Delink Privacy Policy

Last updated September 14, 2026 · Dhavira LLC, a North Carolina limited liability company · https://storeapp.getdelink.com

1. Who we are

Delink is a product of Dhavira LLC. This Privacy Policy describes how we handle information when you install and use the embedded Shopify app.

2. What we collect

Shop and account data — shop domain, Shopify shop ID, shop contact email from Shopify Admin (used for operational emails, including a daily summary of open GDPR requests), offline access token (stored to call Shopify APIs and receive webhooks), subscription identifiers from Shopify Billing, and consent records for Terms and DPA versions. We request Shopify's read_customers permission so Shopify can deliver mandatory customer privacy webhooks to Delink. We do not use that permission to browse, export, or contact your customer list.

Compliance event metadata — operational records when Shopify sends mandatory webhooks, or when a logged-in shopper submits a deletion request in customer accounts. This is not a copy of webhook bodies or a full export of your customers' personal data.

Service and device data — session identifiers needed for Shopify OAuth and embedded Admin sessions, IP address and request metadata, security events, support communications, and diagnostic logs. Sources include you, Shopify webhook deliveries, Shopify Billing, and ordinary use of the Service.

3. What we do not store

We do not persist at rest:

• raw compliance webhook JSON bodies;
• customer names, emails, phones, or mailing addresses from webhooks; or
• order line items or other payload copies.

Webhook payloads are processed transiently in memory to verify the signature and extract the metadata listed below, then discarded. Failed verification does not create a durable compliance record.

4. What we store

For each shop and compliance event, we may store:

• Shop: domain, Shopify shop ID, shop contact email, install time, offline token;
• Billing: Shopify subscription ID, plan status, Terms/DPA version accepted;
• Event metadata: topic, shop domain, received and workflow due times, workflow status, request source (Shopify webhook or customer-account intake);
• Shopify resource IDs (when present): opaque identifiers such as shop_id, customer.id, and orders_to_redact;
• Subject hash (optional): salted one-way token derived from a customer email or shop identifier during in-flight processing; and
• Application event log: technical actions with timestamps. It is not cryptographically immutable.

Under laws such as GDPR, some metadata we store — for example shop domain, opaque Shopify resource IDs, or a salted one-way hash derived from a customer email — may still qualify as personal data even though we do not store contact details at rest.

5. Our roles

For shop contact email, billing, support, and security information, Dhavira LLC generally acts as a controller or business deciding why and how that information is used. For Customer Personal Data contained in compliance events and processed under your instructions, we act as a processor, service provider, or contractor. Our DPA governs that processing. Your privacy notice, not this policy, primarily governs your customers' relationship with your store.

6. Purposes and legal bases

We process information to:

• provide webhook ingest, event records, exports, daily request-summary emails, support, and Shopify Billing (performance of a contract);
• secure, troubleshoot, and monitor the Service; prevent fraud and abuse; and communicate service information (legitimate interests in operating a reliable B2B service);
• maintain tax, transaction, consent, and compliance records (legal obligations); and
• process Customer Personal Data on documented merchant instructions (you determine the applicable legal basis).

We do not use compliance event metadata for advertising, sell personal information for money, share it for cross-context behavioral advertising, or use it to make decisions producing legal or similarly significant effects about individuals.

7. Recipients and subprocessors

We disclose information only as needed to operate the Service: to personnel and contractors with a need to know; providers for hosting and infrastructure (currently Google Cloud); Shopify, which authenticates the app, delivers webhooks, and bills application charges; professional advisers; and authorities when reasonably necessary to comply with law. Some providers, such as Shopify for billing, may also act as independent controllers under their own notices. We provide at least 30 days' notice before an intended subprocessor addition or replacement that materially changes how we process Customer Personal Data. Where a processor agreement is required, our DPA applies when you accept it at subscribe.

8. Retention

Compliance events remain visible through 90 days after the workflow due date, then are hidden and queued for deletion by the weekly retention job. Actual deletion can occur on the next successful job run. If your subscription ends, paid features are locked and event data is scheduled for deletion after a 30-day resubscription period. Test events may be deleted sooner.

• shop registration data: while the app is installed, then as reasonably needed for closure, disputes, security, and legal obligations;
• billing and tax records: generally up to seven years or the period required by applicable law;
• Shopify OAuth sessions: until uninstall, expiry, or routine cleanup;
• consent records: for the life of the agreement and applicable limitation period;
• support records: until the issue is closed and then as needed for follow-up or legal requirements; and
• security and diagnostic records: for the shortest period reasonably needed to detect and prevent incidents.

9. Cookies and security

The embedded app uses Shopify session tokens rather than third-party cookies for authentication. Shopify Admin iframe parameters (shop, host, embedded) may be kept in browser session storage so in-app navigation stays inside Admin. We do not use advertising cookies.

We use safeguards designed for the nature of the Service, including TLS in transit, access controls, secret management, encryption at rest where supported, logging, and data minimization. No method is completely secure. Notify us promptly of suspected compromise.

10. Your privacy rights

Depending on law and context, you may ask to access, know, correct, delete, restrict, or obtain a portable copy of personal data about you; object to or withdraw consent for certain processing; or appeal our response. You may also complain to your local privacy regulator. We do not discriminate for exercising a privacy right.

Submit a request to support@getdelink.com. We may verify your identity and authority. For personal data we hold as a controller, you may use these rights regardless of where you are located. If your request concerns an end customer of your store, handle it in Shopify first; when we act as processor, we refer the request to you and assist as required by the DPA. End-customer requests must be fulfilled by you — Delink does not hold end-customer contact information from webhooks.

11. United States state disclosures

In the preceding 12 months, we have collected the categories described in §§2–4, including identifiers, commercial/account information, internet or electronic activity, and professional information you provide. We do not knowingly sell or share personal information, including information of people under 16, for cross-context behavioral advertising. We do not use or disclose sensitive personal information to infer characteristics about individuals. We act as a service provider or contractor for Customer Personal Data.

12. Service availability and international transfers

The Service is offered only to businesses based in the United States, Canada (outside Quebec), Australia, Singapore, New Zealand, Israel, and India. Businesses based in Quebec, the European Economic Area, the United Kingdom, or Switzerland may not subscribe. The Service is operated from the United States. If you access Delink from an available market, information may still be transferred to and processed in the U.S. and other countries where our providers operate. Restricted EEA, UK, or Swiss transfers that require contractual safeguards are not part of the standard Service. Contact us if you need a completed transfer addendum as described in the DPA.

13. Children and policy changes

The Service is for business users and is not directed to children. We do not knowingly collect account data from anyone under 18. We may update this policy; material changes are posted here with a new effective date. We will request consent or acknowledgment when required for a new use.

14. Contact

Privacy Lead, Dhavira LLC — privacy questions, complaints, and rights requests: support@getdelink.com.