Privacy policy
Last updated 28 August 2026
This policy explains what the Wrapt app for Shopify collects, why, and what happens to it. It covers the app, this website and the support address. Wrapt is operated by Swonie Creative Design (“we”).
Who we are
Swonie Creative Design is the data controller for the data described in this policy, and under Law No. 6698 on the Protection of Personal Data is the veri sorumlusu.
Swonie Creative Design
Aksoy Mah. Yalı Bul. No: 386, Kat: 2 D: 2, Karşıyaka / İzmir, Türkiye
Privacy and data protection enquiries: [email protected]
App support: [email protected]
Telephone: +90 (850) 309 62 78
We are established in Türkiye. We have not appointed a representative under Article 27 of the GDPR, because our processing is not directed at individuals in the EU or UK — merchants install this app themselves. Requests from anywhere are answered at the address above.
The short version
Wrapt does not request, receive or store personal data about your customers. It asks Shopify for permission to manage products and to publish one to your Online Store, and for nothing else. It has no access to your customers, your orders or your checkout.
Gift messages your shoppers write are attached to the order inside Shopify as a line item property. They pass through your storefront to Shopify’s cart. They are never sent to us and we never store them.
What we store
| Data | Why | Kept for |
|---|---|---|
Your shop’s .myshopify.com domain | To know which configuration belongs to which store | Until 48 hours after uninstall |
| Your wrap styles — the name, price and position of each, and the id of the Shopify variant it maps to | This is the app’s configuration | Until 48 hours after uninstall |
| Setup timestamps — when you last published, and whether you ticked off the theme step | To show whether your storefront is up to date | Until 48 hours after uninstall |
| A Shopify session record, including the access token Shopify issued to the app | Required to call Shopify’s API on your behalf. Wrapt requests offline access, so this record is not tied to an individual staff account and carries no staff name or email | Deleted the moment the app is uninstalled |
What we do not store
- Customer names, email addresses, phone numbers or addresses
- Orders, order contents or payment information
- Gift message text
- Browsing behaviour, on your storefront or anywhere else
Server logs
Our hosting provider records ordinary web server logs for requests to the app — IP address, timestamp, path and user agent. These are used for security and to diagnose faults, are not combined with anything else, and are discarded on the provider’s rolling schedule, within 30 days.
This website
The public pages — this one, the landing page, the FAQ and the other policies — run no analytics, no advertising and no third-party scripts, and set no cookies. See the cookie policy for the small number of cookies the installation flow itself needs.
Who else sees the data
We do not sell data, and we do not share it for advertising. Two processors handle it on our behalf:
| Processor | Role | Where |
|---|---|---|
| Shopify Inc. | The platform the app runs inside. Your store data stays in Shopify; Wrapt reads and writes products through their API | Per Shopify’s own terms |
| Railway Corp. | Application hosting and the database holding the configuration described above | United States |
We will update this list before adding a processor. We may also disclose data where we are legally required to.
International transfers
The app is hosted in the United States. Where data originating in the European Economic Area, the United Kingdom or Türkiye is transferred there, the transfer relies on the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, or your explicit consent, as applicable.
Deleting your data
Uninstalling Wrapt is enough. Your session is deleted immediately, and Shopify sends us a shop redaction request up to 48 hours later, at which point your wrap style configuration is erased.
The Gift Wrap product Wrapt created stays in your catalog on purpose, so that past orders containing a wrap line keep resolving. It is yours; delete it yourself if you would rather not keep it.
We implement all three of Shopify’s mandatory privacy webhooks — customer data request, customer redaction and shop redaction. The first two return nothing, because we hold no customer data to return or erase.
Your rights
Because Wrapt holds no data about your customers, requests about a customer should go to the merchant who runs the store, who is the controller of that data. For the store configuration described above, the following apply.
European Economic Area and United Kingdom (GDPR / UK GDPR)
You have the right to access, rectify, erase, restrict processing of and port your data, and to object to processing. Our lawful basis is performance of a contract — you installed the app so that it would provide this service. To exercise any of these, email [email protected]. You may also complain to your local supervisory authority.
California (CCPA / CPRA)
You have the right to know what is collected, to delete it, to correct it, and to opt out of sale or sharing. We do not sell or share personal information as those terms are defined, and we do not use it for cross-context behavioural advertising. We will not discriminate against you for exercising these rights.
Türkiye (KVKK)
Under Article 11 of Law No. 6698, you may learn whether your personal data is processed, request information about it, request correction or erasure, and object to results produced solely by automated analysis. Requests go to the same address.
Everyone
Write to [email protected]. We answer within 30 days, and usually within two business days.
Security
All traffic is served over HTTPS. Access tokens are stored in the application database, which is encrypted at rest by the hosting provider, and are never exposed to a browser. Access to production is limited to the people who operate the app.
If you believe you have found a vulnerability, please email [email protected] rather than disclosing it publicly. We will confirm receipt within two business days.
Children
Wrapt is a tool for merchants and is not directed at children. We do not knowingly collect data from anyone under 16.
Changes
If this policy changes materially we will update the date at the top and, where the change affects merchants who have the app installed, say so in the app. Continuing to use Wrapt after a change means you accept the revised policy.
Contact
Full contact details are under Who we are at the top of this page. For anything about the app itself, the support page says what to include so the first reply is useful.