Privacy Policy
1. Who this policy covers
This policy applies to:
- Operators — people at Shopify app vendors and agencies who create a DeploTeka workspace, connect a Shopify organization, and use the cabinet or the
npx deplotekacommand line; - Merchant contacts — the people at our customers' client stores whose shop domain we record, and the person who approves an app install on a store's behalf (we learn only what Shopify tells us about that install);
- Prospects — visitors to deploteka.com who use the contact form or book a call; and
- Site visitors — anyone whose visit generates standard server logs.
Our customers' apps send their business data to their own systems. DeploTeka does not retain shopper-event analytics. Limited app verification may transiently fetch configured storefront pages and assets, and Shopify privacy requests are forwarded as described below and in the DPA. For shopper data, the store and app vendor remain the responsible contacts. If you are a shopper and a store you visited uses an app set up through DeploTeka, the store (merchant) and the app vendor are responsible for your data; please contact the store. If you write to us, we will tell you that and, where we can, point you to the right party.
2. What we collect
We collect only what the service needs. There is no third-party analytics, advertising, or tracking on our site or cabinet.
| Category | Data | Source | Applies to |
|---|---|---|---|
| Workspace and account data | Your email address, the workspace name, your role in it, and the timestamps of registration and sign-ins. Sign-in is by a link emailed to you; there is no password. | You, at sign-up and sign-in | Operators |
| Shopify sign-in session | Your Shopify Partner and Dev dashboard session, handed over by the connector after you log in on Shopify's own pages, and sealed in our encrypted vault (see §4). Not your password, captcha or one-time codes — those never reach us. | You, when you connect | Operators |
| Operational keys | Release keys (a Shopify app automation token created for one release through your connected session and revoked when it ends) and per-store access keys (each dedicated app's client id and client secret, created by the setup), sealed in the vault and used only for releases, install verification and health checks. | You, and the setup runs you start | Operators |
| App, store and setup records | Your apps' names and client ids, the shop domain and status of each client store, each dedicated app's sealed install link, and the history of every setup run and release: steps, outcomes, errors, timestamps. | Generated by your use of the service and by our automation acting on your instructions | Operators, merchant contacts |
| Audit log | Who did what, to which app or store, when, and with what outcome — for every connect, disconnect, setup, release, credential delivery and deletion. It records references and outcomes, never secret values. | Generated by the service | Operators |
| Billing data | Your Stripe customer and subscription identifiers, plan, and subscription status. Card details are entered on Stripe's pages and held by Stripe; we never see the full card number. | You, at checkout; Stripe | Operators |
| GitHub connection (only if you connect one) | The GitHub App installation reference and the repositories you chose to share. We read those repositories and run workflows only on your instruction, with short-lived tokens GitHub issues to us; we hold no long-lived GitHub secret of yours. | You, via GitHub's own consent screen | Operators |
| Merchant access token (token-delivery mode only) | An offline Shopify Admin API access token for a merchant store that installed one of your dedicated apps, plus the store domain, the permissions the merchant granted, and the install, delivery and uninstall timestamps. Sealed on receipt and delivered to your backend. We also use it for limited, authorized credential and app-installation checks: the basic credential check requests Shopify's shop endpoint and retains its status, without parsing or storing the response body. Required extension verification may inspect this app's installation or extension state. When the merchant uninstalls, a newer token replaces it, or you delete the store, it is retired from active use and destruction is queued durably; storage failures are retried until the sealed copy is removed. The token is never returned to the cabinet or written to a log. | Shopify, at the moment a merchant approves the install | Operators using token delivery; merchant contacts |
| Merchant privacy requests (token-delivery mode only) | The privacy webhooks Shopify sends about a store that installed one of your apps (customer data request, customer redaction, shop redaction). We forward each one to your backend and record that we did; we hold no customer data to act on ourselves. | Shopify | Operators using token delivery |
| Contact form | Work email address, plus three multiple-choice answers: fleet size, current setup, plan interest. That is the entire form. | You, when you submit it | Prospects |
| Booking a call | The name, email address and time slot you enter on our self-hosted booking page (book.fixelpixel.app). | You, when you book | Prospects |
| Email we send you | Sign-in links, service notices and replies to your messages, sent through our own mail server (mail.fixelpixel.app); we keep the record of what was sent. | Generated by the service | Operators, prospects |
| Server logs | IP address, user agent, request path, status and timestamps. Request bodies are not logged, and no secret, cookie, token or install link ever is. | Automatic | Everyone |
| Cookies | Two first-party cookies: __Host-session (cabinet sign-in) and dt_theme (your light/dark preference). No third-party cookies. | Automatic (cabinet) | Operators |
What we never collect: your Shopify password. Optional storefront verification fetches the pages and assets needed to check a required app extension; it does not collect shopper browsing or purchase events for analytics. When you connect, your password is typed only into Shopify's own login page in a browser on your own machine; it never passes through, and is never stored by, DeploTeka.
