Privacy policy - Gift Registry mini

PRIVACY POLICY

Gift Registry mini for the Shop app

Last updated: 28 November 2025

1. Introduction

This Privacy Policy explains how Sundae Lane Pty Ltd (ACN 666 645 263) (“we”, “us”, “our”) collects, uses and shares information when you use Gift Registry (the “Mini”) within the Shopify Shop app.

This Policy applies to anyone who uses or interacts with the Mini in any way, including:

Registry owners who set up and manage registries;
Collaborators who help manage registries; and
Visitors or buyers who view registries, reserve items, or mark items as purchased.

This Policy applies only to the Mini. It does not apply to:

Shopify’s handling of your information in the Shop app (governed by Shopify’s own policies); or
Merchant stores where you browse or purchase products (governed by each merchant’s policies).

By using the Mini, you agree to this Privacy Policy. If you do not agree, do not use the Mini.

2. Who We Are and How to Contact Us

The Mini is provided by:

Sundae Lane Pty Ltd (ACN 666 645 263) (“we”, “us”, “our”)

If you have questions or requests about this Privacy Policy or how we handle information, you can contact us at:

Email: hello@sundaelane.com
Postal address: 470 St Kilda Road, Melbourne, Australia, 3004

Depending on where you live, you may also have the right to lodge a complaint with your local data protection authority.

3. Information We Collect

We aim to collect and process only the information we reasonably need to provide and improve the Mini. Generally, we rely on identifiers, registry-related data and usage data rather than large amounts of detailed personal information.

3.1 Information from Shopify

When you use the Mini through the Shop app, Shopify provides us with certain information so we can identify you and operate the Mini, such as:

A stable user identifier associated with your Shop account;
Basic account profile information (for example, a display name and, where available, a profile image);
Technical information about your device and app (for example, app version, basic device details); and
Session and authentication information that allows you to access the Mini securely.

We do not receive your Shop password or full payment card details from Shopify.

3.2 Registry and Interaction Information

When you use the Mini, we process information you provide or generate, such as:

Registry and event details (for example, names, types and dates of registries);
Product selections associated with your registries, including references to products in merchants’ stores and basic item snapshots (such as titles, prices and images as displayed when you add them);
Sharing and visibility settings for your registries;
Information about who you invite to access or collaborate on a registry (for example, roles such as owner, collaborator or viewer); and
Information about interactions with registries, such as when someone reserves or marks an item as purchased, and the quantity reserved.

If you access a registry via a share link and choose to reserve or mark an item as purchased, we process limited information about that interaction (for example, the fact that you reserved an item, which item you interacted with, and information from your Shop profile such as a display name or profile image) so that the registry owner and others can see which items have been claimed.

We treat this information as relating to you or your contacts, even where stored or processed using pseudonymous identifiers.

3.3 Technical, Usage and Analytics Data

To operate and improve the Mini, we and our service providers may automatically collect and process:

Log data such as timestamps, error messages and diagnostic information;
Device and environment information (for example, device type, operating system, app version, language, approximate region);
Feature usage information such as which screens are viewed, which buttons are tapped, and how registries and reservations are used; and
Aggregated statistics about interactions with the Mini (for example, how many registries are created, or how often sharing features are used).

Where possible, we use this information in aggregated or de-identified form so that it does not identify you personally.

4. How We Use Information

We use the information we collect for the following purposes:

4.1 To Provide the Mini

Authenticating you via the Shop app;
Creating, displaying and managing your registries and product selections;
Enabling sharing, collaboration, reservations and similar features;
Remembering your settings and preferences; and
Responding to your support requests and communicating with you about the Mini where necessary.

4.2 To Improve and Develop the Mini

Monitoring performance and reliability;
Debugging and resolving technical issues;
Testing and rolling out new features and enhancements;
Analysing usage patterns (often in aggregate) to understand which features are useful and how the Mini is used overall; and
Making business decisions about the Mini’s roadmap, including potential paid features.

4.3 To Maintain Security and Prevent Misuse

Detecting and preventing abuse, spam, fraud or unauthorised access;
Protecting the integrity and security of our systems and users; and
Investigating suspicious activity or potential violations of our Terms of Use.

4.4 Monetisation and Attribution

Now and in the future, the Mini may participate in monetisation and attribution programs supported by Shopify or merchants, including:

Recording that a user interacted with a registry or product in the Mini before visiting a merchant store or making a purchase;
Measuring the performance of registry-related campaigns or features; and
Receiving commissions, incentives or other compensation when purchases are made following interactions with the Mini.

We aim to use pseudonymous identifiers and aggregated reporting for these purposes wherever reasonably possible.

4.5 Legal and Compliance

Complying with applicable laws and regulations;
Responding to lawful requests from courts, regulators or law enforcement; and
Enforcing our Terms of Use and protecting our rights, property and users.

5. Legal Bases (Where Applicable)

In some regions (such as the UK and EU), we must identify legal bases for processing personal information. We generally rely on:

Performance of a contract: Processing that is necessary to provide the Mini and its core features (for example, storing registries, enabling sharing, managing reservations);
Legitimate interests: Processing for purposes such as improving the Mini, maintaining security, and supporting monetisation and affiliate attribution, where those interests are not overridden by your rights and interests; and
Consent: Where required by law for specific activities (for example, certain types of analytics or marketing), we will rely on your consent and provide a way to withdraw it.

