Banlist is a Shopify app made by TinyFloor (“we”, “us”). It lets a merchant keep a list of people who can’t buy from their store and stops those people at checkout. For the personal information on a merchant’s blocklist, the merchant decides what is collected and why, and we process it on their behalf.
Information we handle
| What | Why |
|---|---|
| Shop details: store domain, name, country, plan; Shopify access tokens | To run the app for the shop |
| The blocklist: the emails, phone numbers, names, addresses and customer accounts the merchant adds, with their reason and note | To recognise those people at checkout |
| When the merchant blocks someone from an order or customer page: that order’s or customer’s email, phone, names and addresses, read once to fill in the form | So the merchant doesn’t have to copy details by hand |
| Checkouts started on the store. Each is compared with the blocklist when Shopify sends it; only checkouts that match someone on the list are kept (email, the detail that matched, cart total and time) | To show the merchant blocked attempts |
| A short code (hash) of each blocked detail, stored in the store’s checkout rule on Shopify | So Shopify’s checkout can recognise a match without holding the details themselves |
Everything comes from the merchant’s Shopify store or is entered by the merchant in the app.
Information we don’t collect
Checkouts that don’t match the blocklist are not stored. The app doesn’t read payment details, IP addresses or browsing behaviour, adds nothing to the storefront, uses no advertising trackers and doesn’t share blocklists between stores. It doesn’t score or profile buyers: only the merchant decides who is blocked.
Service providers
Each provider only receives what it needs for its job.
- Shopify: the platform the app runs on, and where merchants are billed.
- Oracle Cloud Infrastructure: hosting for the app and its database (United Kingdom).
- Cloudflare: DNS for our domain.
We do not sell personal information or share it for advertising.
How long we keep information
- Blocklist entries are kept until the merchant removes them or uninstalls the app.
- Blocked attempts are kept while the app is installed; removing a person keeps their past attempts until the shop’s data is deleted.
- When a merchant erases a customer in Shopify, we remove that customer’s email, phone and account from the blocklist and their attempts from the log.
- When a merchant uninstalls the app, blocking stops straight away. Shopify notifies us 48 hours later and we delete all of that shop’s data from our database.
- Backups are kept for up to 30 days, then deleted.
Security
All traffic uses HTTPS. The database is on a server only our team can reach, and the details sent to Shopify’s checkout are hashed.
Your rights
If you bought from a store that uses Banlist and want to know what it holds about you, contact that store: it decides who is on its list and can remove you. Merchants can export or delete their list at any time in the app. For anything else, email apps@tinyfloor.com.
Changes
If we change this policy, we’ll update the date above and tell merchants in the app about significant changes.
Contact
Questions about privacy: apps@tinyfloor.com.