Legal

Privacy Policy

This policy explains what personal data the TraceOps app processes when it is installed on a Shopify store, how and why we process it, how long we keep it, and how it is deleted.

Last updated: 2026-11-10 · Applies to the TraceOps Shopify app and the pages under traceops.dilight.website.

1. Who we are

TraceOps is operated by DiLight Entertainment UG (haftungsbeschränkt) ("TraceOps", "we", "us"). For questions about this policy or about the data we process, contact us at privacy@dilight.website.

When TraceOps is installed on a merchant's Shopify store, the merchant is the data controller for the store's data, and TraceOps acts as a data processor on the merchant's behalf, processing store data only to provide the app's traceability features. For our own account and billing records, we act as the controller.

TraceOps does not store or read customer personal data. We never request customer names, email addresses, phone numbers, addresses or customer profiles, and the app does not use Shopify's protected customer data.

2. Data we process

TraceOps adds lot, batch and serial-level traceability to a Shopify store. It reads store data from Shopify on demand (per request, using the merchant's session) rather than keeping a background copy, and it persistently stores only the trace records it creates plus a small cache needed to render public pages. The data involved:

  • Store & account data — your .myshopify.com domain, the OAuth access token issued at install (stored encrypted and never shown to us in plain text in the UI), your locations, plan and billing status, and your trace configuration (which products are traced, how sold units are assigned, and per-product exposure settings for public pages).
  • Product & inventory data — product and variant details (title, SKU, image) and per-location inventory levels are read live from Shopify when you use the app; they are not synced into a background datastore. A small cache of product titles and image URLs is kept so public trace pages can render without a live call. TraceOps stores its own lot/batch records (quantities, expiry, supplier/origin) and serial numbers, and keeps a per-lot inventory ledger that it compares against live Shopify totals to flag drift. Only when the merchant explicitly chooses "Fix shop" on a drift item does TraceOps write an on-hand quantity correction back to Shopify (write_inventory). It writes trace metadata (metafields) to your products (write_products).
  • Order & fulfilment data — only the order ID and order name/number, line items (product/variant, SKU, title, quantity), fulfilment status and order date are read on demand and are delivered through the order-paid and fulfilment webhooks, so each sold line item can be assigned to the lot or serial it came from and updated when the order ships. The full webhook payloads are discarded after processing; the webhook log keeps only the webhook ID, topic, shop, time and result. An inventory-levels webhook is used only to refresh the drift comparison.
  • Customer data — none. The recall center works from order names and line items alone: it lists the affected orders, lots and units and exports them (order name and units) so the merchant can look the orders up in the Shopify admin and contact the affected customers there. Customer names, emails and other personal fields are neither requested from Shopify nor stored.
  • Scan telemetry — when a public trace/verify QR page is scanned, we store the scan event with a salted hash of the IP address and user-agent for anti-counterfeit detection; we never store the raw IP or user-agent.

We do not process payment card details. Access to store data is limited to the Shopify scopes granted at install (read_fulfillments, read_inventory, write_inventory, read_locations, read_orders, read_products, write_products). TraceOps does not request customer access (no read_customers).

3. How we use data

  • Create and manage lots, batches and serial numbers, and assign sold units to them (FEFO/FIFO).
  • Shadow Shopify inventory per lot and flag drift for the merchant.
  • Serve public provenance and authenticity-verify pages for a scanned lot or serial — exposing only a whitelisted set of trace events, never order payloads or any customer data.
  • Detect suspicious scan patterns to help identify counterfeiting.
  • Power the recall center: compute the affected orders (by order name), lots and units for selected lots and let the merchant export that list (CSV). The merchant contacts customers from the Shopify admin.
  • Operate billing, enforce plan limits, and provide support.

4. Legal basis (GDPR)

Where the GDPR applies, we process data on the basis of performance of a contract (Art. 6(1)(b)) with the merchant and our legitimate interest (Art. 6(1)(f)) in providing, securing and protecting the integrity of the service (including anti-counterfeit scan detection). Because TraceOps holds no customer personal data, the merchant's own privacy policy and legal basis govern all customer data in Shopify.

5. Sharing & sub-processors

We do not sell personal data. We share data only with the providers needed to run the service:

  • Shopify — the platform the app is installed on and the source of product, order, inventory and store data.
  • Our hosting/infrastructure provider — to host the application and its database.

Recall exports (CSV) are generated only when a merchant triggers them and are delivered to that merchant; they contain order names, units and dates only and no customer personal data.

6. Data retention

We keep store data only for as long as it is needed to provide the service to the merchant. Trace records (lots, serials, assignments, trace events, scans and recalls) are retained while the app is installed so the store's traceability history stays intact. When the app is uninstalled, or on a Shopify shop/redact request, we purge the store's data as described below. Aggregated, non-identifying statistics may be kept longer.

7. GDPR / data-deletion requests

TraceOps implements Shopify's mandatory compliance webhooks (verified by HMAC signature before any action):

  • customers/data_request — acknowledged. TraceOps holds no customer personal data, so there is nothing to return; the merchant (the controller) answers requests from Shopify.
  • customers/redact — acknowledged. There is no customer personal data to erase; as a safeguard, any email address left in a recall record created by an earlier app version is also removed.
  • shop/redact — sent by Shopify roughly 48 hours after uninstall, we purge all of the store's data (trace configuration, lots, serials, trace events, assignments, scans, recalls, inventory shadow, cached product titles/images, synced order and sync records, webhook logs, compliance request records and billing records) and revoke the stored install.

Store customers should direct data-subject requests to the merchant (the controller). Merchants can reach us at privacy@dilight.website for assistance.

8. Security

The app uses Shopify's OAuth for install and stores access tokens encrypted. Inbound webhooks are verified with HMAC signatures, and public App Proxy pages are verified with a signed request check. Public trace pages are read-only, exposure-gated per product, rate-limited and served with a strict content-security policy. Scan telemetry is stored only as salted hashes, all reads and writes are scoped to the individual store, and all traffic is served over TLS.

9. Cookies

The embedded admin relies on Shopify App Bridge session tokens rather than tracking cookies. These marketing pages may set a small preference cookie to remember your chosen language. We do not use advertising cookies.

10. Changes to this policy

We may update this policy as the app evolves. Material changes will be reflected on this page with a new "Last updated" date.

11. Contact

DiLight Entertainment UG (haftungsbeschränkt) · privacy@dilight.website · dilight.website

← Back to TraceOps