1. Who we are
Boreal is operated by UPILABS in Indonesia. In this policy, “we”, “us” and “our” refer to UPILABS. Contact us at yudha@upilabs.net about privacy or the information we process.
This policy covers the Boreal website and Shopify app. It does not replace a merchant’s own privacy policy or the privacy policies of Shopify and other services the merchant uses. For information about a purchase from a store, contact that store.
2. Information we process
Shopify connection and account information
When you connect the app, we process your store domain, store name, authorization permissions, access tokens and session information. Shopify’s session information may include an authorized staff member’s user ID, name, email address, language, and account or collaborator status.
Product and image information
The app requests permission to read products and manage Shopify Files. When you select a product, the app can retrieve its title, identifier, price, currency, image and store link for use in an email block. Images you upload or prepare for publishing may be added to your store’s Shopify Files.
Projects and content you provide
We store the projects you save, including their names, theme and language choices, email content, design settings, revisions, status and timestamps. We also process project preview images, generated icons and reusable blocks you save. Content may contain personal information if you choose to enter it.
Test emails and support
When you send a test, we process the recipient address, subject, email HTML and image references needed to send it. The app stores a per-store daily usage count to enforce test limits; it does not maintain a recipient-address or message-history table. Our email provider processes the submitted message and delivery information. If you contact us, we receive the information you include in your message.
Technical information
Our hosting, network and email services may process IP addresses, request details, browser information and error or delivery logs to operate and protect the service.
The app does not request permission to read Shopify customer or order records. Its sample email previews do not automatically import live customer orders. Real order and customer values are filled in by Shopify when it sends a notification using an exported template. Please use sample information when testing and avoid adding sensitive personal information to project content.
3. How we use information
- Connect your store and keep authorized sessions working.
- Load selected product details, save your work and render email previews.
- Generate exportable HTML and Liquid, and prepare images for those emails.
- Send tests you request and enforce sending limits.
- Check paid-plan access when billing is enabled.
- Respond to support and privacy requests, investigate errors, prevent abuse and meet applicable legal obligations.
Where a legal basis is required, we rely on providing the service you request, our legitimate interests in operating a secure and reliable business, compliance with legal obligations, or consent where required. If consent is required for a particular activity, withdrawing it does not affect processing that was lawful before withdrawal.
We do not use project content or test recipient addresses for advertising campaigns. Boreal does not add a storefront advertising pixel or make automated decisions about a person’s eligibility for credit, employment or similar services.
5. Public images in emails
Email images need to be accessible to recipients. Images prepared for test emails or published to Shopify Files can therefore have public URLs. Anyone with such a URL may be able to view or copy the image. Do not use these images to store confidential information.
Public email images are different from the app’s authenticated project-preview flow. Deleting a project does not recall emails already sent, remove copies downloaded by others, or automatically delete files from your Shopify store.
6. Retention and deletion
Saved projects and reusable blocks are kept to provide your saved-work features until you delete them or the store’s app data is removed. Retention also depends on the information’s purpose, support needs, security investigations and applicable legal requirements.
Uninstalling removes the app’s access to your store. When Shopify later delivers its store-data deletion request, the app removes that store’s saved projects, reusable blocks, project previews, generated icons, per-store test usage and app-managed public test assets. This is a separate step from uninstalling; deletion is not immediate when you click Uninstall.
Files uploaded to Shopify Files remain under your store’s control and must be managed there. Exported templates and messages already delivered are also outside the app’s live project storage.
Deleting live app data does not, by itself, erase existing backup copies or a provider’s operational records. Those copies require separate handling under the relevant storage and provider processes. Retention depends on recovery needs, security, the purpose of the record and legal obligations. Contact us about the scope of a deletion request, including backups or test email records.
7. Browser storage and security
Shopify authentication and related session mechanisms support access to the app. The editor also uses browser local storage to remember recent color choices; you can clear those preferences through your browser. The current landing page does not install an advertising tracker or analytics snippet.
We use access controls and store-scoped checks to restrict project access, and secure connections for the hosted service. No service can guarantee absolute security. If you believe information has been exposed or a public asset should be removed, contact us with the relevant store and URL, without sending passwords or access tokens.
8. International processing
We operate from Indonesia. Shopify, Cloudflare, Resend and hosting providers operate internationally, so information may be processed in countries other than yours or Indonesia. The applicable locations depend on the provider and service configuration.
Where applicable law restricts a transfer, an appropriate legal transfer basis is required. Contact us for information about the locations and safeguards relevant to your data.
9. Your choices and rights
Depending on applicable law, you may request information about our processing, access to your personal information, correction, deletion, a portable copy, restriction or objection to processing, or withdrawal of consent where processing relies on consent. You may also raise a concern with the competent data-protection authority or pursue other rights available under applicable law.
Email yudha@upilabs.net with your request and the store concerned. We may need to verify your identity or authority before disclosing or changing information. We handle requests within the periods and exceptions required by applicable law.
If you are a customer of a merchant, contact the merchant about your order or the notifications it sends. If your information was supplied to Boreal in a project or test email, you may also contact us so we can identify the relevant processing. We handle data on a merchant’s instructions where we act as its service provider.
You can stop future app access by uninstalling it from Shopify. The app is intended for people authorized to manage a business store, rather than a service directed at children.
10. Updates and contact
We may update this policy as the service or our practices change. The date above identifies the latest version. Where applicable law requires additional notice or consent for a change, we will follow those requirements.
Privacy contact: yudha@upilabs.net
UPILABS, Indonesia.
See also our Terms of Service.