Avis Privacy Policy

Last updated: 14 October 2026 · Effective: 14 October 2026

Avis is a Shopify app that collects, moderates and displays product reviews for online stores. This policy explains exactly what personal data the app handles, where each piece of it is stored, how long it is kept, and how it is deleted. It is written to be checkable against the app's behaviour rather than to be broad enough to cover anything.

1. Who we are

Avis (“Avis”, “we”, “us”) is operated by Hoang Nguyen, a sole trader trading as Avis, of 62/8/1A - 5A, Binh Hung Hoa A, Binh Tan, Ho Chi Minh City 700000, Vietnam. We are a sole trader rather than an incorporated company, which means the person named here is the one responsible under this policy — there is no separate company standing between you and that responsibility. We publish the Avis app on the Shopify App Store. Contact us about privacy at privacy@b2bgold.app.

In this policy, merchant means the business that installs Avis on its Shopify store, and shopper means that merchant's own customer or site visitor.

2. Two different roles, and why the distinction matters

We handle two categories of personal data under two different legal roles. Which role applies changes what rights you have and who you exercise them with.

3. What we collect

3.1 Merchant and store data

• Store identifiers — the numeric Shopify shop ID and the .myshopify.com domain.
• Shopify access tokens — an offline access token and a refresh token, used to call Shopify on the merchant's behalf between admin sessions. These expire and are refreshed automatically.
• Store profile — store name, store contact email, store owner name, currency and timezone, read from Shopify at install and kept current through the shop/update webhook. The store contact email is used as the reply-to address on review-request emails and to reach the merchant about the service.
• Plan and billing state — which plan is active, whether a trial has been used, the Shopify subscription identifier, and our offer record: whether the store holds a founding-store price and when its trial was extended for moving from another review app. We never see or store card details. All charges are made by Shopify through its own Billing API and appear on the merchant's Shopify invoice.
• App configuration — the merchant's own settings. See section 4.
• Notification recipients — up to five addresses the merchant chooses for new-review and new-question alerts and the monthly metrics email (by default the store's contact email).
• Support correspondence — what a merchant sends us by email, and our replies.

3.2 Shopper personal data

Avis handles shopper personal data in the situations below, and only these.

