Privacy Policy
Effective date: September 15, 2026
This privacy policy describes how Optan (“we”, “us”), publisher of the Shopify app Optan Engrave & Personalize (the “App”) and of this website, processes personal data. It is written for both merchants who install the App on their Shopify store and end customers of those stores whose personalization data passes through the App.
Contact for anything in this policy: support@optanapps.com.
1. Who we are
Section titled “1. Who we are”Optan is the publisher of the App. For data that merchants entrust to the App in the course of operating their store (such as their customers’ personalization content), the merchant is the data controller and Optan acts as a data processor on the merchant’s behalf. For data about merchants themselves (account and billing-related data described in section 2.1), Optan acts as a controller.
2. What data we process
Section titled “2. What data we process”2.1 Merchant and store data
Section titled “2.1 Merchant and store data”When a merchant installs the App, we receive and store:
- the store’s
.myshopify.comdomain and Shopify-issued API access tokens (required for the App to function); - the store’s active App plan, onboarding progress and App settings (default fonts, color palettes, storefront text translations, templates);
- minimal, non-personal telemetry events about App lifecycle (e.g. install, setup completed, first personalized order received) used to operate and improve the App.
Product personalization configuration (fields, preview zones, pricing rules) is stored inside the merchant’s own Shopify store as metafields, not on our servers.
We do not collect merchants’ payment information. All App billing is handled by Shopify; we never see payment card details.
2.2 End-customer personalization data
Section titled “2.2 End-customer personalization data”When a customer places an order containing a personalized product, Shopify notifies the App and we store, per order line:
- the order identifier and order number;
- the personalized product and variant;
- the content of the personalization fields — the text the customer typed (which may incidentally contain personal data, such as a first name or a date), selected font, color and swatch options, and, where the merchant enabled image upload, the URL of the file the customer uploaded;
- the preparation status the merchant assigns in the App.
We deliberately do not store end customers’ names, email addresses, postal addresses, phone numbers, account data or payment details.
Customer-uploaded image files are received and hosted by Shopify, not by us; the App stores only the link that appears on the order.
2.3 Technical logs
Section titled “2.3 Technical logs”Our servers keep short, size-limited technical logs for security and debugging. Logs are rotated automatically and are not used to profile individuals.
2.4 This website
Section titled “2.4 This website”This documentation website is static. It sets no cookies, runs no analytics, and makes no third-party requests. If you email us, we process your message to answer you.
2.5 The storefront block
Section titled “2.5 The storefront block”The App’s storefront component running on merchants’ stores makes no external network requests, sets no cookies, and embeds no third-party scripts, fonts, or tracking pixels. All configuration is delivered by Shopify’s own infrastructure.
3. Why we process this data (purposes and legal bases)
Section titled “3. Why we process this data (purposes and legal bases)”| Purpose | Data | Legal basis |
|---|---|---|
| Providing the App: rendering personalization, listing personalized orders, printing, exports, production files | Store data, personalization data | Performance of a contract (merchant); processing on the merchant’s instructions (end customers) |
| Operating, securing and debugging the service | Technical logs, telemetry | Legitimate interest in running a reliable, secure service |
| Responding to support requests | Contact data you provide | Performance of a contract / legitimate interest |
| Complying with legal obligations, including privacy requests relayed by Shopify | The data concerned by the request | Legal obligation |
We do not sell personal data, use it for advertising, or share it with data brokers. No automated decision-making with legal effects is performed.
4. Where data is stored and who can access it
Section titled “4. Where data is stored and who can access it”The App’s database and servers are hosted in the European Union (France) by our hosting provider. Data is transmitted over HTTPS; webhooks from Shopify are authenticated (HMAC) before processing.
We share data only with the subprocessors strictly necessary to run the service:
| Recipient | Role | Location |
|---|---|---|
| Shopify Inc. | E-commerce platform the App runs on; hosts stores, orders, metafields and customer-uploaded files | Global infrastructure, per Shopify’s privacy policy |
| o2switch | Hosting of the App’s server and database | France (EU) |
No other third party receives personal data.
5. How long we keep data
Section titled “5. How long we keep data”| Data | Retention |
|---|---|
| Personalized order records | While the App is installed on the store, then purged 30 days after uninstallation |
| Store record, settings, templates | Deactivated at uninstallation, purged 30 days later (or immediately upon Shopify’s shop/redact notification) |
Data covered by a customer erasure request (customers/redact) |
Purged upon receipt of the request relayed by Shopify |
| Technical logs | Short-lived, rotated automatically at a fixed size |
Reinstalling the App within the 30-day window restores the store’s data; after purge, nothing remains to restore.
6. GDPR requests
Section titled “6. GDPR requests”The App implements Shopify’s three mandatory privacy webhooks, verified and idempotent:
customers/data_request— we compile the personalization data we hold for the customer concerned and make it available through Shopify’s standard process;customers/redact— we permanently delete the personalized order records of the customer concerned;shop/redact— we permanently delete all data related to the store.
End customers should address privacy requests to the merchant they bought from (the data controller); merchants trigger the process through Shopify, and the App responds automatically. You may also contact us directly at support@optanapps.com and we will assist or forward the request as appropriate.
7. Your rights
Section titled “7. Your rights”If you are in the European Economic Area, the United Kingdom, or a jurisdiction with similar laws, you have the right to access, rectify, erase, restrict or object to the processing of your personal data, and the right to data portability, within the limits of applicable law. You also have the right to lodge a complaint with your supervisory authority (in France: the CNIL, cnil.fr).
To exercise these rights regarding data held by the App, contact the merchant you purchased from, or write to support@optanapps.com.
8. Security
Section titled “8. Security”Measures in place include: HTTPS everywhere, HMAC verification of all incoming webhooks, API access restricted to the minimal Shopify permissions the App needs, hardened HTTP response headers, size-limited rotated logs, and daily database backups stored with the same EU hosting provider.
9. Children
Section titled “9. Children”Neither the App nor this website is directed at children under 16, and we do not knowingly collect their data.
10. Changes to this policy
Section titled “10. Changes to this policy”We may update this policy as the App evolves. The effective date at the top reflects the latest revision; material changes will be announced to merchants inside the App or by email.
11. Contact
Section titled “11. Contact”Optan — publisher of Optan Engrave & Personalize Email: support@optanapps.com Website: optanapps.com/engrave