Privacy Policy

This policy applies to merchants who install the App and to end customers who interact with option fields, file uploads, or other customization features on a merchant’s Online Store.

The merchant is the data controller for customer-facing personalization. Workiny processes data on the merchant’s behalf to operate the App.

From merchants (via Shopify OAuth and admin use): shop domain, shop name, contact email, access tokens required to operate the App, app settings (such as language preference and currency), option set configurations (steps, fields, choices, visibility rules, styling), and support messages you send through the in-app form.

From orders and the storefront: product and variant identifiers, cart and order line item properties, customization selections, optional price add-on amounts linked to choices, and customer-uploaded files when a merchant enables file upload fields.

From storefront visitors: technical data needed to deliver the widget (such as product ID, locale, and App Proxy request metadata). We do not require customers to create an account in the App.

We use collected information to provide and improve the App: render product options on the storefront, calculate live add-ons, attach selections to cart and Shopify orders, sync native add-on products where configured, serve customer file uploads through secure app proxy links, respond to support requests, maintain security, and comply with legal obligations.

We do not sell merchant or customer personal data. We do not use customer data for advertising unrelated to operating the App for the installing merchant.

Data is stored on secure servers operated by us or our infrastructure providers. Customer file uploads are stored in private application storage and are accessed through authenticated App Proxy endpoints—not as publicly browsable URLs.

Configuration data may be cached for short periods (for example, storefront config) to improve performance. Cached data is invalidated when merchants change settings.

When you uninstall the App, Shopify sends a shop/redact compliance webhook after a waiting period; we then delete shop configuration, stored customer uploads, and other App data linked to your store, as described in Shopify’s partner requirements. Customization choices already attached to Shopify orders remain in your Shopify admin.

We share data only as needed to operate the App: with Shopify (API, webhooks, billing through Shopify App Pricing), and with hosting, database, and email providers that process data under our instructions.

We may disclose information if required by law or to protect the rights, safety, and security of merchants, customers, or the App.

The App registers mandatory Shopify compliance webhooks: customers/data_request, customers/redact, and shop/redact.

On a customer data request, we provide the merchant with any App-held data related to the request (such as stored uploads and configuration metadata). Selections attached to Shopify orders are available in Shopify admin.

On customer redact, we delete App-held data tied to the specified customer or orders for that shop (such as stored uploads). On shop redact after uninstall, we delete the shop’s App data as described above.

You are responsible for informing your customers about personalization and file uploads, obtaining any required consents, and answering customer privacy requests for data you control as a merchant.

You should only collect information through option fields that you need for fulfillment and comply with applicable laws (including GDPR, UK GDPR, and CPRA where relevant).

We may process and store data in countries other than your own. Where required, we rely on appropriate safeguards for cross-border transfers.

For privacy questions contact [email protected]; for in-app support and technical help use [email protected].

Workiny — Üsküdar, Istanbul, Turkey.

We may update this Privacy Policy from time to time. The “Last updated” date at the top will change when we do. Continued use of the App after changes constitutes acceptance of the updated policy.