Privacy Policy

App: Iromi Color Variant Images (Shopify app) · Provider: GRAMSHIFT (Tokyo, Japan) · Last updated: 2026-10-14

Summary

Iromi Color Variant Images does not collect, store or share any personal data of your customers. It does not read orders or customers. The color assignments are saved in your own Shopify store, on your products. Our server keeps only what it needs to connect to your store: your store's address and the access token Shopify gives the app, plus short-lived logs. Shoppers' browsers never contact our server.

What the app reads from your store

• Products through Shopify's Admin API: title, options and their values, variants and their images, and the product's photos (ID, alt text and image link), so the app can list your products, show the photos and sort them into colors. This uses the write_products permission, which also lets the app save the color assignments on your products. The app does not change your product titles, prices, stock, variants or photos.
• Your app plan, from Shopify, to know how many products your plan includes.
• Your store's address, the staff member's language and a signed session token (which contains Shopify's internal ID of the staff user who opened the app), which Shopify sends with every request from the admin, to check that the request really comes from your store. The app does not read the staff member's name or email.

What the app saves, and where

The app does not request any permission for orders, customers or other customer data, and it does not use the access token for anything other than the features described here.

Your storefront and your shoppers

• The product page gets the color assignments from your theme (the app embed writes them into the page with the product), and a small script served by Shopify as part of your theme hides the other colors' photos in the gallery. The script makes no network requests and stores nothing in the shopper's browser.
• The app sets no cookies and uses no analytics, advertising or tracking. Shoppers' browsers send nothing to GRAMSHIFT.

In the Shopify admin

The app remembers in your own browser's local storage whether it has already asked you for a review, so it asks only once. Nothing about this is sent to our server.

Sharing

We do not sell or rent any data and do not share it with third parties, except the service providers named on this page (our server host, our email forwarding provider and Google for email), and when the law requires it.

Information GRAMSHIFT receives from Shopify

As an app provider, we see in the Shopify Partner Dashboard which stores installed the app, their plan and billing events, and the store contact details Shopify shares with app providers. We use this only to manage plans, answer support requests and meet legal obligations. Payments are processed by Shopify; we never receive card details.

Support requests

If you email us, we receive what you choose to send (for example your email address, your message and screenshots) and use it only to answer you. Email to contact@gramshift.com is forwarded by our email forwarding provider (ImprovMX) to a mailbox hosted by Google (Gmail), so those providers process support emails on our behalf.

Retention and deletion

• Removing the app: when Shopify tells us the app was removed, we delete your store's access token and session data from our server. Forty-eight hours after removal, Shopify sends a request to erase the store's data, and we delete anything that is left for your store.
• The color assignments on your products and the product list on the installation are app-owned values in your store; Shopify handles them under its rules for app data when the app is removed. Removing the app also removes the app embed at once, so your product pages show all photos again. To clear the assignments of a product while the app is installed, open it in the app, click Unassign all photos and then Save: the app deletes that product's assignment.
• Customer data requests: the app holds no customer data, so requests that Shopify forwards for a customer's data or its erasure find nothing to return or delete.
• Support emails are kept only as long as needed to handle the request and meet legal obligations; you can ask us to delete them. Installation and billing records are kept for up to 7 years for accounting and tax purposes.

Security

All connections use HTTPS. The app's server checks the signature of every request and webhook from Shopify, runs under its own restricted system user, and keeps its database and secrets readable only by that user.

Legal basis and location

We process store information to provide the app you installed (contract) and for our legitimate interest in keeping the service secure and answering requests, and to meet legal obligations. GRAMSHIFT is based in Japan, and our server is in Japan.

Your rights

You can ask us to access, correct or delete personal information we hold about you, or object to its use, by emailing contact@gramshift.com. If you are in the EEA or the UK, you can also complain to your local data protection authority.

Changes

If the app starts to collect more data or send data anywhere else, this policy will be updated before that change is released, and the date above will change.

Contact

GRAMSHIFT · contact@gramshift.com · 1-10-8 Dogenzaka, Shibuya Dogenzaka Tokyu Bldg 2F-C, Shibuya-ku, Tokyo 150-0043, Japan

プライバシーポリシー（日本語）