Privacy Policy
This Privacy Policy explains how bStage (the “App”, “we”, “us”), operated by bemyfriends, collects, uses, shares, and protects information when a Shopify merchant installs and uses the App, and when a store’s customers interact with membership features powered by the App. By installing or using bStage, you agree to this Policy.
1. Who this Policy covers
bStage is a Shopify app that lets merchants sell memberships and offer exclusive content, community boards, and member-only products. This Policy applies to (a) merchants who install the App and (b) end customers of those merchants whose data is processed to deliver membership features. Merchants are the data controllers of their customers’ data; bStage acts as a data processor on the merchant’s behalf.
2. Information we collect
- Store & merchant data: shop domain, store settings, and the app configuration you create (membership tiers, content, boards, branding).
- Customer data (as needed for memberships): customer name and email, membership status and tier, membership codes, and order data related to membership or member-only purchases. This is used only to provision and manage memberships and to calculate billing/settlement.
- Usage & technical data: standard logs (IP address, timestamps, request metadata) required to operate and secure the service.
We request only the Shopify API scopes necessary to deliver membership functionality and we access protected customer data solely to provide the features you enable.
3. How we use information
- To create and manage membership tiers, subscriptions, and member access.
- To gate exclusive content, community boards, and member-only products by tier.
- To issue digital membership cards and unique membership codes.
- To calculate plan fees and membership commissions and to process app billing via Shopify.
- To send operational notifications (e.g., membership or billing status) where applicable.
- To secure, maintain, debug, and improve the service.
We do not sell personal information, and we do not use it for advertising.
4. Service providers & sharing
We share data only with infrastructure providers that help us run the service, under contractual data-protection obligations:
- Shopify — the platform on which the App and your store run.
- Vercel — application hosting.
- Supabase — database hosting (data stored in the Asia-Pacific (Seoul) region).
- SendGrid (Twilio) — transactional email delivery.
We may also disclose information if required by law or to protect the rights, safety, and security of users and the service.
5. Data retention & deletion
We retain data only as long as needed to provide the service or as required by law. We honor Shopify’s mandatory compliance webhooks:
customers/data_request— we provide the customer data we store on request.customers/redact— we delete the customer’s personal data.shop/redact— we delete the store’s data after the app is uninstalled.
When a merchant uninstalls the App, associated session data is removed and store data is purged in accordance with the shop-redact request.
6. Security
Data is transmitted over TLS and stored with encryption at rest by our infrastructure providers. Access to production data is restricted and credentials are stored as encrypted environment secrets, never in source code. Webhook requests are verified using HMAC signatures.
7. International transfers
Data may be processed in regions where our providers operate (including the Republic of Korea and other regions used by Shopify, Vercel, Supabase, and SendGrid). Where required, transfers rely on appropriate safeguards.
8. Your rights
Depending on your jurisdiction (e.g., GDPR, CCPA), you may have rights to access, correct, delete, or restrict the processing of your personal data. End customers should contact the merchant (data controller) whose store they interacted with; merchants and individuals may also contact us at the address below and we will assist the controller in responding.
9. Children
The App is not directed to children under the age required by applicable law, and we do not knowingly collect their data.
10. Changes to this Policy
We may update this Policy from time to time. Material changes will be reflected by updating the “Last updated” date above.
11. Contact
Questions or requests regarding this Policy or your data: steve@bemyfriends.com (bemyfriends).