Privacy Policy

Last updated: October 2026

1. Data Controller

Valerian Huber
Dahlienweg 11
83109 Großkarolinenfeld, Germany
Email: help@etchify.app

2. Legal Basis

Personal data is processed on the basis of Art. 6 GDPR:

• Art. 6(1)(b) GDPR — Performance of contract (app provision, design creation, order processing)
• Art. 6(1)(f) GDPR — Legitimate interest (server logs, security, error analysis)
• Art. 6(1)(a) GDPR — Consent (analytics, where applicable)

3. Data Collected

The following data is processed when you use our app:

• Store domain and Shopify store data (for app functionality)
• Design data (texts, images, positions on the canvas)
• Order data (if an order is placed via the configurator)
• Server logs (IP address, timestamp, browser type)

4. Purpose of Processing

The data is processed exclusively for the provision of the Etchify app functionality (design creation, production file export, order management).

5. Authentication

Etchify is a Shopify app and uses Shopify OAuth exclusively for authentication. When you install the app, the shop owner authenticates through Shopify; we do not store passwords or run our own sign-in service. The data exchanged (shop domain, OAuth access token, shop owner email) is used only to operate the app.

6. Web Analytics (Umami, Vercel Web Analytics)

We measure the use of this website with Umami, self-hosted on our server in Frankfurt am Main (Hostinger). Umami sets no cookies, reads nothing from your device and stores no IP addresses; it only records aggregated information such as the page visited, referring page, browser, device type and country. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in privacy-friendly audience measurement). Only if you consent in the cookie banner do we additionally use Vercel Web Analytics, likewise without cookies (Art. 6(1)(a) GDPR); you can withdraw your consent in the banner at any time. We do not use Google Analytics.

7. Storage

Design data is stored on servers in the EU (Supabase, Hostinger).

Deleted data and files remain in our encrypted backup copies for up to 32 days and are then removed automatically. If a technical fault delays the deletion, we complete it as soon as the fault has been fixed.

8. International Data Transfers

Some of our service providers process data in the USA:

• Vercel (website hosting) — EU-US Data Privacy Framework
• Vercel (Web Analytics, only with consent) — EU-US Data Privacy Framework

All providers listed are certified under the EU-US Data Privacy Framework, which ensures an adequate level of data protection.

9. Your Rights

You have the right to information, correction, deletion and restriction of the processing of your data. Contact us at help@etchify.app.

10. Cookies

Etchify only uses technically necessary cookies: for session management, language settings and authentication, and in the app one that keeps serving an open session the matching program version after an update (__vdpl, contains only the version identifier and ends with the browser session). We store your choice in the cookie banner in your browser's local storage. We do not set analytics cookies.

11. API Keys & MCP Integration (Pro/Business)

On Pro and Business plans, shop owners can generate API keys to connect Etchify app data via REST or the MCP protocol with AI frontends (ChatGPT, Claude.ai, Claude Desktop) or their own software. API keys are stored only as hashes in our database and shown in cleartext only once at generation. We never send API keys via email. When using the MCP connector, requests are routed through https://api.etchify.app/mcp via TLS 1.3; AI frontends see shop configuration data. On the Pro and Business plans, AI write tools (21 write tools for products, materials, shapes, and templates) are available — changes to the setup apply directly; products already on sale wait for the shop owner’s approval. API keys can be rotated or revoked from the Etchify admin at any time and are automatically revoked on plan downgrade below Pro or on app uninstall.