App, store and setup records are mostly business data (client ids, shop domains), but we treat them as in-scope here because they can be linked to your account and to people at the stores you serve.
3. Why we use it, and the legal basis
| Purpose | Data used | Legal basis |
|---|---|---|
| Providing the service: operating your workspace, executing the setup runs and releases you start, verifying installs, showing fleet state | Workspace and account data, Shopify sign-in session, operational keys, app/store/setup records, GitHub connection | Contract — Art. 6(1)(b) |
| Keeping a record of who did what, for your accountability and ours, and for incident investigation | Audit log | Contract — Art. 6(1)(b); legitimate interest in security and accountability — Art. 6(1)(f) |
| Billing: subscriptions, invoices, tax records | Billing data, account email | Contract — Art. 6(1)(b); legal obligation for accounting and tax records — Art. 6(1)(c) |
| Token delivery: receiving a merchant's access token when they install one of your dedicated apps and passing it to your backend; forwarding Shopify's privacy requests about that store to you | Merchant access token, merchant privacy requests | Contract with you — Art. 6(1)(b); we act as your processor for it under the Data Processing Agreement (/legal/dpa) |
| Responding to your enquiry or booking and communicating with you about it | Contact form, booking | Steps at your request prior to a contract — Art. 6(1)(b); where you act for a company, our legitimate interest in responding to your enquiry — Art. 6(1)(f) |
| Service communications to account holders (sign-in links, changes to the service or these terms, security and billing notices) | Account email | Contract — Art. 6(1)(b); legal obligation for some notices — Art. 6(1)(c) |
| Securing the service: abuse prevention, rate limiting, incident investigation | Server logs (incl. IP), audit log | Legitimate interest in keeping the service and its tenants secure — Art. 6(1)(f) |
| Remembering your theme preference and keeping you signed in | Cookies | Strictly necessary for the service you asked for — Art. 6(1)(b) / 6(1)(f) |
| Establishing, exercising, or defending legal claims; complying with law | Any of the above, as needed | Legal obligation — Art. 6(1)(c); legitimate interest — Art. 6(1)(f) |
We do not sell personal data, do not share it for advertising, and do not send marketing you didn't ask for. If you used the contact form or booked a call, we will contact you about your request; you can tell us to stop at any time and we will.
We do not use personal data for automated decision-making that produces legal or similarly significant effects, and we do not profile you.
4. The Shopify dashboard session, specifically
Because it is the most sensitive thing we hold, it gets its own section:
- What it is. A session for your Shopify Partner and Dev dashboards — the same kind of session your own browser holds after you log in. It is not your password and we cannot derive your password from it.
- What we use it for. Only the onboarding steps that have no machine-to-machine route at Shopify: creating a dedicated app in your organization, setting it to custom distribution, producing its install link, and requesting access to a client store. Day-to-day releases and checks run on the operational keys instead. Automated setup for an app also needs your explicit, recorded grant in the cabinet for that app; we do not use the session for anything you did not direct through the product.
- How it's kept. Sealed in an encrypted vault (AES-256-GCM envelope encryption with per-tenant data keys) and used server-side; it is never written to logs or rendered into pages. See the Security page (/legal/security).
