Privacy Policy

Last updated: September 28, 2026

1. Who we are

Setify is a Shopify app provided by Digital Connect, located at Dravietdijk 10, 4706 LD Roosendaal, the Netherlands, registered with the Dutch Chamber of Commerce (KvK) under number 50891111. You can reach us at support@setify.io or via the live chat in the Setify admin. Website: setify.io.

2. Who this policy is for

  • Stores and merchants that install and use Setify in their Shopify storefront.
  • Visitors and customers of those stores, to the extent Setify processes technical data or requests on their behalf.

The respective store acts as the Data Controller for all personal data belonging to its customers. Setify processes such data exclusively on behalf of and under the instructions of the store, in accordance with our Data Processing Agreement (setify.io/dpa.html). If you are a customer with questions regarding your personal data, please contact the merchant you purchased from directly.

3. What data we process and why

3.1 Store data

To deliver and configure Setify, we store:

  • the store domain and the secure access tokens (OAuth tokens) granted to us by Shopify;
  • the active subscription plan, time zone, and language settings of the store;
  • the configurators and sales blocks built in Setify, including product connections, discount logic, and layout settings;
  • images and custom icons uploaded by the store in the Setify admin.

Product information (such as titles, variants, prices, and images) is retrieved via official Shopify APIs to render configurators in real time. We temporarily cache product prices and inventory for a maximum of 7 days to maintain fast storefront performance. We use this data to provide the app service, process subscription billing through Shopify, and communicate essential system updates to merchants.

3.2 Analytics and statistics

We collect aggregated metrics on how frequently configurators are viewed, interacted with, or completed. These are strictly anonymous counts aggregated by day and hour: we do not record IP addresses or personally identifiable information in these analytics. These aggregated counts are retained for 365 days.

3.3 Storefront visitors

When a visitor navigates to a store page featuring a Setify configurator, their browser loads scripts from our hosting provider Vercel and static icons from cdnjs (Cloudflare). During this request, these CDN providers automatically process standard network parameters (such as IP address and browser user-agent) in technical server logs for caching and DDoS security. These logs are retained briefly per their standard privacy policies and are neither stored nor analyzed by Setify.

3.4 Save set for later

Merchants may enable an optional feature allowing storefront visitors to save a custom product configuration. The visitor enters their email address and, optionally, their first name. Setify passes this information directly and securely to the merchant's Shopify store via API to generate a draft order with a checkout link. Setify does not retain this email address or name in its database and does not use it for any other purpose.

4. What we do not do

  • We never sell, rent, or trade merchant or customer data to third parties.
  • We do not use store or customer data for advertising, marketing, or behavioral profiling, nor do we share it with ad networks.
  • We do not access or read merchant customer databases, mailing lists, or payment details.
  • We do not engage in automated individual decision-making or profiling.

5. Who we share data with (Sub-processors)

Setify operates with vetted infrastructure providers. Where data processing occurs outside the European Economic Area, it is conducted under the EU-U.S. Data Privacy Framework or Standard Contractual Clauses (SCCs):

  • Shopify: the e-commerce platform the store runs on, for secure authentication (OAuth) and native app billing.
  • Vercel Inc.: hosting provider for the Setify application backend and uploaded image assets (United States / Global Edge). Transfer basis: EU-U.S. Data Privacy Framework.
  • Upstash, Inc.: serverless database for store configuration and aggregated counts (European Union / AWS EU region). Transfer basis: EU-U.S. Data Privacy Framework.
  • Cloudflare, Inc. (cdnjs): content delivery network for static frontend icons and scripts (Global CDN). Transfer basis: EU-U.S. Data Privacy Framework.

6. Data retention

  • A store's API access tokens (OAuth tokens) are immediately and automatically deleted upon app uninstallation.
  • Other configurator settings and layouts are retained for 30 days after uninstallation to allow easy re-activation. After 30 days, all store data is permanently purged.
  • Aggregated, anonymous usage analytics are retained for 365 days.
  • Cached product prices and inventory are retained for a maximum of 7 days.
  • Email addresses and names submitted through "Save set for later" are not retained by Setify.

To request immediate deletion of all store records upon uninstallation, please email support@setify.io.

7. Security and technical measures

  • All communications between the storefront, Setify, Shopify, and the database are encrypted in transit using HTTPS (TLS 1.3).
  • API tokens and access credentials are never committed to source code; they are stored exclusively in secure hosting environment variables.
  • Shopify webhooks and notifications are cryptographically verified using HMAC-SHA256 signatures before processing.
  • Access to infrastructure is restricted to authorized Digital Connect engineers; all administrative accounts (Vercel, Upstash, GitHub, and Shopify Partner Dashboard) require mandatory two-factor authentication (2FA) and strong credentials.
  • The database (Upstash) and automated backups are encrypted at rest (AES-256) and hosted in data centers within the European Union (AWS EU).
  • Test and production environments are strictly separated: software development and testing take place in an isolated environment with a dedicated test database and development store, ensuring production data is never exposed.

8. Your rights (GDPR)

Under the General Data Protection Regulation (GDPR), you have the right to access, rectify, erase, and port your personal data, as well as the right to restrict or object to processing:

  • Shopify merchants can submit data requests directly to support@setify.io. We respond within 30 days.
  • Consumers and storefront customers should direct their inquiries to the merchant where they shopped. We provide merchants with all necessary assistance to fulfill these requests.

If you believe your personal data is not processed in accordance with privacy laws, you have the right to lodge a complaint with your local data protection supervisory authority (such as the Dutch Autoriteit Persoonsgegevens).

9. Cookies and local storage on setify.io

The website setify.io uses only strictly necessary functional local browser storage to retain language and display preferences. We do not use tracking cookies, advertising cookies, or third-party analytics trackers.

10. Changes to this policy

We may update this Privacy Policy from time to time. Updates will be published on this page with an updated revision date. Significant changes will be communicated in advance via the Setify admin or by email.

11. Contact

For questions or requests concerning privacy and data protection, contact us at support@setify.io or via live chat in the Setify admin.