Data Privacy (options)
This page explains how the Options app handles your customers' data, for GDPR, UK GDPR, Swiss FADP and CCPA requests and for your own privacy notice. It is a summary for information only and is not legal advice. The Data Processing Agreement (DPA) and our other policies apply over this page if the two differ.
Our policies
Who is responsible for the data
For your customers' data, your store is the controller and Cloudlift GmbH (Switzerland) is your processor, under the DPA. The DPA applies from installation, no signature is needed. For California residents, we act as a service provider. We do not sell personal information.
What data the app stores
| Data | Examples |
|---|---|
| Uploaded files | Files from upload options, and the preview images and print exports made from them |
| Saved configurations | Products a customer saves for later, with the Shopify customer id |
| Technical data | IP address, browser and request path in application logs |
The app does not store customer names or email addresses.
Where the data is stored
Your customer data, the files your customers upload and the previews and print exports made from them, is stored on Google Cloud in the United States by default.
The Options app has no setting to change the location of the customer uploaded data. To store your customers' uploads in the European Union (Belgium) or Asia (Singapore), you can install the Upload-lift app which shares the same file storage. The Storage location you choose in Upload-lift under Settings > Storage & Privacy applies to the customer uploads of both apps. See Upload-lift: Data Privacy for the plans and steps.
AI
Customer data is sent to AI providers only if you set this up yourself, with the AI extension. When you add an AI option to a product, the images your customers upload to it and the prompts they type are sent to the AI model you selected, to generate or edit the image. Without an AI option, no customer data reaches an AI provider.
The AI assistant in the app admin uses only what you type in the chat and the option configurations it works on for you. We do not use your data or your customers' data to train AI models. The AI providers are named on the subprocessor list. If you offer the AI option, mention it in your privacy notice.
Customer deletion requests
In Shopify, open the customer and choose More actions > Erase personal data. Shopify then asks the app to delete the customer's saved configurations and the files of their orders. For other requests, write to privacy@cloudlift.app.
How long data is kept
| Data | Kept for |
|---|---|
| Uploaded files that were not ordered | At most 30 days |
| Saved configurations and their files | 90 days after the save |
| Ordered files | As set in the shared storage, see Upload-lift: Data Privacy |
| Shop data after uninstall | Deleted on Shopify's erasure notice |
| Backups and application logs | At most 30 days |
Section 11 of the DPA sets these periods.