- How long it lives. Shopify controls expiry and revocation; there is no guaranteed session lifetime. We re-verify before use. If the saved session is no longer accepted and cannot be renewed, the cabinet asks you to reconnect, which replaces it.
- Your control. Disconnect at any time from the cabinet (owners and admins) or by writing to us: disconnecting stops all further automated use and retires the credential from active use and records durable destruction work; storage failures are retried. You can also end the session at Shopify yourself at any time by logging out of all sessions in your Shopify account.
5. Who we share data with
We share personal data only with the following. The first three are the sub-processors that run the service for us, under contracts that restrict them to processing on our instructions:
| Sub-processor | Purpose | What it processes | Location |
|---|---|---|---|
| Scaleway SAS | Hosting of the application, its database and backups; also hosts our own mail server (mail.fixelpixel.app) and our self-hosted booking page (book.fixelpixel.app) | Everything in §2, at rest and in transit on our server | Amsterdam, the Netherlands (EU) |
| Stripe | Subscription payments and invoicing | Billing data: your email, company details, card and payment information (entered on Stripe's own pages), invoices | Stripe's European and UK entities; Stripe transfers data to Stripe, Inc. in the United States under its own safeguards (standard contractual clauses) |
| Cloudflare, Inc. | DNS for deploteka.com only | Name resolution only — no traffic to or from our service passes through Cloudflare, so no personal data of yours is sent to it by us | United States (DNS network worldwide) |
There is no other processor: contact-form submissions are stored in our own database and emailed to us through our own mail server, and we run no analytics or support tooling from third parties.
- Shopify — inherently: the service acts inside your own Shopify accounts at your direction, so the actions you instruct are visible to Shopify like any dashboard activity, and Shopify is the source of the install, uninstall and privacy webhooks we receive. Shopify processes that data under its own terms with you; DeploTeka is not affiliated with Shopify.
- GitHub — only if you connect a repository: GitHub processes your installation under its own terms with you, and you can revoke our access from your GitHub settings at any time.
- Your backend — under token delivery, the merchant token and the privacy requests about a store go to the endpoint you configured; from then on they are yours.
- Authorities or parties in legal proceedings, where required by law or necessary to establish, exercise, or defend legal claims — and only then.
- A successor entity in a merger, acquisition, or asset sale, in which case this policy continues to apply and we will notify account holders.
No data is shared with advertisers or data brokers. If we add or replace a sub-processor we will update this table and, for customers under the DPA, give the notice the DPA requires.
6. Retention
| Data | Kept for |
|---|---|
| Workspace and account data; app, store and setup records; audit log | While the workspace exists. A store you delete is removed with its records at that moment, and its sealed secrets are retired with durable, retryable destruction work (the audit entry recording the deletion is kept). The workspace is closed on your written request (see §9) or when we terminate the Agreement, and its data is then deleted within 30 days of closure |
| Sealed dashboard session | Until you disconnect, reconnect or the workspace closes; old credentials are retired and their sealed copies are queued for destruction with retry after storage failure |
| Operational keys (release keys, per-store access keys) and sealed install links | Per-store keys and install links: until you delete the store or the workspace closes. Release keys: revoked when the release ends, never kept. All can be invalidated at Shopify by you at any time |
| Merchant access token (token-delivery mode) | Until the merchant uninstalls, a newer token supersedes it, or you delete the store — retired from active use, with durable destruction work retried until physical removal succeeds. A token our automation could not hand to your backend is kept until you retry the delivery or the merchant uninstalls, so that a bad minute on your side is recoverable rather than a re-install for every merchant |
| Merchant privacy requests (token-delivery mode) | The forwarding record (which request, when, forwarded or not) is kept in the audit log for the life of the workspace; the request content is not stored by us beyond forwarding it |
| Billing data | For as long as tax and accounting law requires us to keep records of the transaction (in the UK, currently six years after the relevant accounting period) |
| Contact-form submissions and bookings | 24 months from submission, or until you ask us to delete, whichever is first |
| Email we sent you | Life of the account or enquiry it relates to, under the rows above |
| Server logs | Only as long as security monitoring and troubleshooting need them; rotated on a rolling basis and used for nothing else |
| Records needed for legal claims/compliance | As long as the law requires or the claim period runs |
Backups. The database is scheduled for backup every six hours, with the newest 28 copies retained. Deleting a credential stops its active use and records durable destruction work. Retired sealed copies may remain until physical cleanup succeeds and the backups containing them expire; a delayed backup schedule or storage failure can extend that period. A recovery must preserve deletion decisions and finish pending destruction before returning restored data to use. We do not restore a backup to recover data you asked us to delete.
