Privacy Policy

1. Introduction

CSV Fixer ("we", "our", "us") is operated by 920four. This policy explains what data CSV Fixer collects, why, how long we keep it, and the rights you have over it. We wrote it to match how the app actually behaves in code — not a generic template — so that you can verify every statement here against the shipping product.

2. What we collect

• Shop identity & access token. When you install CSV Fixer through the Shopify App Store, Shopify provides us with your shop's .myshopify.com domain and an OAuth access token scoped to read_products, write_products. We use this token solely to analyze, create, or update products in your store when you trigger an import.
• Uploaded CSV content. The rows and headers of the CSV files you upload, plus any images or text fields they reference. We do not inspect, index, or re-purpose this content beyond running our fix and import logic on it.
• Processing metadata. Job identifiers, timestamps, row counts, the derived health score, and the list of fixes applied. We use this to display your job history inside the app.
• Billing signals. Whether you've purchased the Lifetime plan, mirrored from Shopify's Billing API via billing.check(). We never receive or store your payment method.

We do not collect customer personal data, order data, or storefront traffic. CSV Fixer has no read access to orders, customers, or analytics.

3. How we use it

• To analyze your CSV and report issues that would block an import.
• To apply deterministic CSV fixes, show a before/after review, and create or update products in your store when you click Import.
• To display your file history and job status inside the app.
• To respond to support requests that you initiate.
• To meet Shopify's mandatory compliance webhooks described in § 6.

We do not use your CSV content to train machine-learning models, to populate a marketplace, or to enrich a data product for resale.

4. Where it's stored

• Job metadata (shop domain, job ids, timestamps, row counts, health score, fix list) — managed PostgreSQL on DigitalOcean App Platform in the United States.
• Raw and cleaned CSV files — local file-system storage on the application server during processing. Files are written to disk so jobs can be paused, retried, and re-downloaded within the same session.
• OAuth session tokens — the same PostgreSQL instance, encrypted at rest.

All data in transit between your browser, the Shopify Admin, and CSV Fixer is encrypted with TLS 1.2 or higher.

5. Retention & deletion

• Uploaded CSV files are retained only as long as you need them for review and import. You can delete any file manually from the in-app file list at any time.
• Automatic deletion triggers:
  • When you click Delete file inside CSV Fixer — the CSV on disk, import runs, import results, and the corresponding job record are removed immediately.
  • When Shopify sends a SHOP_REDACT webhook — CSV Fixer deletes every CSV file, CsvJob row, import run, Shop row, and Session row belonging to your shop. Shopify dispatches this webhook 48 hours after you uninstall the app.
• Job metadata is kept for as long as your installation is active, so that you can audit past imports. Metadata is removed at the same time as CSVs under the triggers above.

6. Shopify GDPR webhooks

CSV Fixer implements all three mandatory Shopify compliance webhooks:

• customers/data_request — acknowledged. Because CSV Fixer does not store data about your store's customers, we have no customer-scoped data to return.
• customers/redact — acknowledged for the same reason.
• shop/redact — triggers full deletion of every record we hold for your shop (see § 5).

7. Sharing & sub-processors

We do not sell, rent, or share your data. The only third parties that ever touch your data are sub-processors required to run the service:

• Shopify, Inc. — provides the Admin API, Billing API, and webhook infrastructure we depend on. Governed by Shopify's own Data Processing Addendum.
• DigitalOcean, LLC. — hosts our application servers and managed PostgreSQL database. Governed by DigitalOcean's DPA.

We do not load advertising SDKs, analytics SDKs, or session-replay tools on any page that handles your CSV content.

8. Your rights

If you are located in the EEA, the United Kingdom, or a jurisdiction with equivalent protections, you have the right to:

• Access the data we hold about your shop.
• Request correction of inaccurate data.
• Request deletion of your data (also available via uninstall + the shop/redact webhook).
• Object to or restrict our processing.
• Receive an export of your data in a structured format.

Email [email protected] to exercise any of these rights. We aim to respond within 30 days.

9. Security

CSV Fixer runs on managed infrastructure with TLS termination, role-based database access, and automatic security patching. Only the application server can read the PostgreSQL instance, and access tokens are stored encrypted at rest. You can report a suspected vulnerability to [email protected].

10. Cookies

CSV Fixer uses only the session cookies that Shopify's embedded app framework requires for authentication. We do not use tracking, advertising, or third-party analytics cookies inside the app. The marketing site at csv-fixer.com uses a single first-party cookie strictly to remember your last-visited page.

11. Children

CSV Fixer is a B2B product designed for Shopify merchants. It is not directed at children under 13 and we do not knowingly collect data from them.

12. Changes to this policy

We will update the "Last updated" date at the top of this page whenever this policy changes. Material changes (e.g. new sub-processors, new data types collected) will be surfaced inside the app the next time you open it.

13. Contact

Questions about this policy or your data?

920four
Privacy: [email protected]
Support: [email protected]