Privacy policy
ProductDocs is a Shopify app operated by Liam Jones, trading as ProductDocs, in the United Kingdom ("we"). It lets merchants attach manuals, guides and safety documents to their products and share them through permanent links, QR codes, product pages, customer accounts and emails. This policy explains what personal data we process, why, for how long, and your rights. It is written for merchants who install the app and for the shoppers who scan a code or open a link.
Our role
For data about a merchant's customers and orders, the merchant is the controller and we act as their processor under the data processing addendum. For data about merchants themselves, such as the store domain and the email address you write to us from, we are the controller.
What we process and why
| Data | Why | Kept |
|---|---|---|
| Store domain, Shopify store ID, plan and install dates | Running your account and billing through Shopify | Life of the install, then the retention below |
| An offline Shopify access token for your store | Writing document information to your products on your behalf | Deleted the moment the app is uninstalled |
| Documents you upload, their titles, versions and the products they are attached to | The service itself | Retention below |
| Order line items and products, read from an order when staff open it in Shopify admin | Showing staff which documents apply to that order | Read on demand, never stored |
| Scan events: country, device family and a hash of the visitor's IP address that is salted with a value that changes every day, so it cannot be reversed or joined across days | Showing merchants how often their codes are scanned and from where | Hashes are removed at shop redact; counts follow the retention below |
| Your name and email when you contact support | Answering you | Two years after the last message |
We never process customer names, postal addresses, phone numbers, email addresses or payment details. Public pages served from our link domain set no cookies and load no analytics or advertising scripts. Inside Shopify admin the app uses Shopify's session token, not cookies of its own.
We do not sell personal data, share it for advertising, or use it for automated decisions with legal or similarly significant effects.
Legal bases
Performance of our contract with the merchant for everything needed to provide the app; our legitimate interest in keeping the service secure and in understanding how it is used, limited to the pseudonymous scan data above; and legal obligation where a law requires us to keep records.
Retention
- While the app is installed, we keep what you have uploaded and configured.
- When you uninstall, your access token is deleted immediately. If your store has never paid for a plan, all content and links are deleted within 48 hours, when Shopify sends its redaction request.
- If your store has paid for a plan at any time, documents and links stay available read-only for 13 months after uninstall, so QR codes you have printed keep working, and are then deleted automatically. Reinstalling within that window restores everything.
- You can ask us to delete everything sooner at any time.
Where data lives and who helps us
Data is stored in the European Union (Frankfurt, Germany). Our subprocessors are:
| Provider | Purpose | Location |
|---|---|---|
| Supabase, Inc. | Database and file storage | Frankfurt, EU |
| Vercel, Inc. | Application hosting and delivery | Functions in Frankfurt, EU; operational logs may be processed in the United States under the EU-US Data Privacy Framework and standard contractual clauses |
| Shopify International Ltd. | The platform the app runs on, including billing | Per Shopify's own terms |
We will give merchants at least 30 days' notice by email before adding a subprocessor.
Security
All traffic uses TLS. The database and file storage are encrypted at rest. Shopify access tokens live only in the encrypted database and are used server-side only; they never reach a browser. Uploaded files are private and served through short-lived signed links. Every database query is scoped to the store that owns the data, enforced by row-level security as well as application code. If we become aware of a personal data breach affecting your data we will tell you without undue delay and within 72 hours.
Your rights
Under UK and EU data protection law you can ask for access to, correction of, deletion of, or a copy of personal data we hold about you, object to or restrict processing, and complain to a supervisory authority: in the UK the Information Commissioner's Office, in the EU the authority in your country. Shoppers should contact the merchant they bought from first, since the merchant is the controller; we will help the merchant respond. Email hello@productdocs.app and we will reply within 30 days.
Changes
We will post changes here and, for material changes, email merchants at the address on their Shopify account. The date at the top shows the current version.