Privacy Policy

Last updated [Effective Date] · Covers the ImportKit Shopify application and this website.

This policy explains what ImportKit, operated by [Legal Entity Name], accesses in your Shopify store, what it stores, why, for how long, and how to have it removed. It is written to be specific rather than generic, because a data importer that was vague about data handling would be a strange thing to trust.

The short version

ImportKit does not request access to your customers or orders, so it cannot read them.
Uploaded CSV files are read as a stream and never written to disk.
The rows of a file are stored with the import job so you can see what happened to each one and resume an interrupted import.
We use no analytics services, no advertising, and no tracking cookies.
Everything for a store is deleted when Shopify sends a shop redaction request after uninstall, or sooner if you ask.

1. Who is responsible for what

For the data in your store and in the files you upload, you are the controller and we are a processor acting on your instructions. We process that data only to run the imports you start and to show you their results.

For your account-level information — your store domain, your contact email, and your credit purchase history — we are the controller, because we need that information to operate and bill for the service.

2. What we access in your Shopify store

Installing ImportKit grants it these Shopify Admin API access scopes:

Scope group	Why it is needed
`read_content`, `write_content`	Create blog articles, and read the blogs you can import into. Also gates article, blog and page metafields.
`read_products`, `write_products`	Look up products, variants and collections by handle, ID or SKU, and write their metafields and metafield definitions.
`read_metaobjects`, `write_metaobjects`	Create and update metaobject entries, and resolve references to them.
`read_metaobject_definitions`, `write_metaobject_definitions`	Read your existing metaobject definitions and create new ones.
`read_files`, `write_files`	Resolve `file_reference` values used in metafields and metaobject fields.
`write_locations`, `write_markets`, `write_discounts`, `write_cart_transforms`, `write_delivery_customizations`, `write_payment_customizations`, `write_validations`	Metafield definitions are gated by the owner resource's own scope. These exist so you can define metafields on those owner types; ImportKit does not otherwise read or modify locations, markets, discounts or checkout customisations.

What we deliberately do not request

ImportKit does not request write_customers, write_orders, write_draft_orders, write_gift_cards or write_purchase_options. The practical consequences:

We cannot read, export, modify or store your customers, orders or draft orders. Not by policy — the access does not exist.
ImportKit cannot write customer or order metafields. Rows in your file that target those owner types are reported as errors naming the missing permission, and the rest of the file still imports.

The permissions reference lists every owner type this means you can and cannot write to.

3. What we store

What	Specifically	Why
Store record	Your `.myshopify.com` domain, store name, the store's contact email as provided by Shopify, the Shopify plan name, and install / uninstall timestamps.	To identify your store, scope your data to it, and support you.
Shopify session	The OAuth session issued by Shopify, including the API access token, and — where Shopify issues a user-scoped token — the admin user's first name, last name, email and locale.	Required to call the Admin API on your behalf. Deleted on uninstall.
Credit balance	Credits purchased, used and available.	To meter imports.
Credit ledger	One record per purchase, deduction and refund, with the amount, a description, the Shopify charge identifier, and a timestamp.	So your balance is auditable and purchases are never granted twice.
Import job	Import type, target (such as which blog), the file name you uploaded, row counts, credits used, status, any top-level error, and your column mapping and conflict-mode choices.	To run the job and show it in your history.
Import rows	Each row of the uploaded file, stored as the values from the columns you mapped, plus that row's outcome: status, attempt count, a label, the Shopify ID created, and any message or warning. This is the only place file contents are stored.	To process rows one at a time, to resume an interrupted or cancelled import from where it stopped, and to show you per-row results and let you download the failures.

What we do not store

The uploaded file itself. It is read as a byte stream as it arrives and never written to disk or object storage. If an upload fails partway, the job is discarded so a truncated file can never be imported as if complete.
Columns you didn't map. Columns set to Ignore, and columns you left unmapped, are dropped before the file reaches the importer. Their contents are never sent to Shopify and never stored.
Your store's catalogue. Products, collections, pages and articles are read only at the moment they're needed to resolve a reference, and are not copied into our database.
Payment details. Purchases go through Shopify's billing. We never receive card or bank information.
Customer or order data. See section 2.

4. Personal data in the files you upload

ImportKit stores no customer personal data of its own. But the files you choose to upload are yours, and a row could contain personal data — for example an author name on a blog article, a staff name in a metaobject entry, or an email address used as an owner reference. Anything of that kind is stored as part of the import rows described above, for as long as that job record exists.

