Privacy policy

Effective October 14, 2026

Laurel: Reviews & Rewards (“Laurel”) is a Shopify app that runs product reviews and a loyalty program (points, referrals, and VIP tiers) for online stores. It's made by devmesh (“we”, “us”), a partnership of Justin Barnes and Mauricio Mejia based in Winnipeg, Manitoba, Canada. This policy explains what information Laurel handles, why, who it's shared with, how long it's kept, and the choices people have.

In this policy, a merchant is a Shopify store that installs Laurel, and a shopper is one of that store's customers or visitors.

Our role

For shoppers' information, the merchant decides what Laurel is used for and is responsible for its own privacy notice to its customers. devmesh processes that information on the merchant's behalf, only to run Laurel for that store, under our data processing terms. For information about merchants themselves (for example, the store's contact details and plan), devmesh is responsible.

Shoppers with questions about their information should contact the store first; we'll help the store respond. You can also write to us at support@devmesh.ca.

What Laurel collects about shoppers

Information	Where it comes from	Why
Name, email address, and Shopify customer ID	Shopify (when a customer is created or orders), or the merchant's import from a previous rewards or reviews app	To keep each shopper's points account and match it to their orders
Order and refund details: order ID, total, and date	Shopify	To award points for purchases, take them back for refunds, and work out VIP tiers
Points balance and history, rewards redeemed, and the discount codes issued	Laurel	To show shoppers their points and let them spend them
Referral code, and who referred whom	Laurel	To give referral rewards to both people
Birthday (month and day only, never the year)	The shopper, if they choose to add it	To give birthday points
Reviews: rating, title, text, the name to show, photos, and the email address used	The shopper, or the merchant's import from a previous reviews app	To publish reviews on the store and mark verified buyers. The email address is never shown publicly.
Review requests: email address, first name, the order's products, and when emails were sent	Shopify, when an order is fulfilled	To email one request (and at most one reminder) asking for a review
Unsubscribe choices, stored as a one-way hash of the email address	The shopper	To stop review requests to people who unsubscribed

Laurel doesn't collect payment details, addresses, or phone numbers. Its storefront widgets don't set cookies or use them for tracking. (When a shopper follows a referral link, Shopify itself applies the discount to their cart.)

What Laurel collects about merchants

The store's Shopify domain, name, currency, and Laurel plan.
A Shopify access token, so Laurel can act for the store in the background (award points, create discount codes, update review ratings).
The store's Laurel settings: earn rules, rewards, VIP tiers, review and email options.
Files the merchant imports, while the import runs (see “How long we keep it”).

Laurel asks Shopify for access to orders, customers, products, discounts, and files (in shopify.app.toml: read_orders, read_customers, write_customers, read_products, write_products, write_discounts, write_files). It uses them only for the purposes above: for example, writing product ratings to the store, creating reward discount codes, and copying imported review photos into the store's own files.

Server logs

Our hosting provider keeps logs of requests to Laurel, including IP addresses, the store's domain, and the page or action requested. We use them only to run the service, fix problems, and keep it secure.

What we don't do

We don't sell or rent personal information, or share it for advertising.
We don't use it to profile shoppers, or combine it across stores.
We don't make automated decisions with legal or similarly significant effects. Points and VIP tiers follow the store's own published rules.
We don't use shoppers' information for any purpose other than running Laurel for the store it came from.

Emails to shoppers

If the store turns on review requests, Laurel emails a shopper once after their order is fulfilled, and at most one reminder. Every email has a one-click unsubscribe link. After unsubscribing, the shopper gets no more review requests from that store.

Who we share it with

We use these service providers to run Laurel. Each processes data only on our instructions:

Provider	What for	Where
Google Cloud	Hosting the app and its background jobs; storing secrets	United States (us-east4, Virginia)
Neon	Database	United States (AWS us-east-1, Virginia)
Resend	Sending review-request emails	United States
Shopify	The store platform Laurel runs on; review photos are stored in the merchant's own Shopify files	Per Shopify's policy

We may also disclose information if the law requires it, or to protect the rights and safety of our users or others. If devmesh is ever sold or merged, this policy will continue to apply to the information.

How long we keep it

Imported files are deleted as soon as the import finishes. The import's summary (counts and row errors) is deleted after 180 days.
Review requests, including the shopper's email address, are deleted 180 days after they're created.
Points accounts and reviews are kept while the store uses Laurel, because they are the store's loyalty program and review content.
When a shopper asks a store to erase their data (Shopify's customers/redact request), we delete their points account and history, review requests, and review photos, and anonymize their reviews so nothing identifies them.
When a store uninstalls Laurel, its access is revoked right away and all of the store's data in Laurel is deleted about 48 hours later (Shopify's shop/redact request).
Unsubscribe choices are kept as a hash, not an email address, so they can still be honored after other data is erased.
Server logs are kept for up to 30 days, as set by our hosting provider.

How we protect it

All connections use HTTPS/TLS, and data is encrypted at rest by our database and hosting providers, including backups.
Only devmesh's two partners can access production systems, using accounts with 2-step verification. Access to the database credentials is logged.
Test and development use separate databases and never real shopper data.
If a security incident affects personal information, we'll notify affected merchants without undue delay, and within 72 hours of confirming it, so they can meet their own obligations.

Your choices and rights

Depending on where you live (for example under the GDPR, the UK GDPR, Canada's PIPEDA, or California's CCPA), you may have the right to access, correct, delete, or receive a copy of your personal information, and to object to or restrict how it's used.

Shoppers: ask the store, which controls your information in Laurel. Stores can see members and hide reviews in Laurel, and when a store uses Shopify's tools to erase a customer's data, the request reaches us automatically. You can also contact us and we'll pass your request to the store.
Merchants: contact us at support@devmesh.ca, or uninstall Laurel to have the store's data deleted.

You also have the right to complain to your local data protection authority.

International transfers

Laurel's data is stored in the United States. Where the law requires it, we rely on our providers' standard contractual clauses or equivalent safeguards for transfers.

Children

Laurel isn't directed at children and we don't knowingly collect information from children under 16.

Changes

We'll post any changes here and update the effective date. If a change materially affects how we use personal information, we'll tell merchants in the app or by email before it takes effect.

Contact

Laurel is made by devmesh (Justin Barnes and Mauricio Mejia, Winnipeg, Manitoba, Canada). Contact us at support@devmesh.ca, or see devmesh.ca for other ways to reach us.