Privacy policy

This policy explains how Firesio (“we”) handles personal data in connection with CodeVault: Keys & Codes, an application for Shopify stores. It covers the merchants who install the app and the buyers who receive digital codes through it. For buyers’ data, the merchant decides why it is used and we process it on the merchant’s behalf to run the service. For merchants’ own data, and for support requests, we decide how it is used.

What personal data do we collect?

From the merchant, through Shopify: the shop’s address and Shopify identifier, the shop name, the shop’s contact email and the owner’s email, the time zone, the app plan and its billing status, and the access credentials Shopify issues to the app. When a staff member of the shop opens the app, the session also carries that person’s name and email address.

From the merchant, in the app: the codes the merchant uploads, the pools and code types the merchant defines, delivery settings such as the sender name and the reply-to address, and a log of the actions taken in the app.

About buyers, from the order Shopify reports to us once it is paid: the buyer’s email address, the order number and identifier, the products, variants and quantities ordered, the order total and currency, the sales channel, the order’s language, whether it is a test order, and the risk level Shopify assigns to it. We do not collect buyers’ names, postal addresses, phone numbers or payment card details.

When codes are delivered: a delivery log with the time, the outcome and the email provider’s message identifier, how many times each delivery link was opened, and a keyed hash of the network address of the first person who opened the link (the address itself is not stored). When a buyer asks for their codes again from the order lookup page, we use the order number and email address they enter to find the order, and short-lived rate limits are applied by network address.

From merchants who contact support: name and email address, the subject and text of messages, and any file attached. Our staff can ask an AI model to draft a reply, and for that the text of the conversation is sent to the model.

About our own staff: name, email address, sign-in credentials (stored hashed or encrypted) and a log of staff actions in our internal console.

The public pages of this site set one functional cookie, which remembers the language you choose. We run no advertising or analytics trackers on them, and we do not sell personal data.

Why do we collect it, and what do we do with it?

We use merchants’ data to provide the app: to recognise the shop, allocate unused codes to paid orders, deliver them, show the merchant their stock and orders, keep the delivery log, send the merchant notices (low stock, orders held for review, plan usage), apply the plan the merchant chose, and answer support requests.

We use buyers’ data only for the merchant’s purposes in the service: to find the order, send the buyer their codes, send them again when the buyer asks, and show the merchant what was delivered.

We also use limited data to keep the service secure and prevent abuse (rate limits, audit logs) and to meet legal obligations, including Shopify’s privacy requirements.

Where the law asks for a legal basis: we process merchants’ data to perform our agreement with the merchant and for our legitimate interests in securing and supporting the service. For buyers’ data the merchant is the controller and we act as its processor.

We do not use personal data to train AI models, to build profiles or for advertising. The only automated decision is one the merchant configures: whether an order is delivered at once or held for the merchant’s review, for example because Shopify rated it risky. The merchant releases or cancels held orders.

Who do we share it with?

We share personal data only with the providers we need to run the app, and with the merchant it concerns.

Shopify sends us shop and order data, receives our requests (for example to read an order or update stock) and bills the merchant for the app.

Cloudflare is our hosting provider. It runs the app and stores its data: Workers (processing), D1 (database), KV (sessions), Queues (background jobs), R2 (files attached to support requests), Email Sending (the emails we send to buyers and merchants) and Workers AI (drafting support replies).

We have no other sub-processors, and we do not share personal data with advertisers or data brokers. We may disclose data if the law requires it, and we will tell the merchant first where we are allowed to.

Where is it stored, and for how long?

Where: the app runs on Cloudflare’s global network. We have not pinned the database to a region; Cloudflare places and serves it under its own default rules, so data may be stored and processed in any country where Cloudflare operates, which may be outside your country. We rely on our providers’ data processing terms for these transfers.

