Privacy Policy

1. Who we are

VaultKeep is a Shopify app operated by Bedrock Digital (“we”, “us”, or “our”). VaultKeep provides backup and restore tools for Shopify merchants. This policy explains what personal data we process, why, how we protect it, and the rights you have over it. For any question related to this policy, contact support@bedrk.dev.

2. Data we collect

When you install VaultKeep on a Shopify store, we receive data through the Shopify Admin API that is strictly necessary to provide the backup service:

• Store information: shop domain, plan, timezone, primary locale.
• Catalog data: products, variants, collections, metafields, metaobjects, blogs, pages, files, themes.
• Customer data: names, email addresses, phone numbers, addresses, tags, metafields.
• Order data: order IDs, totals, line items, financial/fulfillment status, billing and shipping addresses.
• Merchant account metadata exposed by Shopify OAuth (your shop owner email, session tokens).

We do not collect payment card details, Shopify passwords, or analytics about your store’s visitors. We never sell your data.

3. How we use data

• To produce, store, and restore encrypted backups of your Shopify data.
• To display backup history, change diffs, and restore previews inside the embedded app.
• To enforce plan limits (storage, backup frequency, and retention) and manage subscription terms.
• To diagnose errors and protect the service from abuse.

4. Where data is stored

App metadata (shop settings, backup index, audit logs) is stored in a PostgreSQL database hosted on Hetzner Cloud in Ashburn, Virginia, USA. Backup payloads are encrypted in transit and at rest in Cloudflare R2 object storage. Access to both systems is restricted to VaultKeep production services.

5. Sub-processors

We use the following sub-processors to deliver the service. Each is bound by data processing terms:

• Shopify — source of the data VaultKeep backs up, authentication, billing.
• Hetzner Online GmbH — application and database hosting.
• Cloudflare, Inc. — R2 object storage for backup payloads, CDN.

6. Retention

Backup payloads are retained according to your active plan: Starter 30 days, Professional 90 days, Enterprise 365 days. When a backup exceeds its retention window, it is permanently deleted from storage on the next cleanup cycle. App metadata is retained for the lifetime of the installation. When the app is uninstalled, or when you submit a deletion request, we delete your data within 30 days.

7. Your rights

Depending on where you live, you may have the right to access, correct, export, or delete personal data we process about you or your customers, and to object to certain processing. Shopify forwards privacy requests to VaultKeep, and we complete each one within the 30-day window required by the Shopify App Store:

• customers/data_request — we record the request and compile every backup copy we hold of that customer and of the orders named in the request into a single data file. We provide that file to the merchant, who passes it on to the customer.
• customers/redact — we permanently delete that customer's records, and the orders named in the request, from every stored backup. Backup copies we cannot read are deleted too, and existing export files are invalidated.
• shop/redact — we permanently delete all backups, exports, settings and pending data requests we hold for the store.

You can also email support@bedrk.dev directly and we will respond within 30 days.

8. Security

Traffic between your browser, Shopify, and VaultKeep is encrypted with TLS. Backup payloads are encrypted at rest. Access to production systems is restricted, logged, and protected with key-based authentication. We practice principle-of-least-privilege for internal access and keep audit logs of administrative actions.

9. Children

VaultKeep is a business tool. We do not knowingly collect data from children under 16.

10. Changes to this policy

If we make a material change to this policy, we will update the “Effective” date above and notify active installs by email before the change takes effect.

11. Contact

Questions or privacy requests: support@bedrk.dev.