOcean, Shopify) have their parent companies outside the European Economic Area. Where personal data are transferred, or may be accessed, outside the EEA, the transfer takes place on the basis of an adequacy decision of the European Commission (including, for US providers that participate in it, the EU-US Data Privacy Framework) or of the Standard Contractual Clauses adopted by Decision (EU) 2021/914. A copy of the safeguards can be requested at privacy@madeinevolve.com.
8. Management panel on Shopify
The panel the Merchant uses to manage the app’s home page, shipping and communications is a custom app installed only on the Merchant’s store, not distributed on the Shopify App Store. It only keeps the login sessions of the store’s staff and holds no End User data.
9. Your rights and how to exercise them
Under Articles 15 to 22 GDPR you may ask at any time and free of charge for access to your data and a copy of them, rectification, erasure, restriction of processing, portability of the data you provided, and you may object to processing based on legitimate interest. Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of the processing carried out before.
Requests can be sent through the privacy request form or by email to privacy@madeinevolve.com. We reply within one month of receipt, extendable by two further months where necessary given the complexity or number of requests (Article 12(3) GDPR). The end of the Service does not limit these rights.
If you are a user of a store’s mobile app, the store is the controller of your data: please contact it first. Requests received directly by Made in Evolve are forwarded to the store without undue delay, and we assist the store in responding.
If you believe that the processing infringes the GDPR, you may lodge a complaint with the Italian supervisory authority, the Garante per la protezione dei dati personali, or with the authority of the Member State where you live or work.
10. Changes to this notice
This notice may be updated when the App, its providers or the applicable rules change; the date at the top shows the latest version. Substantial changes (new categories of data, new purposes, new sub-processors or different retention periods) are announced to Merchants before they take effect.
11. Contacts
For any question about this notice or about the processing of personal data through the Service, write to privacy@madeinevolve.com.