Privacy policy
Last updated October 12, 2026GMVify Photo & File Upload (“GMVify Upload”, “the app”) is a Shopify app by Vitamin Creative Lab Limited (“we”, “us”) that lets shoppers upload photos and files on a store’s product pages and delivers those files to the merchant with the order. This policy explains what GMVify Upload collects, why, who it shares it with and how long it keeps it. It covers merchants who install the app and the shoppers who upload files in their stores.
What we collect
| Data | From | Why |
|---|---|---|
| Files shoppers upload, with file name, size, type, pixel dimensions and crop | Shoppers | To give the merchant the files they need to fulfil the order |
| Order ID, order number and line item the files belong to | Shopify (orders/create webhook) | To attach files to the right order and flag orders missing a required file |
| Store domain, access token, plan, store contact email | Shopify, when the merchant installs | To run the app, apply plan limits and send usage and file-expiry notices |
| Upload field settings and which products they apply to | The merchant | To show the right upload box on each product |
| IP address, browser and request times in server logs | Anyone using the app | Security and troubleshooting |
GMVify Upload does not store shoppers’ names, email addresses, phone numbers, shipping addresses or payment details. It reads orders only to match uploaded files to them. Notes a shopper types next to a file are saved on the cart and order in Shopify, not by GMVify Upload.
How files are protected
Files are stored in a private bucket. Nobody can open them by guessing an address: the merchant’s admin, the order page and the shopper’s own upload page get links that expire after an hour. Files are encrypted at rest by the storage provider and always sent over HTTPS.
Who we share data with
We do not sell data or use it for advertising. We use these service providers to run the app:
| Provider | What for | What it receives |
|---|---|---|
| Render | Hosting the app and its database | Everything listed above except the files themselves |
| Cloudflare (R2) | File storage | Uploaded files and the previews we make of them |
| DeepSeek | AI translation of upload fields into the store’s languages (Pro) | The upload fields’ own text (name, help text, note box label and placeholder) and the languages to translate into. No files and no shopper or order data. |
| Resend | Email to merchants | The store contact email and the notice text |
We may also disclose data when the law requires it.
How long we keep it
- Files on an order are kept for 30 days after the order on the Free plan and 365 days on Pro, then deleted. Merchants are notified a week before.
- Files that never became part of an order (a shopper uploaded and left) are deleted after 7 days.
- Phone upload codes expire after 30 minutes.
- When a merchant uninstalls, their access token is deleted at once. Shopify then asks us to erase the store’s data, and we delete all its files, fields and records.
Your rights
Shoppers: the store you bought from controls your order and the files on it. Ask the store to see or delete them; when Shopify sends us the store’s erasure request for your orders, we delete those files. You can also contact us directly.
Merchants: you can download the files on your orders at any time and ask us to delete any of them, and uninstalling removes your data as described above. Depending on where you live (for example the EU, UK or California) you have the right to access, correct, delete or move your data and to complain to a data protection authority.
Changes and contact
If we change this policy we will update the date above, and tell merchants in the app when the change is significant. Questions or requests: email support@gmvify.com or see the support page.