Privacy Policy

Last updated: November 15, 2026

This policy explains what data the Shopify app Allset: Sort Collections ("Allset", "we", "us") uses, why, who it's shared with, and how long it's kept. Allset was called Oftop before; this policy covers the app under both names.

The short version. We use your store's product, stock and sales data to sort your collections. We never sell merchant or shopper data to anyone, and we don't share it for advertising. The only shopper personal data we store is the email address (and, if texts are on, the phone number) of shoppers who ask to be told when a product is back in stock, and we delete it as soon as the alert is sent, or after 180 days.

1. Who we are

Allset is made by TrendyUI.

TrendyUI
8 The Green, Ste A
Dover, DE 19901
United States
Email: trendyuis@gmail.com

Write to the email address above about anything in this policy.

2. Merchants, shoppers and who is responsible

"Merchant" means a Shopify store that installs Allset. "Shopper" means a visitor or customer of that store.

For a merchant's own data (contact email, settings, billing), we decide how it's used, as described here.
For shoppers' data, the merchant is the controller and Allset processes it on the merchant's behalf, only to provide the features the merchant switched on. Shoppers should also read the store's own privacy policy.

3. What we read from Shopify

When a merchant installs Allset, Shopify gives the app access to parts of the store. Allset uses that access to:

Products and collections: titles, tags, product types, vendors, prices, discounts, creation dates, images and the order of products in each collection, so it can sort them, show you a preview and undo a sort.
Inventory: stock per product option and, if you choose locations, per location, so sold-out and low-stock items can be moved or taken out and put back.
Orders: only the products, quantities and prices on each order, to work out best sellers, revenue, profit and which products are bought together. Allset does not read or store customer names, email addresses, phone numbers or addresses from orders, and it doesn't keep order numbers. It stores only totals per product (and per pair of products) per day.
Store details: your store's name, myshopify domain, owner email and customer contact email.
Product data you choose: cost per item (for profit), custom product fields and star ratings from review apps, only if you sort by them.

Allset also writes to your store: it reorders collections, can take sold-out products out of collections or sales channels and put them back, can create "New arrivals" and "Best sellers" collections, saves badge and "bought together" data on products, and can create one automatic discount for "bought together" if you switch that on.

4. What we collect from merchants

Account and access: your myshopify domain and the access token Shopify issues for Allset.
Contact details: the store owner's email and store name, and any address you enter for stock emails.
Your setup: sorting recipes, pins, schedules, tests, add-on settings and API keys (stored only as a one-way hash).
History: each sort Allset ran: when, which collection, how many products moved and why. For 30 days we also keep the order before each sort, so you can undo it.
Plan and billing status, as reported by Shopify. Allset never sees your card or bank details; Shopify bills you.
Usage events: milestones such as installing, finishing setup or uninstalling, and page-speed measurements from the app's screens, so we can see where the app needs to improve.
Google Analytics (optional): if you connect a GA4 property, the service-account key you upload and the per-product views, adds to cart and purchases read from it.
Messages you send us by email.

Inside the Shopify admin, Allset uses an error-monitoring tool (Sentry, see section 7). When something breaks it records technical details of the error, and it records a sample of screen sessions with all text masked and all images blocked, so we can see what went wrong without seeing your store data. It does not record cookies, form contents or your name.

5. What we collect from shoppers

Allset collects nothing from shoppers unless the merchant switches on one of the features below.

Back-in-stock alerts

If the merchant adds Allset's "Email me when it's back" form to sold-out products, a shopper can ask to be told when that product is back. To sign up, the shopper ticks a box agreeing to be emailed once about that product. We store:

the shopper's email address;
their mobile number, only if the merchant allows text alerts and the shopper ticks a separate box for texts;
the product and option they want, and the time they signed up.

We don't store the shopper's name, IP address or cookies with a sign-up. We use the email address or number only to send one alert about that product, in the store's name. We don't add shoppers to any mailing list, and we don't use their details for anything else.

We delete the sign-up as soon as the alert is sent. If the product never comes back, we delete it after 180 days. A shopper can also delete it at any time with the unsubscribe link in the alert. After an alert, we keep only a count (which product, email or text, and when), with no contact details, so we can show the merchant how many alerts were sent.

Shopper activity (web pixel)

If the merchant switches on Shopper activity, Allset adds a Shopify web pixel to the store. It counts collection views, product views, adds to cart and orders, and which collection a shopper came from, so the merchant can sort by what shoppers look at and buy.

Shopify runs the pixel only for shoppers who allow analytics where the law asks for consent, and the pixel stops sending if a shopper withdraws consent. It isn't used for marketing or advertising.
It sends only: the type of event, the collection and product, the quantity and the amount. It doesn't send names, email addresses, phone numbers, addresses, IP addresses or shopper IDs, and Allset doesn't record the IP address the counts come from.
It doesn't set cookies. It keeps a short list of events in the browser's session storage until they are sent; the browser clears that when the tab is closed.
Events are added up into daily totals per collection and product within about 10 minutes and then deleted. Only those totals are kept (see section 9).