Shop, plan, settings, pools, codes, purchases, delivery records and support conversations are kept while the app is installed and are erased when Shopify sends the shop erasure request, which it does 48 hours after the app is uninstalled. The Shopify access credentials are deleted when the app is uninstalled.

Buyer email addresses: the sealed email address and its lookup hash are erased 90 days after a purchase is delivered, cancelled or revoked. The purchase record itself, without the address, stays until the shop’s data is erased. Delivery links expire after 30 days or 10 openings, whichever comes first.

Operational records: records of the webhooks received from Shopify (identifiers, not their content) are deleted after 90 days, or 180 days for failed ones; logs of notification emails, including the recipient address, after 90 days; audit logs of staff and API access after 365 days; and AI usage records (token counts, no message text) after 400 days.

After erasure we keep only a one-way hash of the shop’s address and the date of erasure, so that a late event cannot recreate the shop. Copies in our providers’ own logs and backups expire on their schedules.

How do we keep it secure?

Traffic to and from the app uses HTTPS. Codes and buyers’ email addresses are encrypted before they are stored, with a data key that is specific to each shop and is itself encrypted with a master key kept outside the database. Looking up an order by email uses a keyed hash, so the address does not need to be decrypted to search.

Delivery links are random and only a hash of each is stored. They open the codes only after the buyer presses a button, so a mail scanner that merely visits the link cannot read or use them. Webhooks from Shopify are accepted only when their signature is valid. Every database query is limited to one shop, and automated tests check that one shop cannot read another’s data.

Our staff sign in to the internal console with a password, an authenticator-app second factor is available for every account, and their actions on merchant data are logged.

If we learn of a breach that affects personal data we process, we will notify the affected merchants without undue delay, and within the time the law requires, by email to the shop’s contact address, saying what happened, which data is involved and what we are doing about it. No system is perfectly secure, so we cannot guarantee absolute security.

What rights do individuals have, and how are they exercised?

Merchants can see and change the data they put into the app from inside the app, and can have all of a shop’s data erased by uninstalling the app (see above) or by writing to us.

Buyers: the merchant who sold you the codes is responsible for your data. You can ask the merchant, or us at privacy@firesio.com, for a copy of the data we hold about you, for it to be corrected, or for it to be erased. If you write to us we will tell the merchant, and we will act on the request ourselves where the merchant asks us to or the law requires it. To find your records we use the order number and the email address of the order.

The app receives Shopify’s three mandatory privacy notifications: customer data request, customer erasure and shop erasure. The shop erasure notification erases the shop’s data as described above. The customer erasure notification erases, for the orders Shopify lists, the buyer’s email address and its lookup hash, the order’s language, the email provider’s message id of each delivery attempt and the fingerprint of the address that first opened a delivery link, and it switches off that order’s delivery links. We keep the order, its amount and status, the times and statuses of the deliveries, and the record that a code was handed out: the merchant needs them for its books, and a code that was delivered is never sold again. The customer data request notification makes us email the merchant, at the shop’s contact address, what we hold for the orders Shopify lists (the buyer’s email address, the order lines, the delivery attempts and how the delivery links were used, but not the codes), for the merchant to give to the customer. If we hold no address for the merchant, our staff answer the request by hand. Requests about one buyer that reach us directly are handled by us on the merchant’s instruction or the buyer’s request to privacy@firesio.com.

Depending on where you live you may also have the right to restrict or object to processing, to portability, and to complain to your data protection authority. We answer requests within 30 days, and we may ask you to confirm that you control the shop or the order’s email address before we act.

How do you contact us?

Write to privacy@firesio.com for any privacy question or request. The address is monitored by the people at Firesio who handle these requests. For help using the app, write to support@firesio.com.

How will we tell you about changes?

This policy shows the date it was last updated. If we change it in a way that matters, for example a new category of data or a new sub-processor, we will email merchants at the shop’s contact address and show a notice in the app before the change takes effect, normally at least 30 days beforehand. Earlier versions are available on request.