Last updated: October 19, 2026
Thank you for choosing to be part of our community at Gatto, doing business as Gatto ("Gatto", "we", "us", or "our"). We are committed to protecting your personal information and your right to privacy. If you have any questions or concerns about this policy or our practices with regard to your personal information, please contact us at [email protected].
This Privacy Policy describes how personal information is collected, used, and shared when you install or use Gatto Wishlist Loyalty (the "App") in connection with your Shopify-supported store.
When you install the App and use our services, you trust us with your personal information. We take your privacy seriously and seek to explain what information we collect, how we use it, and what rights you have in relation to it. If you disagree with any terms in this policy, please discontinue use of the App and our services. We reserve the right to refuse service to anyone at any time.
This privacy policy applies to all information collected through the App and any related services, sales, marketing, or events (collectively, the "Services").
In Short: We collect information from you when you install and use our Services. This includes information you provide directly, information about your use of the Services, information from third-party sources, and Shopify permissions required to provide App functionality.
We collect only information that is necessary to provide the Services and enhance your user experience, and we are committed to safeguarding your data with appropriate privacy and security standards.
In Short: We use your information to provide, secure, maintain, and improve the Services.
Your information will not be used for purposes beyond what is stated in this policy without informing you and obtaining explicit consent where required.
In Short: We share your information only with your consent, to provide services, or to comply with legal obligations.
We require service providers to maintain confidentiality and security and to process data only in accordance with our instructions and applicable law. We do not sell, rent, or trade your information with third parties for promotional purposes.
In Short: We only share information with service-related third parties.
In Short: We may use cookies and other tracking technologies to collect and store information.
We may use cookies and similar tracking technologies, such as web beacons and pixels, to access or store information. Information about how you can refuse certain cookies may be provided in our Cookie Policy or related notices.
In Short: We keep information for as long as necessary to fulfill the purposes outlined in this policy unless a longer period is required or permitted by law.
When we have no ongoing legitimate business need to process personal information, we will delete or anonymize it. If deletion is not immediately possible, such as when data is stored in backup archives, we will securely store and isolate it from further processing until deletion is possible.
In Short: We aim to protect personal information through organizational and technical security measures.
We have implemented appropriate security measures designed to protect personal information we process. However, no internet transmission or storage system can be guaranteed to be 100% secure. You should access the Services within a secure environment.
In Short: We do not knowingly collect data from or market to children under 18 years of age.
If we learn that personal information from users under 18 has been collected, we will take reasonable measures to delete such data from our records promptly. If you become aware of data we have collected from children under 18, please contact us at [email protected].
In Short: In some regions, such as the European Economic Area, you have rights that allow greater access to and control over your personal information.
Depending on your location, you may have rights to request access, correction, deletion, restriction, portability, or objection to processing. To make such a request, use the contact details below. If we rely on consent to process personal information, you may withdraw consent at any time, without affecting processing before withdrawal.
You may also have the right to complain to your local data protection supervisory authority. If you have questions about privacy rights, email us at [email protected].
Most browsers accept cookies by default. You can usually set your browser to remove or reject cookies, though this may affect certain features of the Services. You can unsubscribe from marketing emails by clicking the unsubscribe link in emails or contacting us, although we may still send service-related messages necessary for administration and use of your account.
The App responds to Shopify's mandatory privacy (GDPR) requests:
customers/data_request): When a customer asks a store for their data, we collect the customer information the App stores for that store, including profile details, loyalty points and status, referrals, and wishlists, so the merchant can provide it to the customer.customers/redact): When a store asks us to erase a customer's data, we anonymize that customer's name and email address, remove their birthday and referral email, and delete their shared wishlist links.shop/redact): About 48 hours after a merchant uninstalls the App, Shopify asks us to erase the store's data. We anonymize the store's customer records, delete email logs and connected integration credentials, and remove the store owner's contact details and access tokens.Each request is recorded so we can confirm that it was completed.
A privacy breach occurs when there is unauthorized access to or collection, use, disclosure, or disposal of personal information. In the event that Gatto becomes aware of a security breach that has resulted or may result in unauthorized access, use, or disclosure of personal information, Gatto will promptly investigate the matter and notify applicable authorities or affected individuals as required by law.
Most web browsers and some mobile operating systems include a Do-Not-Track ("DNT") feature. No uniform technology standard for recognizing and implementing DNT signals has been finalized. As such, we do not currently respond to DNT browser signals. If a standard is adopted that we must follow in the future, we will inform you in a revised version of this policy.
In Short: Yes, California residents may be granted specific rights regarding access to personal information.
California Civil Code Section 1798.83 permits California residents to request certain information about categories of personal information disclosed to third parties for direct marketing purposes. If you are a California resident and would like to make such a request, please contact us using the information below.
If you are under 18 years of age, reside in California, and have a registered account with the Services, you may request removal of unwanted data that you publicly post on the Services by contacting us.
In Short: Yes, we will update this policy as necessary to stay compliant with relevant laws.
We may update this privacy policy from time to time. The updated version will be indicated by an updated "Last updated" date at the top of this page and will be effective as soon as it is accessible. If we make material changes, we may notify you by posting a notice or by sending a notification. We encourage you to review this policy frequently.
If you have questions or comments about this policy, you may email us at [email protected].
Gatto
Gia Dinh Ward, Hồ Chí Minh City, Vietnam