AppVerix Size Charts: Privacy Policy
Last updated: October 15, 2026
AppVerix Size Charts ("the app") is a Shopify app published by AppVerix ("we", "us"). This policy explains what the app collects when a merchant installs it, why, where it is kept, and how to have it deleted.
The app does not store personal data of a store’s customers. Size charts are merchant content. For any customer data that stays in Shopify, the merchant is the controller.
1. What we collect and why
From the merchant’s store (through Shopify’s API):
| Data | Why | Do we store it? |
|---|---|---|
| Shop domain, shop name, contact email, country and currency | To identify the store, open the app in Shopify Admin, and pick a default language | Shop domain, yes. Other shop profile fields are read when needed and not kept as a customer record |
| An access token from Shopify | So the app can stay installed and read products or collections you pick in the assignment picker | Yes, in the login session, until you uninstall |
| Product, collection, tag and vendor identifiers you assign to a chart | To decide which chart to show on a product page | Yes, as part of the chart assignment |
| Customer names, emails, addresses, orders or payment details | The app does not need this to show a size chart | No |
What the app saves in its database:
- Your size charts: title, notes, optional image URL, saved unit, link label, table rows and columns, and starter-template key if you used one.
- Assignments: which products, collections, tags or vendors each chart is for (id and a label you or Shopify provided).
- Shop settings: the admin language you chose.
- Login session: shop domain, granted scopes, access token, and refresh token when Shopify issues one.
- Compliance log: the topic and payload Shopify sent on a privacy webhook, so we can show that we handled the request. These are not used for marketing.
We do not collect payment card data, phone numbers, browsing data, analytics, or cookies for tracking. The app sets no advertising or analytics cookies. We do not sell or share personal data, and we do not use it for profiling or automated decisions.
2. Who processes data for us
| Provider | What for | Data they see | Location |
|---|---|---|---|
| Cloudflare (cloudflare.com) | Hosting for the app and its D1 database | Everything listed in section 1 | Globally distributed |
| Shopify | The platform the app runs on; also handles billing for the app | Already holds shop and catalog data | See Shopify’s privacy policy |
Each provider has its own privacy terms. Where data leaves the EEA/UK, we rely on the provider’s Standard Contractual Clauses or other approved transfer mechanisms.
3. How long we keep it
- Charts, assignments and shop settings: while the app is installed.
- When you uninstall: we delete the login session right away. Shopify sends us a shop/redact request 48 hours later, and we then delete all of that store’s charts, assignments, settings and compliance logs.
- When a customer asks to be deleted (Shopify customers/redact): we do not hold customer personal data to delete. We log that the request arrived.
- Server logs: kept for up to 7 days.
4. Your rights and data requests
The app supports Shopify’s three privacy webhooks:
customers/data_request: we reply that we do not store that customer’s personal data.customers/redact: we have no customer record to delete; we log the request.shop/redact: we delete all data for the store.
Merchants can also email support@appverix.com to ask for a copy of their data or to have it deleted. We answer within 30 days. Customers of a store should contact the store first.
If you are in the EEA/UK you may also complain to your local data protection authority. In Brazil, the LGPD applies; contact us at support@appverix.com.
5. Security
- All traffic to the app uses HTTPS (TLS).
- The database is hosted on Cloudflare D1, which encrypts data at rest.
- Webhooks from Shopify are verified with their HMAC signature; unsigned requests are rejected.
- The app checks a Shopify session token on every admin request; it does not use third-party cookies.
- Access to production infrastructure is restricted and protected by two-factor authentication.
- If we learn of a breach that affects your data, we will tell you without undue delay and within 72 hours where the law requires it.
6. Changes
If we change this policy in a way that matters, we will update the date at the top and tell merchants inside the app or by email.
Data Processing Addendum
By installing the app you also agree to the AppVerix Data Processing Addendum. It explains how we process personal data for you as your processor, our subprocessors, security measures, deletion and breach notification. Our security and incident response policy is public.
Data Processing Addendum · Security and incident response
7. Contact
AppVerix. Email: support@appverix.com