6. How We Share Information

We do not sell your personal information to data brokers. We may share information with the following categories of recipients:

6.1 Shopify

We exchange information with Shopify to allow the Mini to function inside the Shop app, for example:

Receiving identifiers and basic account information from Shopify so we can authenticate you and personalise your experience;
Allowing Shopify to understand how the Mini is used within Shop to improve the platform; and
Supporting monetisation or attribution programs managed by Shopify (for example, so Shopify can recognise when a purchase followed an interaction with the Mini).

Shopify processes your information in line with its own terms and privacy policies.

6.2 Merchants and Product Providers

When you follow links or take actions that lead you to a merchant’s store or product page, Shopify and the merchant may be able to infer that you came from the Mini or from a particular registry.

We generally do not share detailed personal information directly with merchants from the Mini. However:

Aggregated or pseudonymous attribution data may be shared, particularly in connection with affiliate or commission arrangements; and
Information you choose to provide directly to a merchant (for example, during checkout) is subject to that merchant’s policies, not this Privacy Policy.

6.3 Service Providers

We use third-party service providers to help us operate, host, maintain and improve the Mini, for purposes such as:

Application hosting and storage;
Logging, monitoring and crash reporting;
Analytics and performance measurement; and
Customer support tools.

These providers are only permitted to process information on our behalf and in accordance with our instructions, and they must protect it appropriately.

6.4 Business Transfers

If we are involved in a merger, acquisition, restructuring, sale of assets or similar transaction, information about users of the Mini may be transferred to the relevant parties, subject to appropriate confidentiality and data protection safeguards.

6.5 Legal, Protection and Safety

We may disclose information where we reasonably believe it is necessary to:

Comply with a law, regulation, legal process or governmental request;
Protect the rights, property or safety of our users, the public, Shopify, merchants or ourselves; or
Enforce our Terms of Use or investigate potential violations or misuse.

7. International Data Transfers

We may store and process information in countries other than your own, using reputable infrastructure and service providers. These countries may have different data protection laws.

Where required by law, we will take steps to ensure that any international transfers of personal information are subject to appropriate safeguards (for example, standard contractual clauses or similar mechanisms).

8. Data Retention

We retain information for as long as reasonably necessary for the purposes described in this Privacy Policy, including:

To provide and maintain your registries and related features;
To comply with legal obligations;
To resolve disputes; and
To enforce our agreements.

In practice, this generally means:

Registry and interaction data are retained while you actively use the Mini. If you delete a registry, the related data may be deleted, anonymised or archived after a reasonable period;
Log and analytics data may be retained for a shorter, fixed period to support security, diagnostics and high-level analytics; and
Backups containing your information may remain for a limited time, but are subject to strict access controls and periodic deletion.

We may retain aggregated or de-identified data (which does not identify you) indefinitely.

9. Security

We take reasonable technical and organisational measures to help protect the information we process from loss, misuse and unauthorised access or disclosure. These measures may include:

Encryption in transit where appropriate;
Access controls and authentication for our systems and tools;
Segregation of environments and restricted access to production data; and
Monitoring and logging for security and operational purposes.

However, no system can be completely secure. We cannot guarantee absolute security of information transmitted or stored in connection with the Mini.

10. Your Rights and Choices

Depending on your location and applicable law, you may have rights regarding information we hold about you, such as:

Access: The right to request a copy of information we hold about you;
Correction: The right to request that we correct inaccurate or incomplete information;
Deletion: The right to request that we delete certain information, subject to legal and operational constraints;
Restriction or objection: The right to restrict or object to certain processing, particularly where we rely on legitimate interests; and
Data portability: The right to request certain information in a portable format.

Within the Mini, you can usually:

View and edit registry details and some related information; and
Change visibility and sharing settings or delete registries (subject to features available at the time).

To exercise rights that cannot be handled directly in the Mini, you can contact us using the details in Section 2. We may need to verify your identity, which may include confirming your control of the relevant Shop account.

If your request relates to information controlled by Shopify or a merchant (for example, your Shop account profile or order data), we may ask you to contact Shopify or the merchant directly.

11. Children

The Mini is not intended for children below the age at which they can lawfully use the Shop app in their country (for example, 16 or 18). We do not knowingly collect personal information from children who are not permitted to use the Shop app.

If you believe that a child has provided us with personal information in violation of this Policy, please contact us so we can investigate and take appropriate steps, such as deletion where required.

12. Changes to this Privacy Policy

We may update this Privacy Policy from time to time, for example, to reflect:

Changes to the Mini or its features (including new analytics or monetisation capabilities);
Changes to our data practices; or
Changes in applicable laws.

When we do so, we will update the “Last updated” date at the top of this page. For material changes, we may also provide more prominent notice within the Mini or through other reasonable means.

Your continued use of the Mini after an update means you accept the updated Privacy Policy. If you do not agree, you should stop using the Mini.

13. Contact and Complaints

If you have questions, concerns or complaints about this Privacy Policy or our handling of information, please contact us at:

Sundae Lane Pty Ltd (ACN 666 645 263)

Email: hello@sundaelane.com
Postal address: 470 St Kilda Road, Melbourne, Australia, 3004

We will do our best to address your concerns. If you are not satisfied with our response and local law gives you that right, you may also lodge a complaint with your local data protection or consumer protection authority.