Privacy Policy

Paceline by lalo-app · Last updated: October 15, 2026

In short: Paceline reads your products and stock to sort your collections and writes the new order back to Shopify. Your catalog is not stored on our server. A personal order for signed-in shoppers is optional, works only if you turn it on, and uses what shoppers chose themselves; we keep no shopper records.

1. Who we are and our role

Paceline is a Shopify app made by lalo-app (“we”, “us”). For data about your store and your shoppers that the app processes on your behalf, you, the merchant, are the controller and we act as your processor. Contact: support@lalo-app.com.

2. What the app accesses

Products (read_products, write_products): titles, vendors, types, tags, options, prices, publication dates and collections, to rank products; writing is used only to set the order of products in collections and to create the collections you approve from Scout.
Inventory and locations (read_inventory, read_locations): stock per location, so in-stock products come first in the locations you choose.
Publications (read_publications, write_publications): to publish the collections you approve to your online store.
Orders (read_orders, if you use “bestsellers”): products and quantities from orders of the last 30 days, counted per product in memory. No customer details are read for this.
Customers (read_customers, write_customers), only if you turn the personal order on: see section 4.

Paceline does not access checkouts, payment information or staff accounts.

3. Where data is kept

In your Shopify store: the order of your collections, the collections you approve from Scout, and shoppers' own preferences (section 4).
On our server: the store identifier and the access token issued by Shopify (encrypted); your settings and rules; the list of collections Paceline manages and the result of the last run; snapshots of a collection's order before Paceline changed it, so you can undo (at most 10 per collection, deleted after 30 days); Scout's suggestions (names, the product IDs they would contain and their status); service records about your store: when the app was installed and removed, plan changes, and the first steps you took in the app (for example the first collection Paceline manages and its first reordering) — to understand how Paceline is used; the store domain only, nothing about your products or customers; short-lived technical records: Shopify webhook IDs for 48 hours (so the same event is not processed twice) and the queue of background work until it is done; error messages are kept in memory only, with tokens, signatures and email addresses removed. Your catalog is read into memory during a run and is not stored.

Hosting: our server is in France (European Union), operated for us by Contabo GmbH. All connections are encrypted (HTTPS); access to the server is limited to us and protected by key-based login and a firewall.

4. Personal order for shoppers (optional)

If you turn it on, signed-in shoppers can tell your store what they like (for example “gravel” or “women's”) and the first pages of a collection lean towards it for them. Their filters always win, and everything after page two is the same for everyone.

What a shopper chooses is saved in that shopper's own record in your Shopify store (an app-owned customer metafield), not on our server.
To build the order, Paceline reads that choice and the products of the shopper's recent orders, using only the customer ID. It does not read names, emails, phone numbers or addresses.
The result is held in memory for at most 10 minutes and is never written to disk.
Shoppers who are not signed in, or who did not choose anything, see the store's general order.

5. Shared anonymous statistics

To make Scout's suggestions better for every store, Paceline can count what merchants decide about them. The option is called “Help improve Scout”. It is on by default, and you can switch it off at any time on the Selections screen.

What is counted: category-level decisions from Shopify's public product taxonomy, for example “Clothing tops × gender = women: accepted”.
What is never included: products, product titles, prices, sales, shoppers, and any identifier of your store.
Counted once: while sharing is on, each store counts each decision once; a changed decision moves the count instead of adding to it. For this our server keeps a record keyed by a salted one-way hash of the store, never its name.
Minimum of five stores: a count influences suggestions only after the same decision came from at least five different stores.
Switching it off or uninstalling the app stops sending anything new and unlinks your store: the record that tied your store to its decisions is deleted, so no one, including us, can tell what your store contributed. Decisions already counted stay in the totals, as anonymous counts. Stores not seen for 180 days are unlinked the same way.

These counts do not relate to an identified or identifiable person and are not personal data. We collect them on the basis of our legitimate interest in improving the service; you can object by switching the option off.

6. Who else sees the data

Shopify hosts your store and processes billing.
Contabo GmbH provides the server infrastructure and does not use the data for its own purposes.
Email: messages to support@lalo-app.com pass through Cloudflare Email Routing to our mailbox and are used only to answer you.

We do not sell your data, do not use it for advertising and do not share it with anyone else.

7. How long we keep it

Undo snapshots: at most 10 per collection, deleted after 30 days.
When Shopify sends a customer erasure request, the shopper's cached order (if any) is dropped; their preferences live in your store and are removed with the customer record. On a customer data request there is nothing about that shopper on our side to return.
When you uninstall Paceline, the access token is deleted right away and your store is unlinked from the shared counts.
When Shopify sends a data erasure request for your store (48 hours after uninstall), your settings, rules, snapshots and suggestions and pending background work are erased; the service records stay only without your store domain (replaced by an irreversible code), so they can no longer be linked to your store.
Nightly copies of the database are kept for 7 days, so erased data leaves the copies within a week.
Shared counts contain nothing that identifies your store and, once your store is unlinked, cannot be traced back to it, so they are kept.

8. Changes and contact

If we change this policy, we update the date above. Questions: support@lalo-app.com.