Hinata WooCommerce Migration — Privacy Policy
Last updated: October 22, 2026
Hinata WooCommerce Migration is a Shopify app that copies a merchant’s WooCommerce store into their Shopify store: collections, products, customers, orders, refunds and cancellations. This policy explains what the app processes, why, and for how long. The app reads WooCommerce; it never writes to it.
1. Data the app processes
Store credentials. The Shopify store domain and the offline access token Shopify issues at installation; the address of the merchant’s WooCommerce site and the WooCommerce API key pair used to read it. The WooCommerce credential is encrypted at rest with AES-256-GCM, bound to the store it belongs to, and is never displayed again after it is saved.
Migration bookkeeping. A correspondence table between WooCommerce identifiers and the Shopify identifiers the app created, the merchant’s migration settings, and a migration journal recording what happened to each item (migrated, adapted with the reason, or skipped). Journal entries may contain product names, order numbers, collection names, source or Shopify customer identifiers, and diagnostic details such as an e-mail address rejected by Shopify. The app does not store payment card credentials.
Customer data in transit. Names, e-mail addresses, phone numbers, postal addresses and order contents are read from WooCommerce and written into the merchant’s own Shopify store. They are processed to perform the migration and are not retained by the app beyond the bookkeeping described above. The app does not request customer notification e-mails from Shopify and never modifies anything on the WooCommerce site. Shopify store-owner notifications and other automations configured by the merchant are controlled separately.
What the app does not do. No advertising cookies, no advertising, no profiling and no sale of data. The app uses Shopify authentication and the service providers listed below to operate. The operator may access technical records to provide support and maintain the service.
2. Why the app processes it
Solely to provide the service the merchant asked for: authenticate the app inside the Shopify admin, read the source store, create the corresponding objects in the destination store, report the outcome, and let a migration be resumed or re-run without creating duplicates.
3. WooCommerce API access
The app reads data through the REST API included with WooCommerce, using the read-only key and secret supplied by the merchant. The merchant creates a key with read permission and can revoke it at any time in WooCommerce settings, under Advanced → REST API.
4. Sub-processors
- Shopify — the platform the app runs in and writes to (Admin API).
- Railway — hosting of the application and of its PostgreSQL database.
These providers process data needed to deliver and host the service.
5. Retention and deletion
Data is kept while the app is installed, so that a migration can be resumed, verified or re-run. Uninstalling the app removes its Shopify session immediately. The app honours Shopify’s mandatory compliance webhooks:
customers/data_request— the app records the request so the operator can prepare a response from its mappings and journal and provide it to the merchant. This response requires operator follow-up.customers/redact— the mappings and journal entries identified for that customer and the orders specified in the request are deleted, along with recorded data requests for that customer.shop/redact— the following migration data is purged for that store: sessions, settings, encrypted credential, mappings, jobs, pricing records, journal and recorded data requests. Two types of records are retained: a fraud-prevention ticket holding the store domain, a technical fingerprint of the source store and free-sample counters, so the free sample cannot be reset by uninstalling and reinstalling; and the list of app purchases made for the store (purchase identifier, name, status, whether Shopify issued it as a test charge, the store plan name at that time and any access revocation), so that a valid lifetime purchase is honoured after a reinstall. These retained records contain store identifiers and may therefore remain identifiable business or personal information; they are not anonymous.
A merchant can ask for access or erasure at any time by writing to the address below. Any request concerning retained purchase or anti-abuse records is reviewed by the operator separately from the automated purge, taking into account the reason for retention and applicable obligations.
6. Roles and rights (GDPR)
The merchant is the data controller for their customers’ data; the operator of Hinata WooCommerce Migration acts as a data processor, on the merchant’s instructions, for the duration of the migration. Data subjects exercise their rights of access, rectification, erasure, restriction and portability with the merchant, who can obtain the app’s cooperation through the compliance webhooks above or by writing to the address below.
7. Security
Transport is HTTPS end to end. WooCommerce credentials are encrypted at rest and bound to their store. The production source connection refuses private-network addresses. Merchants are instructed to use a key with Read permission; the app sends read requests to their WooCommerce site.
8. Changes
This policy may be updated; material changes are reflected by the “Last updated” date at the top of this page.
9. Contact
Questions, or a deletion request: contact@hinata.fr.