Privacy Policy

Last updated: October 28, 2026

This Privacy Policy explains what information SpecLock ("the App", "we", "us") collects when a Shopify merchant installs and uses it, why we collect it, and how it is stored and deleted. The App lets a merchant create a visual proof for a custom or made-to-order order — attaching an image, dimensions, material, color and text to a specific order — and send the customer on that order a link where they can approve the proof or request changes before the merchant produces the item.

1. Information we collect from the merchant

When you install the App, we collect and store the following about your store:

Your store's domain (e.g. your-store.myshopify.com), used to identify your store and keep every merchant's data separate from every other merchant's.
An OAuth access token issued by Shopify when you install the App, which lets the App read and act on the data you authorize below on your behalf. We never see or store your Shopify login password.
Basic account information about the staff member who installed the App (name and email address, if made available to us by Shopify as part of the standard installation process).

To do its job, the App requests the following permission scopes from Shopify:

read_orders — to let you pick the order a proof belongs to, show its order number, and (see Section 2) check whether the order's items or quantities have changed after a customer has already approved a proof;
write_orders — to add a small status tag to the order (e.g. "awaiting approval", "approved", or "needs re-approval") so you can see a proof's status directly on the order in Shopify;
read_customers — to look up the name and email address of the customer on that order, so the App can send them the approval link;
write_files — to upload the proof image or PDF file(s) you attach to Shopify's own file storage;
write_products, write_metaobjects, write_metaobject_definitions — reserved for the App's own configuration and future product-side features; the App does not currently modify your product catalog.

2. Information we collect about the merchant's customer

For each proof you create, the App stores the customer's name and email address (as they appear on the order you selected), the order number, and the proof itself — the image or PDF file(s) you upload, a checksum of that file (so you and your customer can both verify exactly which file version was approved), and any dimensions, material, color, text or notes you enter. It also stores the customer's response: whether they approved the proof or requested changes, and any comment they left. Once a customer approves, the App stores a small technical fingerprint of the order's line items (which products/variants and quantities — not the customer's personal data) so it can warn you automatically if the order is edited afterwards.

This customer data is collected only because you, the merchant, chose to create a proof for a specific order — the App never scans, imports, or collects data about customers beyond the ones you have explicitly created a proof for. The customer's image uploads and typed comments on the public approval page are stored only in connection with that one proof.

3. How we use the information

We use the information above only to:

Let you create, view, and manage proofs for your own orders inside the App;
Send the customer on an order an email containing a link to view and respond to the proof;
Let the customer view the proof and approve it or request changes, without needing a Shopify account;
Notify you by email when a customer approves a proof or requests changes;
Diagnose and fix technical problems if something goes wrong.

We do not sell, rent, or share this information with any third party for marketing or advertising purposes.

4. Where your data is stored

Your store's data and your customers' proof data (as listed in Sections 1–2) is stored in a Postgres database hosted by Supabase in the EU (Ireland). The App itself runs on Vercel's hosting infrastructure. Proof images are stored in Shopify's own file storage, under your store. Outgoing emails (the approval link to your customer, and notifications to you) are sent through Resend. All of these providers act purely as infrastructure for us — they do not use your data for their own purposes.

5. Data retention and deletion

We keep a proof's data for as long as the App remains installed on your store, so that you and your customer can keep referring back to it. If you uninstall the App, Shopify automatically notifies us, and:

Your OAuth session is deleted immediately;
Within 48 hours of uninstalling, Shopify sends us a mandatory shop/redact notification, and we automatically and permanently delete all remaining data associated with your store — every proof, its versions, and the customer data attached to them.

The App also responds to Shopify's customers/data_request and customers/redact webhook notifications, as required of every Shopify app. Because the App does store customer data (Section 2), these are real, not placeholder, responses: on a customers/redact request we permanently remove that customer's name and email address from every proof on your store (the proof's production details — image, dimensions, material, color, text — are kept, since they describe the order/production itself rather than the person, once the identifying fields are removed).

6. Payments and billing

Any subscription fee for the App is billed entirely through Shopify's own Billing API. We never see, collect, or store your payment card details or any other payment information — that is handled directly by Shopify.

7. Your rights

You can see every proof you have created, and your customers' responses, at any time inside the App. You, or a customer who contacts you, can ask us to delete a specific proof's customer data, or request a copy of what we hold, at any time by contacting us at support@speclockapp.com.

8. Children's privacy

The App is a business tool intended for use by Shopify merchants managing their own store, not by children, and we do not knowingly collect information from anyone under the age required to operate a Shopify store in their jurisdiction.

9. Changes to this policy

If we make material changes to this policy, we will update the "Last updated" date above. We encourage you to review this page from time to time.

10. Contact us

If you have any questions about this Privacy Policy or how your data is handled, contact us at support@speclockapp.com.