1. A shopper submits a review, a question, or an answer to another shopper's question. We record the name they type, their email address if they provide one (optional for an answer, where we use it only so that a deletion request can find the answer), the rating, the review title and body, any photos or videos they attach, and the product. If they arrived from a review-request link we also record the matching order reference so the review can be labelled as a verified purchase. We additionally store a salted hash of their IP address for abuse prevention — never the address itself. A “helpful” vote records only a salted hash of IP address, user agent and store, which lets us count one vote per person without identifying anyone. Where the store asks them, we also record the reviewer's answers to the store's own review questions (for example fit or skin type), the product variant they bought, and an optional review of the store itself. Photos and videos are uploaded straight into the merchant's Shopify Files. A reviewer who wrote from an emailed link can later edit or delete their review through a signed link in their thank-you email. A shopper who asked a question is emailed once when it is answered. A signed-in customer who opens “Write a review” from their order page in their customer account is identified by the Shopify customer ID in that page's session, which we use only to check the order is theirs.
2. The store rewards reviews. If the merchant offers a discount for reviews, we create the reviewer's discount code in the merchant's Shopify store and record which review earned it, together with a hash of the reviewer's email address and their customer ID, so the code can be locked to them, emailed to them, and matched when an order uses it.
3. The merchant asks us to send a review request. When an order is paid, fulfilled or delivered (whichever the merchant chose), Shopify sends us the order's customer name, email address, order reference, the products, the customer's language, the customer's tags (so the merchant's exclusions, such as a NOREVIEW tag, are honoured) and the order's shipping country — used only to time the email and choose its language — so we can send the review request the merchant configured, and at most three reminders. We record when the review page was opened from the email and, only for customers who accepted email marketing, when the email was first opened (a one-pixel image in the message); no other tracking is used. A shopper who writes a review may then receive the follow-ups the merchant switched on: a thank-you email, a reminder to add a photo, a notice when the merchant replies, a reminder before their reward expires, or a request from the merchant to update their review. Section 6 covers consent.
4. A shopper asks for a review link. A store's public review page asks for the email address used at checkout. We look up that address's most recent order in the merchant's store and, if there is one, email the review link for it. The page answers the same way whether or not an order exists, so it cannot be used to find out who shops there.
5. The merchant imports reviews from a previous review app. The uploaded file contains whatever that app exported — typically reviewer names, email addresses, ratings and review text. We process it to create the reviews, and to award a verified-purchase badge we look up whether each reviewer's email address matches a real order in the merchant's store. Instead of a file, a merchant can give us the API keys of their previous review app (Judge.me, Loox, Yotpo or Klaviyo Reviews): we use them only to read the merchant's reviews from that app (the same kind of data the file holds, plus, from Judge.me and Loox, the Shopify customer identifier of each reviewer, so a later deletion request finds the review), and we delete the keys as soon as the reading ends, fails or is canceled.
6. A shopper joins the store's referral program. A shopper who asks for a share link (after a positive review, on the checkout thank-you page, or on the store's referral section) gives us their email address and, optionally, a name; we store them with the link, a count of its clicks and the rewards earned. When a friend's paid order uses the link's code, we record the order reference and total and, to check the order is not the shopper referring themselves or a repeat, only a hash of the friend's email address and their Shopify customer ID. The shopper's reward code is created in the merchant's store and emailed to them.
7. The merchant connects another service. When a merchant connects one, we send it only the events the merchant chose, and each receives only what it needs:
   • the merchant's own webhook endpoints receive the review as it appears on the storefront — never an email address;
   • Klaviyo or Omnisend receive the review together with the reviewer's email address, so the provider can attach it to the customer's profile in the merchant's own account — and, only if the merchant lets that provider send review requests instead of us, the customer's name, email address, order reference and review link;
   • Shopify Flow receives the review with the Shopify customer and order IDs when they are known;
   • the merchant's Google Shopping reviews feed publishes their published product reviews with each reviewer's name in the same form the storefront shows it, at a secret address the merchant controls and can change;
   • Slack receives a short notice of a new review or question — rating, product, an excerpt and a link into the merchant's admin, never an email address;
   • Gorgias receives, for reviews at or below the rating the merchant chose, a support ticket with the review and the reviewer's name and email address, so the merchant's team can follow up. The review itself is published exactly as it would be otherwise;
   • Mailchimp receives the same events as Klaviyo or Omnisend, on the matching contact in the merchant's own audience — we never add anyone to an audience;
   • Shopify's Shop app, when the merchant turns it on and Shopify has approved the app for it: each product review is copied into the merchant's own store as a standard Shopify “product review” record (the reviewer's name in the form the storefront shows it, the Shopify customer and order references when known, the rating, text, reply and photo links). Only published reviews are marked live; Shopify decides which of those to show in the Shop app. Reviews shoppers write in the Shop app come back to Avis the same way.
   Addresses are looked up when a delivery is sent rather than kept in the queue, and removed from a queued review request once it has been handed over. These services are chosen by, and contracted with, the merchant.
8. The merchant uses AI features. Review text, ratings, the product's title, the store's own reply and review photos (a reduced 640-pixel copy) are processed by AI models to summarise a product's reviews, pick a key sentence, compose a review story, draft a reply for the merchant, translate a review a shopper asks to translate, describe photos for screen readers, flag abusive content or personal data for the merchant's attention, sort reviews into topics and a sentiment for the merchant's own analytics, offer the topics as filters shoppers can tap on a product page, with one sentence on what reviewers say about each (neither topics nor sentiment are ever used to publish or hide a review, and sentiment is never shown to shoppers), and draft frequently asked questions from a product's reviews for the merchant to approve. When a merchant imports a file of reviews that Avis does not recognise, an AI model also matches the file's columns to review fields: it sees the column names, the shape of each column, and sample values only from columns that cannot identify a person (such as ratings, dates and review text). Reviewer names, email addresses, order references and customer IDs are never sent to a model, and email addresses or phone numbers a reviewer typed into their text are masked before it is. Most of these models run on Cloudflare's own infrastructure (Workers AI). The review summary (and the review story made with it) and the matching of an imported file's columns use Google's Gemini model, through Google's paid Gemini API, under terms that do not let Google use the data to improve its products; if it is unavailable, a Workers AI model does the work instead. AI-written text is labelled as such on the storefront, and nothing is sent to any other AI provider.
9. The merchant asks Shopify Sidekick about their reviews. Sidekick is the assistant in the merchant's own Shopify admin. When the merchant asks it about their reviews, review requests or product questions, Avis answers inside that admin session, as the merchant: review and question text, ratings, product names, statuses, dates and counts, and each reviewer's or asker's name in the form the storefront shows it. Never the reviewer's email address, customer ID or order ID; review text is passed as the reviewer wrote it, and an order number appears only when the merchant asks about that order. Replies, answers and emails Sidekick drafts go into the merchant's own Avis pages and are posted or sent only when the merchant presses the button. Sidekick is part of the merchant's Shopify platform, governed by their agreement with Shopify.

