Data & privacy
This is the practical summary for merchants. The full legal document is the privacy policy.
What the app stores
Section titled “What the app stores”| Data | Where | Why |
|---|---|---|
| Product & shop configuration (fields, zones, fonts, settings, translations) | Your shop’s metafields — inside Shopify | So your theme reads everything via Liquid, with zero storefront network calls |
| Personalized order lines (order number, product, field values, font, color, prep status) | The app’s database (EU) | The Orders page, printing, CSV, production files |
| Shop record (domain, plan, onboarding state) | The app’s database (EU) | Operating the app |
| Minimal telemetry (install, setup milestones — no personal data) | The app’s database (EU) | Reliability |
What the app deliberately does not do
Section titled “What the app deliberately does not do”- No customer accounts data: no names, emails, addresses or payment data are stored by the app. The personalization text itself may contain personal information (a first name to engrave) — that’s the only such data, and it’s stored to fulfill the order.
- No tracking on your storefront: the block makes zero external network requests, sets no cookies, loads no third-party scripts or pixels. Nothing to add to your cookie banner.
- Customer-uploaded images never touch the app’s servers — Shopify hosts them and the order carries the link.
Where data lives
Section titled “Where data lives”The app is hosted in the European Union (France). Configuration data lives in your Shopify shop itself (metafields).
Retention & deletion
Section titled “Retention & deletion”| Event | Effect |
|---|---|
| You uninstall | The shop is deactivated immediately; all its data is purged after 30 days. Reinstalling within the window restores your setup. |
| Shopify “shop redact” request (48h after uninstall per Shopify’s schedule) | Full purge of the shop’s data. |
| Customer erasure request (GDPR) | Shopify relays it to the app; the customer’s personalized order records are purged. |
| Customer data request (GDPR) | The app provides the personalization data it holds for that customer through Shopify’s standard process. |
These three GDPR webhooks are implemented, verified (HMAC) and idempotent — they’re a Shopify App Store requirement the app takes seriously.
Your responsibilities as a merchant
Section titled “Your responsibilities as a merchant”You remain the data controller for your customers. Practically:
- mention in your own privacy policy that personalization text (and uploaded images, if you enable them) is processed to fulfill orders;
- handle customer privacy requests through Shopify’s standard tools — the app responds to them automatically.
Questions: support · Full text: privacy policy.