Privacy Policy

Joy Search ("the app", "we", "us", "our") is a Shopify application developed and operated by Joykek Dijital Reklam ve Pazarlama Danışmanlık Hizmetleri Ltd. Şti. ("Joykek"), Suadiye Mah. Bağdat Cad. No: 399, B Blok Kat: 1/1, Kadıköy / İstanbul, 34740, Türkiye. Joykek is the data controller for the merchant data described in this policy and a data processor for the storefront search events it handles on behalf of the merchant.

Contact: info@joykek.com

This policy describes how Joykek collects, uses, stores and protects information when a Shopify merchant installs and uses Joy Search, when a shopper uses the Joy Search panel on that merchant's storefront, and when someone visits this website (joysearch.joykek.com).

It does not cover the privacy practices of Shopify Inc., of the merchant's own store, or of any third-party service the merchant connects.

3.1. From your Shopify store (merchant)

When you install Joy Search, Shopify grants the app the following access scopes. All catalog scopes are read-only:

• read_products: products, variants, collections, images, prices, tags and metafields, to build the search index.
• read_inventory and read_locations: stock levels per location, to show availability and apply stock rules.
• read_locales: the languages and markets enabled on your store, to map results to the right language.
• write_pixels and read_customer_events: to register a Shopify Web Pixel and receive the events it emits, so purchases can be attributed to a search.
• Shop information: store domain, name, primary currency, plan name, contact email, used for the account and for support.

3.2. Storefront search events (shoppers)

The Joy Search panel on your storefront sends the app: the query text, the language of the page, the products shown and clicked, add-to-cart actions from the panel, the device type and an anonymous session id generated in the shopper's browser. The Web Pixel reports checkout completion so that a purchase can be linked to the search session that preceded it, limited to the products that were clicked from search.

We do not receive or store the shopper's name, email, address, phone number or payment details. IP addresses appear only in short-lived server logs used for security and are not linked to search events.

3.3. Information you enter in the app

• Merchandising rules, pinned results, sequence rules, synonyms, redirects, banners, exclusions and filter settings.
• Appearance settings (colors, layout, texts and translations).
• Plan selection and billing status, as reported by Shopify.

3.4. Authentication and session data

Joy Search stores an encrypted shop session record (shop domain, access token, granted scopes) required to call the Shopify Admin API on your behalf.

3.5. Website visitors

This website is static HTML. It sets no cookies, runs no analytics and loads no third-party scripts. Our hosting provider keeps standard web server logs only.

Joy Search deliberately keeps its footprint small. We do not:

• Request access to orders, customers, discounts or the checkout.
• Store shoppers' personal information (names, emails, addresses, phone numbers, payment data).
• Build cross-site profiles of shoppers or follow them to other stores.
• Sell, rent or trade any data for advertising or marketing.
• Use your catalog or your shoppers' searches to train models shared with other merchants.

Under GDPR and KVKK our legal bases are:

• Performance of a contract: processing necessary to provide Joy Search to the merchant.
• Legitimate interest: minimal logging, abuse prevention and security monitoring.
• Legal obligation: compliance with applicable law, including Shopify's mandatory privacy webhooks.

For shopper search events the merchant is the controller and Joykek acts as processor under the merchant's instructions and Shopify's Data Processing Addendum.

• Build and keep up to date a search index of your catalog.
• Answer search requests from your storefront and apply your merchandising rules.
• Compute analytics: top searches, zero-result searches, click positions, learning ranking and sales attributed to search.
• Show setup status, plan usage and notifications inside the app.
• Provide support when you contact us.
• Detect and prevent abuse, fraud and technical errors.

We share data only with the infrastructure providers needed to run the app. Each is bound by a data processing agreement.

We do not share data with advertising networks, data brokers or analytics vendors.

• Search index and settings: kept for as long as Joy Search is installed.
• Raw search events: kept for the analytics window of your plan (30, 90 or 365 days), then reduced to aggregated daily statistics that contain no session ids.
• Session and billing records: kept while the app is installed.
• Server logs: rotated within 30 days.

When you uninstall, everything associated with your shop is deleted within 48 hours (see section 12).

Joykek operates from Türkiye. The app, the database and the search index run in Germany (Hetzner). Transfers between Türkiye and the EEA rely on the European Commission's Standard Contractual Clauses where applicable and on the safeguards of KVKK and GDPR. Shopify processes data under its own DPA.

• All traffic is encrypted in transit with TLS 1.2 or higher.
• The search index is never exposed to the public internet. The storefront reaches it only through a scoped, read-only key that works for one store and cannot list or export the catalog.
• Every database query is restricted to the merchant's shop id; stores are isolated from each other.
• Shopify access tokens are stored encrypted at rest.
• Webhooks from Shopify are verified with HMAC signatures.
• Access to production servers is limited to authorized Joykek staff via SSH keys.

No system is perfectly secure. If an incident affects your data we will notify you and, where required, the supervisory authority without undue delay.

Depending on your jurisdiction (GDPR, KVKK, CCPA) you may have the right to access, rectify, erase, restrict, port or object to the processing of your personal data, and to withdraw consent where processing is based on consent. Write to info@joykek.com; we respond within 30 days. Shoppers should contact the merchant whose store they used; we assist the merchant with every such request.

When you uninstall Joy Search:

• Shopify sends the app/uninstalled webhook and the app marks your shop inactive immediately; the storefront stops calling the search index.
• Your search index, rules, settings, search events and session records are deleted within 48 hours.
• The Web Pixel and the app-owned metafield that carries the search key are removed from your store.

Joy Search also implements Shopify's mandatory privacy webhooks: customers/data_request, customers/redact and shop/redact. Because the app stores no customer identities, a customer request results in a confirmation that no personal data is held; a shop redact request deletes anything that may remain.

This website sets no cookies. The Shopify-embedded admin app uses only the session cookies Shopify's App Bridge requires for authentication. On the storefront, the Joy Search script keeps the shopper's recent searches and the anonymous session id in the browser's own storage on the shopper's device; nothing is used for cross-site tracking or advertising.

Joy Search is a business tool for Shopify merchants and their staff. It is not directed to children under 16 and we do not knowingly collect personal data from children.

We may update this policy from time to time. Material changes are announced by updating the date at the top of this page and, where appropriate, inside the app or by email to the address on your Shopify Partner account.

• Joykek Dijital Reklam ve Pazarlama Danışmanlık Hizmetleri Ltd. Şti.
• Suadiye Mah. Bağdat Cad. No: 399, B Blok Kat: 1/1, Kadıköy / İstanbul, 34740, Türkiye
• Email: info@joykek.com
• Website: joykek.com

For data protection requests please use the subject line "Privacy Request - Joy Search".