You control this. In practice:

Only upload personal data you have a lawful basis to process.
Set columns you don't need to Ignore — ignored columns are never stored.
Ask us to delete a job, or all of your data, at any time (section 7).

Note that customer email addresses or phone numbers used as owner references cannot be acted on anyway, because customer metafields are outside the permissions we request. Such rows fail with an explanatory error.

5. This website

This documentation and marketing site sets no cookies, embeds no analytics or advertising scripts, and loads no third-party fonts or resources. Standard server access logs may be kept by our hosting provider for security and debugging, typically containing IP address, timestamp, requested URL and user agent.

The app itself uses only the session cookies required for Shopify's embedded app authentication. There is no tracking, profiling or advertising anywhere in ImportKit.

6. Who else is involved

We keep the list of third parties deliberately short. Your data is not sold, rented or shared for marketing, ever.

Party	Role	Location
Shopify Inc.	Your store platform, the source and destination of all imported data, and the processor of credit purchases.	Per Shopify's own policy
[Hosting Provider]	Runs the application and its background import jobs.	[Region]
[Database Provider]	Hosts the database holding the records in section 3.	[Region]

We use no third-party analytics, error-tracking, session-recording, advertising or email-marketing service in the app. We will update this list before adding one.

We may disclose data where required by law, and to protect our rights or the safety of others. If a lawful request covers your data and we're permitted to tell you, we will.

7. How long we keep it, and deletion

Automatic deletion

When you uninstall, Shopify sends an app/uninstalled webhook. We immediately delete your Shopify session and access token, so all API access ends, and mark the store inactive. Import history and credit balance are retained at this point so they're intact if you reinstall.
When Shopify sends a shop redaction request (shop/redact, normally 48 hours after uninstall), we delete everything for that store: the credit ledger, the credit balance, every import job, every stored import row, and the store record itself.
Customer data requests and redactions (customers/data_request, customers/redact) are received and acknowledged. There is nothing to return or erase, because ImportKit holds no customer records.

Deletion on request

You do not have to wait for an uninstall. Email privacy@importkit.app from an address associated with the store and we will delete a specific import job and its rows, or all of your data, within [30] days and normally much sooner. Deleting a job removes its stored rows and its results; the credit ledger entry is kept where we need it for financial records.

Retention of records we must keep

Purchase records may be retained for as long as required by tax and accounting law in [State/Country], typically [7] years, even after other data is deleted.

8. Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict or object to our processing of your personal data, to receive a portable copy, and to withdraw consent. Under the GDPR, UK GDPR, CCPA/CPRA and similar laws, exercise any of these by emailing privacy@importkit.app. We will respond within the period the applicable law requires, and within 30 days at the latest.

We do not sell personal information, and we do not share it for cross-context behavioural advertising, as those terms are defined under US state privacy laws. We make no automated decisions with legal effect about anyone.

Where a request concerns data in your store rather than your account — for instance a shopper exercising rights over their own record — the request belongs to you as the controller, and to Shopify as your platform. ImportKit holds no such records to act on.

If you are in the EEA or UK and are unhappy with how we've handled a request, you may complain to your local data protection authority. Our EEA representative, where required, is [EU Representative].

9. Security

All traffic to the app and this site is encrypted in transit with TLS.
Data at rest is encrypted by our database provider.
Every database query is scoped to the store making the request, so one merchant's jobs, rows and credits are not reachable from another's session.
Shopify access tokens are stored only for as long as the app is installed and are deleted on uninstall.
Access to production systems is limited to personnel who need it, and uses multi-factor authentication.
The app requests the narrowest set of scopes that lets it do its job, which is why customer and order access is absent.

No system is perfectly secure. If we become aware of a breach affecting your data, we will notify you and the relevant authorities as the law requires, without undue delay.

10. International transfers

Our infrastructure is located in [Region]. If you are outside that region, your data is transferred there to provide the service. Where the transfer leaves the EEA or UK, it relies on the European Commission's Standard Contractual Clauses or another lawful transfer mechanism, and equivalent terms are in place with the providers listed in section 6.

11. Children

ImportKit is a business tool and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child's data has reached us, contact us and we will delete it.

12. Changes to this policy

We will update this policy as the app changes. The “last updated” date at the top always reflects the current version. Material changes — a new subprocessor, a new category of stored data, a longer retention period — will be announced in the app or by email before they take effect.

13. Contact

[Legal Entity Name]
[Registered Address]
Privacy: privacy@importkit.app
Support: support@importkit.app

See also the Terms of Service, and the permissions reference for exactly what the app can and cannot reach in your store.