3.3 What we deliberately do not collect

• No phone numbers and no postal addresses. Shopify's order data includes a shipping address; we read only its country code, to time emails, and keep nothing else from it.
• No tracking of shoppers across sites. The storefront widget sets no advertising cookies, loads no third-party trackers, and builds no shopper profiles.
• No raw IP addresses in storage. Only salted hashes, as described above.
• No personal data in our operational logs. Our logs record store domains, record identifiers, status codes and counts. They never contain an email address, a reviewer name or review text.
• No payment card data, ever.
• No marketplace scraping. Avis does not import reviews from AliExpress, Amazon or any other marketplace.

4. Where the data lives

This is unusual enough to state plainly: most of what Avis produces is stored in the merchant's own Shopify account, not in our database. That is a deliberate design choice, so that a merchant's reviews remain theirs and survive leaving us.

Review images and videos are copied into the merchant's Shopify Files rather than served from our servers or from a previous vendor's CDN. They remain in the merchant's file library after the app is uninstalled, by design, so their storefront does not break.

5. Why we process it

We do not use any of this data for advertising, we do not sell it, and we do not share it with data brokers.

6. Review-request emails and consent

A review request is unsolicited outbound email to a shopper. Two protections apply and neither can be turned off by a merchant.

• We read Shopify's marketing consent state before the first send. If the customer's state is unsubscribed or redacted, no email is sent. This applies to manual sends too.
• Every email to a shopper carries a one-click unsubscribe — a link in the message and the standard one-click header mail providers show as an “Unsubscribe” button. An opt-out is stored as a hash of the email address, is permanent for that store, and is checked before every later send. We keep the hash rather than the address precisely so that the opt-out record itself holds no readable personal data.

Beyond that, the merchant chooses one of three consent modes. By default, a customer who accepted marketing receives the full request, and a customer who did not receives a plain, transactional request with no discount or other offer in it. The merchant may instead send only to customers who accepted marketing, or send the full request to everyone who has not opted out. Merchants remain responsible for having a lawful basis to email their own customers in their own jurisdiction.

7. Who we share data with

We do not sell personal data and we do not share it for cross-context behavioural advertising. We use a deliberately small number of sub-processors.

The alerting channel above is a deliberate exception rather than an oversight, so it is listed with the rest: it tells us an install happened and relays feedback a merchant typed into the app. It receives no shopper personal data, and nothing about a customer of yours is sent to it under any circumstance.

Services a merchant chooses to connect — Klaviyo, Omnisend, Mailchimp, Slack, Gorgias, Shopify Flow, their own webhook endpoints, and Google Merchant Center through the reviews feed — are not our sub-processors: they are the merchant's own providers, contracted by the merchant, and receive data only after the merchant connects them and only the events the merchant chose (section 3.2). The same holds for a previous review app a merchant imports from through its API (Judge.me, Loox, Yotpo or Klaviyo Reviews): it is the merchant's own provider, we only read from it, and we send it nothing but the API keys the merchant gave us and, for Judge.me, the merchant's store domain.

Shopify is the merchant's own platform provider and their existing agreement with Shopify governs it. We also disclose data where we are legally required to, or to establish or defend legal claims. We will tell affected merchants about a legally compelled disclosure unless we are prohibited from doing so. A current list of the sub-processors that handle personal data on a merchant's behalf is maintained in the DPA, Annex III. The alerting channel above is not on it, because it receives none; the DPA says so beneath that list.

8. International transfers

Our infrastructure runs on Cloudflare's global network and data may be processed outside the country where a merchant or shopper is located. Where personal data is transferred out of the UK or the European Economic Area, we rely on the European Commission's Standard Contractual Clauses, together with the UK International Data Transfer Addendum where the UK GDPR applies. These are incorporated into our DPA and are available to merchants on request.

9. How long we keep it

Reviews, star ratings and review media that we wrote into the merchant's own Shopify metafields and Files stay in the merchant's Shopify account after uninstall, because they belong to the merchant. The Data and privacy tab of the app's Settings page reports exactly what exists there and can clear the metafield values on request.

