K's Apps ("we") operates the Shopify app Showfold - Line Sheet Maker ("Showfold"). This policy explains what Showfold reads from your store, what it keeps, for how long, how it is deleted, and what rights you have.
1. What Showfold reads from your store
Store details: the store's domain, name, currency, time zone and tax setting.
Products: titles, descriptions, vendors, product types, tags, images, status and dates, variants with their options, SKUs, barcodes, prices and compare-at prices, whether a variant is available (never stock quantities), and collections.
Metafields: your store's product and variant metafield definitions, and the values of the metafields you choose in Settings or in a document.
Catalogs: your B2B and market catalogs with their markets, product lists, price lists, volume prices and quantity rules.
Your Showfold plan, as Shopify reports it.
Showfold does not read customers, orders or companies, and it has no access to your customers' personal data.
2. What Showfold keeps
Your settings: brand name, contact lines (which may include a staff member's name, email address or phone number), logo, brand color, labels and defaults, and a copy of the store details above.
Your plan: the plan Shopify last reported for your store, when a trial ends, when the plan was last checked and changed, and when you uninstalled Showfold, if you did.
Your documents and their settings, with the newest 20 versions of each document's settings.
Generated files: the PDF and CSV of the newest 4 versions of each document.
Working copies: product snapshots for 14 days, converted product images for 30 days, and preview files for 1 day. A snapshot also holds its generation's report of the products left out and why. If a file upload is interrupted, its unfinished parts can remain in storage for up to 1 day before they are removed automatically.
Share links: the link, the label you give it, and a password if you set one (stored only as a salted hash), with daily totals per link of views, downloads and wrong passwords typed.
Feature requests you send from the Help page.
Technical records: the status and error code of each generation (90 days, except the generations behind the versions you keep and each document's latest ones, which stay while the document exists), error logs without product content (90 days), in-app events (a file opened or downloaded in the app, a suggestion or a review request shown, clicked or dismissed), short-lived locks that name your store while one of its tasks runs, and your Shopify login session. Cloudflare keeps the state of each generation run for up to 30 days, as step names, codes and counts.
Operation logs: Cloudflare keeps Showfold's logs for up to 7 days, and only K's Apps can read them. A log line holds your store's domain, what happened and on which page, ids and counts; for an error, also its name, a shortened message and where in the code it happened. Showfold removes share link addresses and the values in URLs from the lines it writes, and never writes access tokens or the contents of Shopify's webhooks into them. Cloudflare, the host, may also record the web address and approximate location of each request in these logs; for a buyer page, that address is the share link.
Documents you move to Trash are deleted after 30 days, with their settings, versions, share link and files (for the database's restore history, see section 5). Anything else this section gives no period for is kept until you delete it or uninstall Showfold, and is then deleted as section 5 says.
3. Buyers who open a share link
Showfold counts views, downloads and wrong passwords per link and day. It does not store a buyer's IP address, browser details or any other personal data, and known bots are not counted. Like any request to Showfold, a buyer's visit may appear in Cloudflare's logs for up to 7 days, with its web address and approximate location (section 2).
When a link has a password and the buyer enters it, Showfold sets one cookie, __Secure-showfold-access, for that link only (its path is the link's address). It keeps the buyer signed in to that link for 7 days and holds no personal data. There are no other cookies, no tracking and no scripts on the buyer page.
4. How we use the data
To generate your line sheets and price lists, keep them up to date, and serve your share links.
To show your plan and usage, and to answer your support requests.
We do not sell or share data with third parties except as required by law, and we never use it for advertising.
5. Deletion
When you uninstall Showfold, your share links stop at once. Shopify then sends a deletion request (shop/redact), and within hours Showfold deletes everything it keeps for your store from its database and its file storage, apart from the database's restore history (next item). Anything still left 7 days after an uninstall is deleted automatically.
Our database provider, Cloudflare D1, keeps a point-in-time restore history of the database for 30 days, so data deleted from the database leaves that history 30 days after it is deleted. We only ever restore from it to recover from an outage.
Cloudflare keeps the record of each deletion run, which names your store's domain and otherwise holds only counts, for up to 30 days.
Showfold keeps no customer data, so the customers/data_request and customers/redact requests have nothing to return or delete.
6. Service providers
Cloudflare: hosting, processing and storage.
Google: the support mailbox.
7. Security
Every page, share link, generated file and webhook of Showfold uses HTTPS only: a plain HTTP request to any of them is redirected to HTTPS. The app you open in Shopify runs at a .dev address, which browsers open only over HTTPS. Data is stored on Cloudflare's encrypted infrastructure. Buyers get files only through Showfold, which checks the link on every request. Showfold never writes share link addresses, access tokens or the contents of Shopify's webhooks into its log lines; section 2 says what Cloudflare may record with them.
8. Your rights and who we are
Who we are: K's Apps, the developer of Showfold, based in Japan, is the controller of the data this policy describes. You can reach us at support-catalog@ks-apps.org.
Legal basis: we use the data to provide Showfold under our contract with the merchant who installs it, and for our legitimate interests in counting share link views, keeping the app secure and answering support requests.
Your rights: you can ask us to access, correct, delete or export your data, or to restrict or object to how we use it, by email to support-catalog@ks-apps.org. Uninstalling Showfold also deletes what it keeps for your store, as section 5 says.
Complaints: you can complain to the data protection authority where you live or work.
Where the data is processed: on Cloudflare's global network and, for support email, by Google, under their data processing terms, which provide for the EU Standard Contractual Clauses and the EU-U.S. Data Privacy Framework. K's Apps works from Japan, which the European Commission recognises as protecting personal data adequately.
9. Contact
Questions about this policy or the app: support-catalog@ks-apps.org