Privacy Policy
How Qtoof Apps LLC handles data in the Shopify apps it publishes.
Who we are
Qtoof Apps LLC builds and operates the Shopify apps listed below. In data-protection terms we act as a processor on behalf of the merchant who installs an app; the merchant remains the controller of their store's data.
The apps this covers
| App | Permissions it requests |
|---|---|
| AI Size Chart | read_products |
| Qtoof Delivery Date & Zones | read_products, read_shipping |
This table is generated from each app's live configuration, so it cannot fall out of step with what the app actually requests. An app requests only the permissions it uses.
What we store
| Data | Why | Kept for |
|---|---|---|
Your .myshopify.com domain |
To tell one installation from another | Until you uninstall |
| A Shopify access token | To call the Shopify API on your behalf | Deleted the moment you uninstall |
| Your app settings | To provide the feature you configured | Kept through uninstall so a reinstall restores your setup |
What we do not store
- We do not store customer personal data. No names, addresses, emails or phone numbers.
- We do not store order or payment data. We never receive card details; Shopify handles payment.
- We do not use cookies for tracking, advertising, or authentication. Our apps authenticate with short-lived Shopify session tokens and set no cookies at all.
- We do not sell, rent or share your data with anyone for their own purposes.
How it is protected
- Every stored Shopify access token is encrypted at rest with AES-256-GCM. Tampering is detected rather than silently accepted.
- All traffic is over HTTPS.
- Each installation is isolated by (app, shop): one app cannot read another app's data, and one store cannot read another store's.
- Secrets are redacted from logs by name, so a credential cannot reach a log file through a debug line.
Uninstalling
When you uninstall, Shopify notifies us and we immediately delete the access token for your store. Your settings are retained so that reinstalling restores your configuration. To have everything erased instead, email support@qtoofapps.com and we will delete it within 30 days.
Your rights, and your customers'
We implement Shopify's mandatory privacy webhooks. If a customer asks your store for their data or asks to be erased, Shopify notifies us automatically and we act on it — and because we hold no customer personal data, there is normally nothing of theirs for us to return or delete. When a store closes, Shopify tells us and we erase that store's records entirely.
Depending on where you live you may have rights to access, correct, export or erase your data, and to object to processing. Email support@qtoofapps.com and we will respond within 30 days.
Sub-processors
Shopify Inc. — the platform the apps run on. Our servers are operated on our behalf by our hosting provider. We do not send your data to any analytics, advertising or AI service.
International transfers
Data is processed on servers that may be located outside your country. Where required, transfers rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.
Changes
If this policy changes materially we will update the date above and, where the change affects how we handle your data, notify installed merchants by email.
Contact
support@qtoofapps.com
Qtoof Apps LLC