Tessetto Privacy Policy
Last updated: 13 October 2026 (before the first release)
Tessetto ("the App") is a Shopify app operated by Vitalcore Research Inc., doing business as Nolarine ("we", "us"), 30 N Gould St, Ste R, Sheridan, WY 82801, USA. It lets Shopify merchants sell paid memberships and gives members their perks and access while the membership is paid. This policy explains what information the App collects, why, and what rights you have.
Who this policy covers
- Merchants: the Shopify stores that install the App, and the store staff who use it.
- Members: customers of those stores who buy a membership, and customers the store gives a membership to.
For members' information, the merchant is the data controller and we act as their processor. Members with questions about their data should contact the store they joined first; we will help the store respond. Merchants who need a data processing agreement can ask for one at support@nolarine.com.
The App does not read or store anyone's address, phone number or payment details.
Information we collect
From merchants, when the App is installed:
- The store's Shopify domain, name, contact email, currency and main language.
- The name and email of the staff member signed in to the App, which Shopify provides so the App knows who is using it.
- A Shopify access token so the App can do its job. It is stored in a database on our server that is not reachable from the internet.
- The plan, the trial dates, and the store checks the App runs (payment provider, theme and customer accounts).
- The membership programs, tiers, perks, prices, settings and email texts the merchant sets up in the App.
About members, only for customers who hold a membership:
- Their Shopify customer ID, first and last name and email address, so the merchant can find them in the member list and the App can send them emails about their membership.
- Their membership: tier, status, start, paid-through and renewal dates, the Shopify subscription contract and the orders that paid for it, and their language, so emails are sent in it.
- A record of each payment attempt for a renewal: when it ran and Shopify's result. It holds no card details.
- An activity log of each change to the membership: what changed, when and why. When a staff member made the change, the log shows their first name.
- On the Pro plan, a record of each store credit grant: the amount, when it expires and Shopify's reference for it.
- A record of each email sent (the recipient's email address and the subject), so the same email is never sent twice.
- When a merchant imports existing members from a file (Pro), the names and emails in it are used only while the import runs; the file is deleted when it ends.
In the merchant's Shopify store, not on our server: the App adds member tags (for example "member" and "member-gold") and one App-owned record on the customer with the membership's status, tier, perks and dates. Shopify uses them to give member prices, to allow members-only products at checkout, and to show members-only content and the member's page in their customer account. The App removes them when the membership ends.
We do not collect or store card numbers or other payment credentials. Members pay in Shopify's checkout. For renewals, the App asks Shopify to charge the payment method the member saved at checkout; the card details never reach us. The member's page in their customer account shows the card the way Shopify shows it (for example the last four digits), drawn by Shopify and not stored by us.
The App adds no cookies, tracking or analytics to the merchant's storefront. Its storefront blocks show membership plans, member prices and members-only content, and store nothing about visitors. Members-only pages are served through Shopify, which tells the App which signed-in customer is asking so the App can check their membership.
How we use it
- To start, renew and end memberships, and to switch members' perks and access on and off with them.
- To bill renewals through Shopify, retry failed payments, and tell members what happens next.
- To email members about their own membership on the merchant's behalf: welcome, renewal reminders, payment problems, cancellation and ending notices, and price change notices. These emails are sent in the store's name, with the store's email address for replies.
- To show merchants their members, activity logs and reports.
- To provide support, keep the App secure, and fix problems.
We do not sell personal information, and we do not use it for advertising or profiling. We send no marketing email: every email is about the member's own membership.
Legal basis. For merchant information, we rely on our contract with the merchant (providing the App they installed) and our legitimate interest in keeping it secure and supporting it. For members' information, we process it on the merchant's instructions; the merchant decides the legal basis (usually the contract with their member for the membership).
Who we share it with
Only service providers that help us run the App, under contracts that limit their use of it:
| Provider | Purpose | Location |
|---|---|---|
| Shopify | The platform the App runs on; checkout, payments, renewals and customer accounts | Canada / worldwide |
| Hetzner Online GmbH | Application hosting and database (encrypted HTTPS connections; daily backups) | Germany (Falkenstein), European Union |
| PLACEHOLDER (the email delivery provider, named when it is chosen, before the first release) | Delivering the emails to members: it receives the member's email address, first name and the email's text | PLACEHOLDER |
| Cloudflare, Inc. | Domain name service, and forwarding of email sent to support@nolarine.com | United States / worldwide |
| Google LLC | The mailbox where support email is read and answered | United States / worldwide |
We may also disclose information if required by law.
How long we keep it
- While the App is installed, we keep membership records so merchants can see their members and history. Records of renewal payment attempts are deleted after 24 months.
- When a merchant uninstalls the App, Shopify notifies us 48 hours later and we delete that store's data, including all members' information, within 30 days.
- When Shopify forwards a member's request to delete their data, we remove their name, email and customer ID from our records, including the activity log and our log of emails sent, within 30 days.
- When a customer asks a store for their data, we keep a note of the request (the customer's email) so the merchant can answer it; it is deleted with the store's data.
- After a store uninstalls, we keep only its Shopify domain and the date its free trial started, so that each store gets one free trial. This contains no personal information.
- Database backups are kept for 14 days, so deleted information leaves them within 14 days of being deleted.
- Server logs hold store domains and order and contract numbers, never names or emails; they are rotated automatically and kept only for a short time.
- Support emails are kept for up to 24 months after the conversation ends, then deleted.
Member tags and the App's record on the customer are in the merchant's Shopify store. The App removes them when a membership ends, and the merchant can remove them all from the App before uninstalling. Anything left in the store after uninstalling is the merchant's to keep or delete.
Your rights
Depending on where you live (for example under the GDPR, UK GDPR or CCPA/CPRA), you may have the right to access, correct, delete or export your personal information, and to object to or restrict its processing. Members should contact the store first; merchants can contact us directly. We respond within 30 days. You can also complain to your local data protection authority.
Security
Data is sent over HTTPS and stored with our hosting provider, on an encrypted disk, with access limited to what the App needs. Only Nolarine's operator can reach the server and its database, by key login. To help a store, we look at its plan, its settings and the status of the App's work for it; we open members' details only to answer that store's own request, and every operator action is logged. No system is perfectly secure, but we take reasonable steps to protect your information. If a security incident exposes personal information, we tell affected merchants within 72 hours of finding out, so they can inform their members. Report a security problem to support@nolarine.com.
International transfers
We are based in the United States and our providers may process data in other countries. Where the law requires, we rely on appropriate safeguards such as standard contractual clauses.
Children
The App is for businesses and is not directed at children under 16.
Changes
We will post any changes on this page and update the date above. Significant changes will be announced to merchants in the App.
Contact
Vitalcore Research Inc. (Nolarine) 30 N Gould St, Ste R, Sheridan, WY 82801, USA Email: support@nolarine.com