10. Security

• All traffic is encrypted in transit with TLS. Data at rest is encrypted by our infrastructure provider, including backups.
• Every request to our API is authenticated — by a Shopify session token, a verified webhook signature, a signed app-proxy request, a signed, time-limited email link, or a hashed API key — and the reviews feed a merchant publishes to Google, by the secret token in its address. Nothing is served on the strength of a store domain alone.
• Development and production run as entirely separate applications, with separate databases and separate credentials. Live merchant data is never copied into development.
• Access to production systems is limited to the account owner. There are no shared credentials and no internal console that browses merchant data.
• IP addresses and voter identities are stored only as salted hashes, and personal data is kept out of logs by design rather than by redaction after the fact.
• API keys are stored hashed and shown to the merchant exactly once, at creation.
• The API keys of services a merchant connects, and the signing secrets of their webhook endpoints, are encrypted at rest (AES-GCM). Every webhook we send is signed so the receiver can verify it came from us.
• The API keys a merchant gives us to import their reviews from a previous review app are encrypted at rest (AES-GCM), used only to read those reviews, never shown back, and deleted as soon as the reading ends, fails or is canceled.

No system is perfectly secure. Our breach notification commitments to merchants are in the DPA.

11. Your rights

Merchants

Where we are the controller, you may ask us to give you a copy of your data, correct it, delete it, restrict or object to its processing, or provide it in a portable format. Write to privacy@b2bgold.app. We answer within 30 days. You may also complain to your data protection authority; in the EU that is the authority where you live or work, and in the UK it is the Information Commissioner's Office.

Shoppers

If you left a review on a store or received a review request, the merchant is the controller of that data. Contact the store directly. If you contact us instead, we will pass your request to the relevant merchant and help them act on it, but we cannot delete or disclose their data on our own initiative.

To stop review-request emails immediately, use the unsubscribe link in any of them. It is honoured permanently for that store and needs no account.

California residents

We do not sell personal information and we do not share it for cross-context behavioural advertising, as those terms are defined by the CCPA as amended by the CPRA. Where we process shopper personal information we do so as a service provider to the merchant, only for the purposes in our written contract with them. We do not retain, use or disclose it for any other purpose, and we do not combine it with data from other sources. California residents may exercise their rights through the merchant whose store they used.

12. Shopify's mandatory privacy webhooks

Shopify requires every app to implement three privacy endpoints, and Avis implements all three as real handlers rather than acknowledgements.

• Customer data request. We record the request with a 30-day deadline and list it in the app under Settings, on the Data and privacy tab, where the merchant can download the complete package of that customer's data to hand over. Shopify requires the merchant, not the app, to make the disclosure.
• Customer redaction. We find every record matching that customer by ID or email address and remove the personal data: reviewer names and email addresses are anonymised, review-request records and queued emails are deleted, discount codes are unlinked from them, deliveries to connected services that name them are deleted, AI summaries that quote their review are regenerated, their referral record is deleted and referred orders they placed are unlinked from them, IP hashes are cleared, votes are removed, imported row data is stripped of author fields, and moderation notes are redacted. The review text itself remains, now unattributable, because deleting published content is the merchant's decision.
• Shop redaction. We delete the store's data in full — reviews and their answers, media records, requests and queued emails, discount-code and referral records, imports, questions, AI summaries and translations, connected-service settings and delivery logs, moderation log, API keys and the store record itself. Only the trial record and the offer record described in section 9 survive, and they hold no personal data.

13. Children

Avis is a business tool sold to merchants and is not directed at children. We do not knowingly collect personal data from children. If you believe a child has submitted a review containing their personal data, contact the store, or write to us and we will help the merchant remove it.

14. Changes to this policy

We will update this page when the app's data handling changes, and change the date at the top. For changes that materially affect merchants we will give notice in the app or by email before they take effect. Continued use after a change means acceptance of the updated policy.

15. Contact

• Privacy: privacy@b2bgold.app
• Support: support@b2bgold.app
• Postal: Hoang Nguyen, a sole trader trading as Avis, 62/8/1A - 5A, Binh Hung Hoa A, Binh Tan, Ho Chi Minh City 700000, Vietnam

Our representatives in the EU and UK

We have not appointed one, and we would rather say so than leave the question unanswered. Article 27 of the UK and EU GDPR asks a controller or processor established outside those territories, which we are, to designate a representative there. We are working on it. Until we have, write to privacy@b2bgold.app, which is monitored and is the fastest route to us in any case. This does not reduce any right you have, and it does not change our obligations to you by one word.

This policy is governed by the laws of Vietnam, without prejudice to any mandatory consumer or data protection rights available to you locally — a choice of law cannot take away a right your own jurisdiction gives you.