Privacy Policy
Last updated: October 2026
Moddify Studio ("the app", "we", "us") is a Shopify app operated by Moddify Tech Sp. z o.o., a company registered in Wrocław, Poland (KRS 0001186085, NIP 8943265466, REGON 542315847). The app lets merchants offer a visual product builder on their Shopify store and passes the buyer's design to the order. This policy explains what data the app and this website process, why, where, and for how long.
Roles
For data about a merchant's store and account, we are the controller. For data about the merchant's customers (buyers who use a builder on the store), the merchant is the controller and we process that data on the merchant's behalf, only to provide the app.
Data the app processes
- Store and account data: the shop's
.myshopify.comdomain, the access token Shopify issues at install, the store name, contact email, currency, locales and Shopify plan, and the app plan you chose. We use it to authenticate calls to your store, bill through Shopify and adapt pricing to your plan type. - Customizers: the steps, questions, answers, prices, production codes, rules and published versions you create, and the layer images and swatches you upload to the asset library.
- Designs: when a buyer adds a configured product to the cart, the builder saves the buyer's choices (answers and any text they typed, such as initials or a name to engrave), the computed price, a readable summary and the production data. Designs do not contain the buyer's name, email or address.
- Buyer uploads: where a merchant offers image upload, the pictures buyers upload for their design. The original file is kept untouched for production, next to a resized copy for the preview, and is only reachable through private links in the merchant's admin.
- Design images: images of each design rendered by our server, one per product view, used on orders, production sheets and in the API.
- Order line data: from the
orders/createandorders/cancelledwebhooks we store the Shopify order ID, order name, line item ID and order date for lines that contain a design, so the design can be frozen with the order, re-priced and tagged. We do not store customer names, emails, addresses or payment details from orders. - API tokens and webhooks: tokens you create for the REST API and the webhook endpoints you add, with a log of recent deliveries.
- Builder statistics: daily counts of builder sessions, steps reached, add to carts and orders per customizer, sent only when the store's cookie consent allows analytics. They contain no personal data.
- Support requests: your name, email, store address (if you give it) and message when you use the support form or email us. We use this only to answer you. The form uses Cloudflare Turnstile to block spam bots; Turnstile checks your browser without setting tracking cookies.
- Website analytics: only if you accept analytics cookies on this website. See the Cookie Policy.
Why we process it
To run the app: show the builder, price configured products at checkout, attach designs and production data to orders, apply the merchant's order rules, answer API requests and provide support. Legal basis: performance of our contract with the merchant, and our legitimate interest in keeping the service secure and free of abuse. We do not use this data for advertising or profiling, and we do not sell it.
Where it is stored
The app, its database and all files (layer images, design images and buyer uploads) are hosted in the European Union, on a server run by Webdock in Denmark. Backups are stored with Hetzner in the EU.
Sub-processors
| Provider | Purpose |
|---|---|
| Webdock (Denmark) | Hosting: the server, database and files for the app and this website |
| Hetzner (EU) | Backups |
| Our transactional email provider | Delivering emails the app and this website send, such as support form messages |
| Cloudflare | Turnstile bot check on the support form |
| ImprovMX | Forwarding emails sent to our support address to our inbox |
| Google Ireland Limited | Google Analytics on this website, only after consent |
Shopify processes store, order and billing data under its own privacy policy.
Retention
- Customizers, designs and order line data are kept while the app is installed, so past orders keep their design and production data.
- Buyer uploads: files never attached to a design are deleted after 24 hours, uploads of designs that were never ordered after 30 days, and uploads of ordered designs 365 days after the order.
- When a merchant uninstalls the app, Shopify sends a
shop/redactrequest 48 hours later and we delete the store's data, including customizers, designs, uploads and tokens. - When Shopify sends a
customers/redactrequest for a buyer, we delete that buyer's uploads and design images and remove text they typed from their designs.customers/data_requestrequests are answered through the merchant. - Support requests are kept as long as needed to handle the request and any follow-up.
Your rights
Under the GDPR you can ask for access to, correction of, or deletion of your personal data, and object to or restrict its processing. Buyers should contact the store they ordered from, since the store is the controller of their order; we help the store respond. Merchants and anyone else can contact us directly. You also have the right to complain to a data protection authority; in Poland that is the President of the Personal Data Protection Office (UODO).
Contact
Questions about this policy or your data: [email protected]