Privacy Policy
Effective date: 22 October 2026
ShopFlow (shopflow.studio) is operated by KLAVTAR Sp. z o.o., ul. Siewna 15, lok. C002, 94-250 Łódź, Poland (KRS 0000977627, NIP 7272859792, REGON 522326772) ("ShopFlow", "we", "us").
This policy explains what personal data we process, why, and how we protect it. It applies to the ShopFlow web application and to the ShopFlow app for Etsy, Heartysan and Shopify stores.
1. Our role
- For merchants (sellers who create a ShopFlow account) and their team members, we are the controller of account data.
- For customers of merchants (buyers who place orders in a merchant's store), the merchant is the controller and ShopFlow acts as a processor on the merchant's behalf, under our Data Processing Addendum.
2. Data we process
Merchant account data: name, email address, password hash, team member names and roles, store connections, billing and usage records, support tickets.
Store and order data (on behalf of merchants):
- order details: order number, items, quantities, prices, taxes, discounts, payment and fulfillment status, shipping method, tracking numbers;
- customer contact data needed to fulfil the order: name, shipping address and phone number;
- buyer messages and personalization entered for the order.
We do not request customer email addresses from Shopify. We do not process payment card data.
3. Why we process it
We use store and order data only to provide ShopFlow's functionality to the merchant:
- showing and managing orders (order board, stages, assignees, tasks);
- preparing shipments, packing slips and labels, and sending tracking numbers back to the store;
- calculating order costs and profit for the merchant;
- notifying the merchant and their team about order events.
We do not sell personal data, do not use customer data for advertising or profiling, and do not make automated decisions with legal or similarly significant effects about customers. We do not send customer personal data to AI model providers.
4. Legal basis (GDPR)
- Merchant account data: performance of our contract with the merchant (Art. 6(1)(b)) and our legitimate interests in securing and improving the service (Art. 6(1)(f)).
- Customer data: processed on the merchant's documented instructions under Art. 28 GDPR; the merchant determines the legal basis for its own processing.
5. Retention
- Customer personal data (name, address, phone, messages) is deleted automatically 90 days after delivery or cancellation, or 120 days after shipment if delivery is not confirmed. Order records without personal data may be kept for the merchant's reporting.
- When a merchant uninstalls the Shopify app, store access tokens are deleted immediately. All data of that store is deleted when Shopify sends the
shop/redactrequest (48 hours after uninstall). - Customer data deletion requests received from Shopify (
customers/redact) are executed promptly and in any case within 30 days. - Merchant account data is kept while the account is active and deleted within 90 days after account closure, unless law requires longer retention (e.g. invoices).
6. Who we share data with (sub-processors)
| Sub-processor | Purpose | Location |
|---|---|---|
| Supabase Inc. | database hosting (encrypted at rest, encrypted backups) | EU (Stockholm) |
| Vercel Inc. | application hosting | EU / USA |
| Cloudflare Inc. | file storage for product images (no customer data) | global |
| Upstash Inc. | short-lived security tokens (no customer data) | EU / USA |
| SkladUSA | fulfillment warehouse, only when the merchant sends an order to it for shipping | USA |
| Shopify Inc., Etsy Inc. | the merchant's sales channels | global |
Transfers outside the EEA rely on the European Commission's Standard Contractual Clauses or an adequacy decision (EU-US Data Privacy Framework) where applicable.
7. Security
Data is encrypted in transit (HTTPS/TLS) and at rest; store access tokens are additionally encrypted with AES-256-GCM. Access to customer data is limited to the merchant's own account, every access to customer personal data is logged, and staff access follows least-privilege rules. See our Security Policy.
8. Your rights
Under the GDPR you may request access, rectification, erasure, restriction, portability, or object to processing. Customers of a merchant should contact the merchant first; we assist merchants in answering such requests. You may also lodge a complaint with the Polish supervisory authority (Prezes Urzędu Ochrony Danych Osobowych, uodo.gov.pl).
9. Contact
KLAVTAR Sp. z o.o., ul. Siewna 15, lok. C002, 94-250 Łódź, Poland
Email: klavtarlab@gmail.com · Phone: +48 516 090 280
We will update this policy when our processing changes and show the new effective date above.