This Privacy Policy explains how KLYX ("we", "us", "our") collects, uses, and protects information when you install and use the Klyx Store Backup Shopify application ("the App"). By installing the App, you agree to this policy.
1. Information We Collect
When you install and use the App, we collect the following information:
- Store domain and owner email — to identify and authenticate your Shopify store.
- Shopify OAuth access token — stored encrypted to make API calls on your behalf. Never exposed in plain text.
- Backup data snapshots — JSON representations of your store's products, collections, pages, blogs, articles, themes, customers, metafields, metaobjects, navigation menus, and store settings — collected solely to provide the backup and restore service.
- Alert email and settings — the email you configure for notifications, and your chosen backup schedule, resource toggles, and retention preferences.
- Restore history and logs — records of restore operations for your audit trail.
- Google Drive refresh token (optional) — stored encrypted only if you connect Google Drive for backup export.
2. How We Use Your Data
We use collected information solely to provide the App's services:
- Perform scheduled and on-demand full backups of your store data.
- Allow you to restore your store to any previous backed-up state — full store, resource type, or individual item.
- Send email notifications for backup success, failure, large change detection, and restore completions.
- Display backup history, storage usage, and diff comparisons in the app dashboard.
- Process Shopify billing for paid subscription plans via the Shopify Billing API.
We do not sell, rent, or share your data with third parties for marketing purposes.
3. Data Storage & Security
- Encryption at rest: Access tokens and Google Drive tokens are encrypted using AES-256-CBC before being stored in the database.
- Database: Backup metadata and JSON snapshots are stored in a PostgreSQL database hosted on Supabase with SSL/TLS enforced for all connections.
- Binary file storage: Product images and theme asset files (if enabled) are stored in Cloudflare R2 object storage — US or EU region per your preference — with no public access. Files are stored under a path scoped to your shop ID.
- Transmission: All data is transmitted over HTTPS only. No unencrypted connections are permitted.
- Isolation: All database queries are scoped to your
shopId — merchants cannot access other shops' data.
4. Data Retention
- Active backups: Backup snapshots older than your configured retention period (7–365 days) are automatically deleted via scheduled cleanup jobs.
- Upon uninstall: All your shop data is scheduled for deletion within 30 days of uninstalling the App, per our GDPR uninstall webhook handler.
- Immediate deletion: You can delete all backup data at any time via the "Delete All Backup Data" button in App Settings.
- Customer data processed via Shopify GDPR webhooks is handled per the timelines in Section 6 below.
5. Third-Party Services
The App relies on the following third-party services. Each has its own privacy policy:
6. GDPR Compliance
For merchants and customers in the European Economic Area (EEA), we respect all rights under GDPR:
- Right to access — Use "Download Data Export" in App Settings to receive a JSON copy of all data we hold for your store.
- Right to rectification — Contact us to correct inaccurate data.
- Right to erasure — Use "Delete All Backup Data" in Settings, or contact us to request complete deletion.
- Right to portability — The data export feature provides your data in machine-readable JSON format.
- Right to object — Object to certain types of processing by contacting us.
We fully support all three mandatory Shopify GDPR webhooks: customers/data_request, customers/redact, and shop/redact.
To exercise any of your GDPR rights, contact us at contact@klyx.agency.
- Email: contact@klyx.agency
- Phone: +91-8279555123
- Developer: KLYX — klyx.agency
- Address: Durga Vihar, Lane no 4, Vikasnagar, Dehradun - 248198, Uttarakhand, India