7. Security
Full detail is on the Security page (/legal/security). In short: all traffic is over TLS; every credential we hold is sealed with AES-256-GCM envelope encryption under a per-tenant data key and never appears in logs or pages; every cabinet read is tenant-scoped at the query layer; webhooks from Shopify are signature-verified; public endpoints are rate-limited and validated; the site and cabinet run no third-party scripts. That is how it is built; it is not a compliance certification. No system is perfectly secure; if a breach affects your personal data we will notify you and any competent authority as the law requires.
8. International transfers
Our infrastructure is hosted in the European Union (Amsterdam). Fixel Pixel LLP is established in the United Kingdom, which the European Commission has recognised as providing adequate protection, so data moving between our EU server and us in the UK needs no further safeguard. Stripe may process billing data in the United States under its own standard contractual clauses. Where we ourselves transfer personal data to a country without an adequacy finding, we rely on the EU Standard Contractual Clauses (Commission Decision 2021/914), plus the UK Addendum/IDTA where UK data is in scope. Details of the mechanism applicable to a given sub-processor are available on request at privacy@deploteka.com.
9. Your rights
Depending on your location, you have the right to:
- access the personal data we hold about you, and get a copy;
- rectify inaccurate data;
- erase data ("right to be forgotten");
- restrict or object to processing, including any processing based on legitimate interest;
- data portability — receive data you provided in a structured, commonly used, machine-readable format;
- withdraw consent at any time, where processing is based on consent (today, essentially nothing is);
- complain to a supervisory authority — in the EU, the supervisory authority of your habitual residence or place of work; in the UK, the ICO. We'd appreciate the chance to resolve your concern first, but you are not required to give us one.
How to exercise them. Email privacy@deploteka.com from the address your account or submission is under (or provide equivalent verification — we will ask only for what we need to confirm it's you). We reply within one month, extendable by two further months for complex requests, in which case we'll tell you within the first month. Exercising these rights is free unless requests are manifestly unfounded or excessive.
Workspace export and closure are not self-serve. The cabinet lets you disconnect the Shopify session and delete individual stores (which removes their records, retires their credentials and records durable destruction work). Exporting your whole workspace or closing it is done by us, on your written request to privacy@deploteka.com, within 30 days: we send you your workspace records (apps, stores, setup-run history, audit log) in a machine-readable format, close the workspace and destroy its sealed secrets, or both. Backup retention and pending credential destruction are described in §6.
If your request concerns a merchant store or its customers, we are the app vendor's processor, not the controller: we do not retain shopper-event analytics; limited app verification and privacy-request forwarding are described above. We will refer you to the store and the vendor and assist them as the DPA requires.
10. Children
The service is for businesses. It is not directed at children, and we do not knowingly collect data from anyone under 16. If you believe a child has provided us data, contact us and we will delete it.
11. Changes to this policy
We will post changes here and update the "Last updated" date. For material changes we will notify account holders by email at least 14 days before they take effect. Previous versions are available on request.
12. Contact
Fixel Pixel LLP, a limited liability partnership registered in England & Wales (No. OC439847), 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom
privacy@deploteka.com (privacy requests) · help@deploteka.com (everything else)
DeploTeka is not affiliated with or endorsed by Shopify. "Shopify" is a trademark of Shopify Inc.