Product badges and Bought together

Badges ("Best seller", "New", "Only a few left" and so on) and "Frequently bought together" suggestions are worked out from the product, stock and sales totals described in section 3. They don't use any information about individual shoppers. Items added from the "Bought together" block carry a hidden marker with the product they were suggested from, so Allset can count sales from the block. No shopper details are kept.

6. How we use data

To provide Allset: sort collections, show previews, history and undo, show badges, send back-in-stock alerts and suggest products bought together.
To email merchants: service notices, stock emails you switch on, a reply to any data request Shopify passes on, and occasional product news. After you uninstall, we may send one email asking how we could do better. Every non-essential email has an unsubscribe link.
To keep Allset working and secure: find and fix errors, prevent abuse, and improve the app.
To meet legal obligations.

We do not sell merchant data or shopper data to anyone, we don't rent or trade it, and we don't share it with advertisers or use it for targeted advertising. We don't use your store's data to train AI models.

We share data only with the service providers below, only what each needs to do its job, and only for Allset. Some are used only if a feature is switched on.

Provider	Why	What it receives
Shopify	The platform Allset runs on; billing	Everything Allset reads or writes in your store
Our hosting provider	Runs Allset's servers and database	All data described in this policy
Resend	Sends email	Merchant email addresses and messages; for back-in-stock alerts, the shopper's email address and the product
Twilio	Sends text alerts (only if the merchant allows texts and the shopper asks for one)	The shopper's mobile number and the alert text
Sentry	Error monitoring	Technical error details, page addresses and the store's domain; masked screen recordings (see section 4)
Anthropic	AI feature "Describe how you want this collection sorted" (only when a merchant uses it)	The sentence the merchant types, the collection's title and its number of products. No product details, sales or customer data
Google	Reading Google Analytics numbers (only if the merchant connects GA4)	The merchant's own GA4 key, used to read product numbers from their own account

We may also share data if the law requires it, to protect our rights or users' safety, or with a buyer if Allset is sold, in which case this policy continues to apply.

8. Where data is stored and international transfers

Allset's servers and database are run by our hosting provider. Some of the providers above, including Resend, Twilio, Sentry and Anthropic, are based in the United States and process data there. So data may be processed in countries other than yours, including the United States, where data protection laws may differ. Where the law requires it, we rely on the safeguards these providers offer, such as the European Commission's Standard Contractual Clauses, in their data processing terms.

9. How long we keep data

Data	How long
Back-in-stock sign-up (email or mobile number)	Until the alert is sent, the shopper unsubscribes, or 180 days, whichever comes first
Raw shopper activity events	About 10 minutes, then added into daily totals and deleted
Daily shopper activity totals	90, 180 or 365 days depending on plan; deleted when Shopper activity is switched off
Sales totals per product and per pair of products	60 days, rolling
"Order before the sort" kept for undo	30 days
App page-speed measurements	35 days
Everything else about your store	While Allset is installed, then deleted as described below
Server logs (standard web server logs may include the IP address and browser type of any request) and backups	Only as long as needed to run and secure the service; deleted data drops out of backups as they expire

When you uninstall

As soon as you uninstall, Shopify cancels Allset's access to your store and we delete your access token, your sales and stock data and the list of collections Allset was filling. 48 hours later Shopify sends us a request to erase your store's data (shop/redact), and we then delete all remaining data about your store, including your settings, history, contact details and any shopper sign-ups. We complete this within 30 days of that request.

Collections Allset sorted stay in the order Allset last gave them. To put a collection back in its original order, turn Allset off for it before you uninstall.

10. Your rights

Depending on where you live, you may have the right to access, correct, delete or get a copy of your personal data, and to object to or limit how it's used.

Merchants: email trendyuis@gmail.com from your store's email address, with your myshopify domain. We'll reply within 30 days. You can also change most settings yourself in the app, and uninstalling starts deletion as described above.
Shoppers: please contact the store you shopped with, since they control your data. When you make a request to a store, Shopify passes it to Allset: for a data request (customers/data_request) we send the store owner everything Allset holds about you, and for an erasure request (customers/redact) we delete your back-in-stock sign-ups. You can also unsubscribe from a back-in-stock alert with the link in it, or email us and we'll pass your request to the store.

You can also complain to your local data protection authority.

11. Security

All data travels over encrypted connections (HTTPS/TLS), between your browser and Allset, between Allset and Shopify, and to the providers above. Access to Allset's servers and database is limited to the people who maintain Allset. Requests from Shopify are checked with Shopify's signature before Allset acts on them. No system is perfectly secure, but if a security incident affects your data, we'll tell affected merchants without undue delay.

12. Children

Allset is a tool for businesses and isn't meant for children. We don't knowingly collect data from children.

13. Changes to this policy

If we change this policy, we'll update the date at the top. If a change significantly affects how we use your data, we'll tell merchants in the app or by email before it takes effect.

14. Contact

Questions about this policy or your data: trendyuis@gmail.com, or by post to TrendyUI, 8 The Green, Ste A, Dover, DE 19901, United States.