Privacy policy

Last updated July 31, 2026

This policy explains what the Shopfloor Shopify app ("the App") stores, why, and for how long. It is written against the App's actual database schema, not against a template.

The App is operated by Aikolumi Software PVT LTD ("we", "us"), the data controller for the information described here.

1. In one sentence

Shopfloor is an internal task board for the people who work in a store. It stores the tasks you write and the staff you assign them to. It does not read, receive, or store your customers' personal information at all.

2. What the App does not touch

The App is installed with a single Shopify access scope: read_products. It therefore cannot read — and has no database column for — any of the following:

• customer names, email addresses, phone numbers, or addresses
• orders, draft orders, checkouts, or carts
• payment or card data
• storefront browsing, analytics, or marketing consent records
• your theme, your storefront, or anything a shopper sees

Nothing the App stores is ever shown to a shopper or published to your storefront.

3. What the App stores, exactly

Six tables. This is the complete list.

3.1 Work you create

The title, description and comment body are free text that your staff type. What goes in them is up to you — see §8.

3.2 Your staff roster

Per person we store: shop domain, name, email address, role, an avatar colour, Shopify staff user id, an origin marker (added by hand, or enrolled from Shopify), and the date the record was created.

This is personal data about your staff, and it reaches the App in two ways:

• They enrolled themselves. The first time a member of your staff opens Shopfloor, the App exchanges their Shopify session token for the identity Shopify issues with it, and records their first name, last name, email address and Shopify staff user id. The access token used for that exchange is discarded immediately and never stored; only the identity is kept.
• You typed them in. Anyone without a Shopify login — floor staff, packers, weekend cover — is added by hand on the Staff page, with whatever name, email and role you enter.

The App cannot list your staff. Shopify puts every query that returns a store's team behind the read_users scope, which is granted only to Plus and Advanced stores. Shopfloor does not request that scope. It only ever learns about the person making the current request, from their own request — so the roster fills in gradually, one person at a time, as each of them opens the app.

3.3 Your plan

We store: shop domain, plan name (Free, Team or Store), the seat limit, the Shopify subscription id and status, the billing interval, when the trial ends, and when the current period ends. No card, bank or billing-address data is stored — payment is handled entirely by Shopify and never reaches the App.

3.4 Your Shopify connection

One record per shop holds the shop domain and the Admin API access token and refresh token Shopify issued to the App, with their expiry times. The token is what lets the App search your product catalogue when you link a work item to a product.

The short-lived session tokens your browser sends on each request are verified in memory and never written to the database.

3.5 Product references

If you link a work item to a product, the App stores that product's Shopify id and its title on the work item. Nothing else about the product — no price, no inventory, no images — is stored.

3.6 Server logs

The application server records ordinary request logs (timestamp, path, status, shop domain, error detail). They exist for debugging and are not used for profiling or advertising.

4. Why we store it

Only to run the App: showing and saving your projects and work items, assigning them to your staff, letting your staff comment on them, linking a work item to a product, and enforcing the seat limit your plan carries.

We do not sell your data. We do not share it with third parties for marketing. We do not use it to train machine-learning models. There is no advertising or analytics tracker in the App.

5. Where it is hosted

All data stays in the EU. If you are outside the EU, your data is transferred to and stored in Germany.

6. Sub-processors

There are no others. No analytics provider, no error-tracking service, no email provider, no AI or LLM vendor receives any of your data.

7. Retention and deletion

• While installed: data is kept for as long as the App is installed on your store, because the App exists to keep a history of your work.
• On uninstall: the App's access token for your store is deleted immediately, when Shopify sends the app/uninstalled webhook. The App can no longer reach your store from that moment.
• 48 hours after uninstall: Shopify sends shop/redact, and the App deletes everything for that shop in a single transaction — every comment, work item, project, staff record, plan record and session. Nothing is retained, archived, or kept in a backup beyond the ordinary rotation of the encrypted database backups described below.
• Backups: encrypted RDS snapshots roll off on the instance's retention schedule. A deleted store's data disappears from backups when the last snapshot taken before the deletion ages out.
• Manual deletion: you can ask us to delete your store's data at any time, without uninstalling, at mo@touchstage.com.

Shopify's mandatory privacy webhooks

The App implements all three:

• shop/redact — deletes the entire store's data, as described above.
• customers/data_request — acknowledged. The App holds no customer data, so there is nothing to return.
• customers/redact — acknowledged. The App holds no customer data, so there is nothing to erase.

8. Your responsibilities as the controller of task content

Work item titles, descriptions and comments are free text. If your staff type personal data about a customer into a task, that data will be stored by the App even though the App never asks Shopify for it. Please don't do this — and never put payment card numbers, government identifiers, or health information into a work item. The App is not built for that, and §4 of the terms says the same.

9. Your rights

Depending on where you are, you may have the right to access, correct, export, restrict, or delete the personal data we hold, and to object to its processing. For the App, that data is your staff roster and the content of your work items and comments.

Exercise any of these at mo@touchstage.com. We will respond within 30 days. You also have the right to complain to your local data protection authority.

Because the App holds data about your staff, you are the controller for that relationship: please make sure the people on your roster know their name and email are recorded in Shopfloor.

10. Security

• Every request from the embedded app is authenticated with a Shopify session token, verified against the App's own secret with a constant-time comparison, and checked for expiry and audience before any data is read.
• Every webhook is verified with an HMAC over the exact bytes Shopify sent; anything that fails is rejected with 401 before it reaches a handler.
• Every query is scoped to a single shop domain taken from the verified token, so one store cannot read another's data.
• The database is not publicly reachable; it is accessed over a private network connection.
• Secrets are held in AWS Secrets Manager, not in the container image or the repository.

If we discover a breach affecting your data, we will notify you at the email address on your Shopify account, and any supervisory authority we are required to notify, without undue delay.

11. Children

The App is a business tool. It is not directed at children and we do not knowingly store data about anyone under 16.

12. Changes

If this policy changes, the updated version is posted on this page with a new date at the top. Material changes will also be announced in the App.

13. Contact

Aikolumi Software PVT LTD

Support and privacy enquiries: mo@touchstage.com