Privacy Policy

1. Introduction

GemReach is operated by John Moore, a sole trader trading as JMS Dev Lab in Ireland ("we", "us", "our"). GemReach is a clienteling and text-messaging application for jewelry retailers. New accounts are installed through Shopify; existing legacy standalone accounts remain supported. This Privacy Policy explains how we collect, use, and protect personal information when you use the application.

2. Information We Collect

When merchants install and use GemReach, we collect and process the following data:

• Shop information: Store name, Shopify domain (where connected), email address, and currency/timezone preferences.
• Client information: Names, email addresses, phone numbers, and clienteling details (e.g. important dates, ring sizes, wishlists, notes, purchase history) entered by the merchant or synced from the merchant's Shopify store or a merchant-provided CSV file.
• Text messages: The content of SMS/MMS conversations between the merchant and their clients, sent and received through the app.
• Consent records: A timestamped audit trail of separate SMS service-update and marketing opt-ins (including the consent language shown and, for web opt-ins, a one-way hash of the requesting IP address), opt-outs (STOP), and service-update re-subscriptions (START).
• Images: Photos uploaded by the merchant for messaging (MMS) or shop branding.

3. How We Use Your Information

• Maintaining client profiles and follow-up reminders for the merchant
• Sending and receiving text messages on the merchant's behalf
• Supporting responsible texting: consent checks, STOP/START handling, quotas, and quiet hours
• Sending automated occasion messages (e.g. birthdays, appointment reminders) the merchant has enabled
• Generating usage and campaign statistics for the merchant

Service-update and marketing texts are each sent only when the client selected that specific category. Every recipient can opt out of all texts instantly by replying STOP.

4. Data Sharing

We do not sell personal information. Data may be shared with:

• Shopify: As the platform provider for connected stores, in accordance with Shopify's terms of service.
• Service providers: We use Twilio for SMS/MMS delivery, SendGrid for email delivery, and Anthropic for optional AI-assisted message drafting. These providers process data solely to provide their service on our behalf.
• Hosting and storage: The application is hosted on Railway, and uploaded images are stored on S3-compatible Cloudflare R2 infrastructure.

5. Data Retention

Client and messaging data is retained for as long as the merchant's account is active. For Shopify-connected stores, when a merchant uninstalls the app the account is deactivated; if the merchant does not reinstall within 48 hours, Shopify requests deletion of all shop data and we comply by permanently removing all records associated with that shop. While an account remains active, consent and opt-out records are retained to honor opt-outs and demonstrate compliance. Backups expire according to our normal backup-retention cycle and are not restored except for disaster recovery.

6. Your Rights (GDPR)

If you are a client whose data has been entered into GemReach by a merchant, you have the right to:

• Access: Request a copy of your personal data.
• Rectification: Request correction of inaccurate data.
• Erasure: Request deletion of your personal data.
• Portability: Request your data in a machine-readable format.
• Objection: Stop marketing texts at any time by replying STOP to any message.

To exercise these rights, please contact the merchant you shop with, or contact us directly using the information below.

7. Security

We use industry-standard security measures including encrypted connections (HTTPS), encrypted access tokens at rest, secure authentication with optional two-factor authentication, and role-based access controls. Webhook communications from Shopify and Twilio are verified with cryptographic signatures.

8. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data rights, contact the data controller: