Terms of service

Effective October 14, 2026

These terms are an agreement between Justin Barnes and Mauricio Mejia, operating as devmesh (“devmesh”, “we”, “us”), in Winnipeg, Manitoba, Canada, and the business that installs Laurel: Reviews & Rewards (“Laurel”) on its Shopify store (“you”, the “merchant”). By installing or using Laurel, you agree to them. If you're accepting for a business, you confirm you can bind it.

1. The service

Laurel lets your store collect and show product reviews and run a loyalty program with points, rewards, referrals, and VIP tiers. It works only through Shopify, and you also need to follow Shopify's terms. We may improve or change Laurel over time; if we remove something important, we'll tell you in advance.

2. Plans and billing

Plans and prices are shown in the app and on the Shopify App Store listing. Shopify bills you on our behalf, and Shopify's billing and refund rules apply. Going over your plan's monthly order allowance never adds a charge: review requests pause until the next month or until you upgrade.

3. Your responsibilities

• Give your customers a privacy notice that covers your use of Laurel, and have a lawful basis for the data you have Laurel process, including any data you import from another app.
• Set up your rewards program fairly, honor the rewards you offer, and follow consumer and marketing laws where you sell.
• Moderate reviews in line with applicable law and Shopify's policies. Don't use Laurel to post fake reviews or to hide reviews in a misleading way.
• Don't misuse Laurel: no attempts to break, overload, or get around its security, and no use for unlawful purposes.

4. Your content and data

You own your store's data and content, including reviews and loyalty records. You give us permission to use them only to provide Laurel to you. When you uninstall Laurel, we delete your store's data as described in our privacy policy.

5. Data processing terms

This section applies when Laurel processes personal information about your customers (“customer data”). For that data, you are the controller (or business) and devmesh is your processor (or service provider).

5.1 Instructions and purpose

We process customer data only to provide Laurel to you, as described in the privacy policy, and on your documented instructions, which are these terms and your settings in the app. We don't sell or share customer data, use it for advertising, or combine it with data from other stores. We'll tell you if we believe an instruction breaks the law.

5.2 Types of data and people

Your customers' names, email addresses, Shopify customer IDs, order IDs and totals, points activity, birthdays (month and day), referral relationships, and reviews, including photos. We don't process payment details, addresses, or phone numbers.

5.3 Confidentiality and security

Only devmesh personnel who need access to run Laurel can access customer data, and they're bound by confidentiality. We encrypt data in transit and at rest (including backups), keep test and production data separate, require 2-step verification for staff accounts, log access to production data, and maintain a security incident response policy.

5.4 Sub-processors

You authorize the sub-processors listed in the privacy policy (Google Cloud, Neon, and Resend). We'll update that list at least 14 days before adding a new one; if you object, you can stop using Laurel. We make sure each sub-processor is bound by data protection terms at least as protective as these.

5.5 Helping you with requests

We act on Shopify's data request and erasure webhooks automatically, and we'll help you respond to other requests from your customers, and with any data protection assessments or regulator questions, where reasonable.

5.6 Security incidents

If we become aware of a breach affecting your customer data, we'll notify you without undue delay, and within 72 hours of confirming it, with what we know and what we're doing about it.

5.7 Retention and deletion

We keep customer data only as long as described in the privacy policy, and we delete all of your store's data about 48 hours after you uninstall Laurel.

5.8 Transfers

Customer data is stored in the United States. Where the law requires it, transfers rely on standard contractual clauses or equivalent safeguards, which these terms incorporate by reference where needed.

5.9 Audits

On reasonable written request, no more than once a year, we'll answer your questions about how we protect customer data and give you the information you need to show compliance.

6. Availability and support

We work to keep Laurel available and fix problems quickly, but we don't promise it will be uninterrupted or error-free. Support is by email at support@devmesh.ca.

7. Disclaimers

Except as these terms say, Laurel is provided “as is”. To the extent the law allows, we disclaim implied warranties of merchantability, fitness for a particular purpose, and non-infringement.

8. Limitation of liability

To the extent the law allows, neither party is liable for indirect or consequential losses, such as lost profits, and each party's total liability under these terms is limited to the fees you paid for Laurel in the 12 months before the claim. These limits don't apply to a party's fraud or wilful misconduct, or where the law doesn't allow them.

9. Ending the agreement

You can stop at any time by uninstalling Laurel. We may suspend or end your use if you seriously breach these terms, or end the service for everyone with 30 days' notice. Sections 4, 5 (for as long as we hold customer data), 7, 8, and 10 continue after the agreement ends.

10. General

These terms are governed by the laws of the Province of Manitoba and the federal laws of Canada that apply there, and its courts have jurisdiction, unless the law where you're based requires otherwise. We may update these terms; we'll post changes here and, for material changes, tell you in the app or by email at least 14 days before they take effect. These terms, with the privacy policy, are the whole agreement between us about Laurel.

11. Contact

Laurel is made by devmesh (Justin Barnes and Mauricio Mejia, Winnipeg, Manitoba, Canada). Contact us at support@devmesh.ca, or see devmesh.ca for other ways to reach us.