What data Etchify processes — and where it lives
Etchify is a Shopify app. The merchant is the controller; Etchify processes data on their behalf. This page shows how data moves, in plain words; the privacy policy and the DPA are binding.
As of 24 September 2026
How data moves
1 · Install
Shopify hands over the shop domain and a session token. Etchify reads products and variants and writes back the metafields and variants the merchant sets up.
2 · Design
The shopper designs in the configurator on the product page. Text, images and the design go to our backend in the EU. Background removal runs on our own server — no image is sent to a third-party AI service.
3 · Order
At checkout the design is linked to the order. Payment runs through Shopify; Etchify never sees payment data.
4 · Production
The merchant downloads the true-to-scale production file from their admin. Only they can — the shopper never can.
Where data lives
Every service that processes personal data of the shop or its customers. The full list with data categories is Annex 1 of the DPA.
Supabase Pte. Ltd. (Singapore)
Database: shop settings, designs, order references
- Location
- EU — AWS Stockholm (eu-north-1)
- Transfer safeguard
- Standard Contractual Clauses (support access from Singapore/US possible)
Hostinger
Backend (api.etchify.app) and uploaded files
- Location
- EU (Germany)
- Transfer safeguard
- not needed — EU
Vercel Inc.
Serving the interfaces (etchify.app, the admin app)
- Location
- US, global edge
- Transfer safeguard
- EU-US Data Privacy Framework / Standard Contractual Clauses
Shopify International Ltd.
Platform: install, products, metafields, billing
- Location
- Ireland, group Canada/US
- Transfer safeguard
- EU-US Data Privacy Framework / Standard Contractual Clauses
Resend (Plus Five Five, Inc.)
Notification emails to merchants
- Location
- Sent via AWS SES in the EU, provider US
- Transfer safeguard
- EU-US Data Privacy Framework / Standard Contractual Clauses
What Etchify does not do
- No payment data — billing and payment run through Shopify.
- No sharing of shopper images with third-party AI services, and no training on them.
- No selling of data and no advertising use.
- Error reports go to self-hosted monitoring (GlitchTip), not to a third party.
Deletion and retention
- Uninstall: Shopify sends “shop/redact”; Etchify deletes the shop’s data including uploaded files.
- Shopper deletion request: “customers/redact” deletes their order references, projects and uploads.
- Backups: daily. Database backups are deleted after 32 days at the latest (encrypted off-site copy with a 30-day deletion lock, released afterwards); server backups after 5 days.
The binding texts
Privacy questions: legal@etchify.app