GrowGood: Tree Planting ("GrowGood", "the App", "we", "us") is operated by NextGen Software LLC, 192 Bear Christiana Rd #2016, Bear, DE 19701, United States. The App helps Shopify merchants plant trees with their sales and lets their customers add tree planting to orders.
This policy explains what information the App collects when a merchant installs it on their Shopify store, why we collect it, how long we keep it, and the rights merchants and their customers have over it. It forms part of our data protection commitment to merchants who install the App.
1. Information we collect
We practice strict data minimization and collect only what the App needs to work:
| Category | What it includes | Why we need it |
|---|---|---|
| Store information | Store domain, App settings (impact preferences, spending limits), Shopify API access tokens | Operating the App for your store |
| Order information | Order ID, order number, order total, and line-item quantities for paid orders | Calculating how many trees to plant and billing the merchant per tree |
| Impact records | Trees planted per order, planting confirmations from our planting partner, aggregate impact statistics | Showing merchants and shoppers verified impact totals |
What we do NOT collect: we do not collect, store, or process customer names, email addresses, phone numbers, shipping or billing addresses, payment details, or any other directly identifying customer information. Order data in our systems is keyed by order ID only.
2. How we use information
- To calculate trees to plant for each paid order, per the merchant's settings
- To place tree-planting requests with our planting partner
- To create usage charges for planted trees through Shopify's billing system
- To display impact statistics in the merchant dashboard and storefront widgets
- To provide merchant support and comply with legal obligations
We use information only for these purposes. We do not sell, rent, or trade any data, use it for advertising or profiling, or make automated decisions with legal or similar effects.
3. Service providers (subprocessors)
| Provider | Purpose | Data shared |
|---|---|---|
| Shopify Inc. | Commerce platform, authentication, billing | All App data flows through Shopify's APIs |
| Render Services, Inc. | Application hosting and database (United States) | Encrypted storage of the data described in Section 1 |
| The TreeApp World Ltd (thetreeapp.org) | Tree planting fulfilment | Tree quantity only — no store, order, or customer data is ever sent to our planting partner |
4. Data storage and security
- All data is stored in the United States on Render's infrastructure
- Data is encrypted in transit (TLS/HTTPS) and at rest
- Database access is restricted by network allow-listing and credentials
- Shopify API access tokens are short-lived and rotated automatically
- Access to production systems is limited to authorized NextGen Software personnel
5. Data retention and deletion
- While the App is installed: we retain the data in Section 1 to operate the App and maintain accurate billing and impact records.
- Customer redaction requests: when a customer asks a merchant to delete their data, Shopify notifies us and we remove order identifiers and order values from the affected records within 30 days. Anonymous tree counts are retained for billing integrity.
- After uninstall: Shopify sends us a shop redaction request 48 hours after the App is uninstalled, and we permanently delete all store data — settings, order records, impact summaries, and access tokens — within 30 days.
- Merchants may also request deletion at any time by emailing us (Section 8).
6. Legal bases (GDPR/UK GDPR)
Where the EU or UK General Data Protection Regulation applies, we process data on these legal bases:
- Performance of a contract — providing the App a merchant installed
- Legitimate interests — maintaining accurate billing and impact records, securing our services
- Legal obligation — retaining records where required by law
Data subjects in the EEA/UK have the rights of access, rectification, erasure, restriction, portability, and objection. Because we hold no directly identifying customer information, customer requests are best routed through the merchant and Shopify's privacy tools, which notify us automatically; we honour every such request within 30 days. You also have the right to lodge a complaint with your local supervisory authority.
7. California privacy rights (CCPA/CPRA)
We do not sell or share personal information as defined by the CCPA/CPRA, and we have not done so in the preceding 12 months. California residents may exercise their rights to know, delete, and correct through their merchant or by contacting us directly; we do not discriminate against anyone for exercising privacy rights.
8. Contact us
For any privacy question, data request, or complaint, contact:
NextGen Software LLC
192 Bear Christiana Rd #2016
Bear, DE 19701, United States
Email: nextgenerationsoftwarellc@gmail.com
We respond to privacy requests within 30 days.
9. Other things you should know
- Cookies and tracking: the App does not set tracking or advertising cookies. The embedded dashboard uses Shopify session tokens strictly for authentication; the storefront widget stores no personal data in the browser.
- International transfers: if you or your customers are outside the United States, the data described above is transferred to and processed in the United States under appropriate safeguards, including our subprocessors' standard contractual commitments.
- Children: the App is a business tool for merchants and is not directed at children under 16. We do not knowingly collect data about children.
- Changes: if we make material changes to this policy, we will update it here with a new effective date and, where changes are significant, notify merchants through the App or by email.