Who we are
DataDock is a Shopify app operated by [legal entity name], registered at [registered address] (“we”, “us”).
For the data inside your store, you are the controller and we are a processor. We act on your instructions: we read and write store data only when you ask us to, through the app.
Questions, or a request about your data: [privacy contact email].
What the app does with your store's data
DataDock imports, exports and migrates Shopify store records. To do that it reads records through Shopify's Admin API, compares them against the file you provide, and — only after you approve the preview — writes the changes back.
The data it touches is whatever the data type you selected contains. For customers and orders, that includes personal data: names, email addresses, postal addresses, phone numbers and order contents.
We do not sell your data, we do not share it for advertising, and we do not use it to train machine-learning models.
What we store, and for how long
| What | Why | Kept for |
|---|---|---|
| Shop domain, access and refresh tokens | To call the Admin API on your behalf | Until you uninstall |
| Job records — type, status, counts, errors | Job history and the rollback list | Until erasure |
Per-row plans (job_rows) | The diff you approve; may reference customer or order data | Until erasure |
| Rollback journal | Inverse patches, so an import can be undone | Until erasure |
| Saved column mappings | So a supplier's file format maps itself next time | Until erasure |
| Schedules | To run repeating imports and exports | Until erasure |
| Saved FTP/SFTP servers | To fetch or deliver files; credentials encrypted | Until erasure |
| Webhook logs | To show what Shopify sent and when | Until erasure |
| Uploaded sheets and result files | The actual file contents, on disk | 30 days after the job finishes, then deleted automatically |
The uploaded sheet and the result file are where personal data actually sits, so they are deleted 30 days after a job finishes. The job record and its rollback journal are kept beyond that, so an old import stays reversible.
Credentials you save
If you save an FTP, FTPS or SFTP server, its password or key is encrypted at rest with AES-256-GCM and is never sent back to the browser. Once saved it cannot be read out of the app — only replaced.
The app refuses to connect to hosts on private networks, and re-checks on every redirect, so it cannot be used to reach systems it should not.
Export download links
An export can be shared through a signed link that works outside the Shopify admin. Those links are cryptographically signed, expire after a limited period, and cannot be altered to point at another job. Anyone holding an unexpired link can download that file, so treat one as you would the file itself.
Who else processes the data
| Sub-processor | Purpose | Location |
|---|---|---|
| Shopify | Source and destination of all store data | Per Shopify's terms |
| MongoDB Atlas | Application database | [cluster region] |
| Oracle Cloud Infrastructure | Application and worker hosting, file storage | India South (Hyderabad) |
We do not pass data to anyone else. If a supplier's FTP server is used, files move directly between that server and ours at your instruction.
Your rights, and how requests are handled
DataDock implements Shopify's mandatory privacy webhooks. They behave as follows.
A customer asks what data is held
Shopify sends customers/data_request. We look up every job row that references that customer — by Shopify ID or by email, because an import keyed on email never had an ID — and report what is held. You are the controller and answer the customer, within 30 days; our report is what you answer from.
A customer asks to be erased
Shopify sends customers/redact. Every job row matching that customer, by ID or email, is deleted, along with the rollback journal entries for them.
You uninstall the app
Two things happen, at different times:
- Immediately — the shop is marked uninstalled and the access token is discarded. Your data is kept, in case you reinstall.
- 48 hours later, Shopify sends
shop/redactand everything is deleted: every uploaded file and result file on disk, all job rows, the rollback journal, jobs, saved mappings, saved servers and their encrypted credentials, schedules, webhook logs and the shop record itself.
You can also ask us directly at [privacy contact email] to erase everything before those 48 hours are up.
Security
- All traffic is served over HTTPS.
- Requests are authenticated with Shopify session tokens; the shop is always taken from the verified token, never from anything the browser sends.
- Every webhook's signature is verified against the raw request body before it is acted on.
- Saved FTP/SFTP credentials are encrypted at rest with AES-256-GCM.
- The app requests only the access scopes its data types need — the scope list is generated from them and checked by an automated test, so it cannot quietly grow.
No system is perfectly secure. If you believe you have found a vulnerability, please write to [security contact email].
Changes to this policy
If this policy changes materially we will update the effective date above and, where the change affects how your data is handled, notify you in the app before it takes effect.
Contact
[legal entity name]
[registered address]
[privacy contact email]
This policy is governed by the laws of [jurisdiction].