Legal
The Dress Rental App Privacy Policy
Last updated: 23 October 2026
This policy applies to merchants who use The Dress Rental App (the "App") on Shopify, and to the customer data the App processes on their behalf for rental bookings, try-on appointments and related features. The App is provided by Dress Hire Websites.
Information we collect
From Shopify
- Store domain and identifiers
- Order data related to rentals
- Customer name, email, phone and address
- Product, variant and inventory data
- Webhook events
From merchants
- Store name, logo and business details
- Booking and delivery rules
- Pricing and insurance settings
- Manual bookings and staff notes
- Try-on configuration
From customers, through storefront and booking flows
- Name, email and phone
- Delivery and billing address
- Instagram handle
- Booking notes
- Booking and appointment dates
- Identification images, when the merchant enables this
Technical information
- App usage and configuration events
- Server and error logs
- Webhook payloads
- Support communications
Instagram widget and Instagram imports
If a merchant enables the Instagram feature, the merchant may connect an Instagram Professional account through Meta/Instagram's authorization flow. The App requests the instagram_business_basic permission to retrieve the connected account's profile identifier and username and recent media.
Depending on what Instagram makes available, retrieved media may include a media identifier, caption, media type, image or video URL, thumbnail URL, Instagram permalink and publication timestamp. The App stores the connected account identifier, username and connection time, together with an encrypted long-lived access token, so the widget can refresh recent posts.
The storefront widget displays recent media from the merchant's connected account, including images or thumbnails, captions, the account username, publication information and links to Instagram. Where a post has been imported and matched to a rental product, the widget may link it to that Shopify product. The widget does not send customer booking data, customer Instagram handles or customer contact details to Instagram.
Merchants may optionally import selected Instagram posts into Shopify as draft products. The App re-reads the selected post, uses its caption and media to create a draft Shopify product, and stores post and product references needed to maintain the match. Merchants are responsible for reviewing imported content and having the rights to use the images, captions and other content.
How we use information
- Create and manage rental bookings and try-on appointments
- Sync with Shopify orders and refunds
- Manage delivery, return and booking workflows
- Calculate availability and inventory
- Send booking communications
- Create aggregated, de-identified reports and public communications about rental trends, including most-rented dresses and other rental products
- Connect to a merchant-authorized Instagram Professional account, retrieve recent media, display it in the storefront widget and optionally create draft Shopify products from selected posts
- Provide support and troubleshoot problems
- Comply with legal obligations
The App does not sell customer personal data, use it for cross-context behavioural advertising, or use personal data to profile or score customers. We may use aggregated or de-identified rental trends, together with publicly available or merchant-authorized product information, for optional public communications such as Instagram posts, presentations or case studies.
Aggregated rental trends and Instagram publicity
The App may include an optional Instagram and publicity workflow for merchants who want to promote rental trends. A customer's Instagram handle may be collected as a booking or manual-booking field so the merchant can identify the customer and manage the rental relationship. The handle is treated as customer information and is not included in public trend reports or promotional posts.
For optional public communications, we may use aggregated or de-identified rental information to identify trends such as the most-rented dresses or other rental products during a stated period. We may combine those trends with a product name, category or image that is publicly available or that the relevant merchant has authorised us to use. A post may include a ranking, rental-count range or rental period, but it will not include a customer's name, contact details, Instagram handle, booking notes, identification images or exact booking details.
We may publish or share aggregated or de-identified rental trends through our website, Instagram account, other social-media accounts, presentations, case studies or other public communications. This includes Instagram posts about the most-rented dresses or other rental products during a stated period, including product name, category, rental-count range, ranking, rental period and a product image where the image is publicly available or the relevant merchant has authorised its use.
These public communications will not include customer names, email addresses, phone numbers, addresses, Instagram handles, identification images, booking notes, exact customer booking details or other information that directly identifies a customer. We will not publish a specific merchant's confidential sales or booking performance, or identify a merchant or product in a trend post, unless the information is already publicly available or the relevant merchant has authorised that use.
Merchants may contact us at dresshirewebsites@gmail.com to ask that their non-public merchant or product information not be used for optional publicity.
Data retention
| Data | Retained for |
|---|---|
| Staged bookings and ID uploads that were never completed | 48 hours |
| ID uploads for completed bookings | 30 days after the rental ends |
| Personal fields on completed, cancelled or refunded bookings | 730 days after the rental ends |
| Personal fields on past try-on appointments | 180 days after the appointment |
| Access audit logs | 400 days |
| Instagram connection, encrypted token, account metadata and imported-post matching records | While connected, or until the merchant requests disconnection or deletion |
Customer data is redacted when Shopify sends a customer-redaction request, and store data is deleted when Shopify sends a shop-erasure request after the App is uninstalled. The App may keep non-identifying operational and financial booking records after personal fields have been redacted.
Security
- HTTPS/TLS encryption in transit
- AES-256 encryption at rest for the database
- Need-to-know internal access
- Strong authentication and multi-factor requirements
- Logging of protected-data access (without recording customer field values)
- Automated retention and environment-separation controls
- Handling of Shopify privacy compliance webhooks
No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
Service providers
- Render: application hosting and managed PostgreSQL database
- Resend: delivery of booking and notification emails
- Twilio: delivery of SMS booking and notification messages
- Meta/Instagram: account authorization and retrieval of the connected merchant account's profile and media when the Instagram feature is enabled
Instagram account disconnection and deletion
The merchant controls the Instagram connection. When the merchant disconnects the account, or when Meta/Instagram sends a valid deauthorization or data-deletion request, the App removes the stored Instagram connection, encrypted access token, imported media identifiers and imported-post matching records held in the App. Draft Shopify products and media already created by an import remain Shopify data under the merchant's control and may need to be deleted separately. Meta and Instagram may retain or process information under their own policies.
International transfers
Our service providers and infrastructure may process data in countries other than the merchant's or customer's country, including the United States.
Your rights
Depending on applicable law, individuals may request access to, correction of, or deletion of their personal data, or object to its processing. Customers of Shopify stores can make requests through Shopify's processes; the App is configured to respond to Shopify privacy compliance webhooks.
Merchant responsibilities
Merchants are responsible for having a lawful basis to collect customer data, giving customers any required notices and obtaining consents, configuring the App in a compliant way, and publishing their own privacy policy and customer terms.
Children's privacy
The App is intended for business use by merchants. We do not knowingly design the App to collect personal data directly from children.
Contact
Questions about this policy: dresshirewebsites@gmail.com. To request deletion, see the Data Deletion Instructions.