Privacy Policy

This Privacy Policy explains how Digital Project Design ("DPD", "we", "us", "our") handles information in connection with the Professional Form Manager application (the "App") for Shopify. It applies to merchants who install the App ("Merchants") and their staff, to the people who submit a Merchant's storefront forms ("Respondents"), whose information the App processes on the Merchant's behalf, to the recipients of the App's emails, and to people who contact us about the App. In this policy, "you" means a Merchant, except in section 8.

The App lets a Merchant build storefront forms, collect submissions (including file attachments), optionally render a submission into a PDF, and deliver the result by email to one or more recipients the Merchant chooses.

Our role. For the personal data a Respondent enters into a Merchant's form ("Respondent Data") and for information about a Merchant's staff, DPD acts as a data processor on behalf of the Merchant, who is the data controller. The Merchant decides what fields to collect, who receives the submissions, and how long they are kept. Our Terms of Service and Data Processing Addendum set out our obligations as a processor. Each Merchant is responsible for its own privacy notice to Respondents and for any consent it is required to obtain; this policy describes what the App does so Merchants can make those disclosures accurately. DPD is the controller for its own business records and for support email.

a. Merchant and staff information

• Store identifiers and configuration: your myshopify.com shop domain, App settings, branding/presentation customizations, the PDF templates and logos you upload, and the form definitions you author.
• Recipient addresses: the email addresses you configure to receive form submissions and any auto-reply/notification content you author.
• Store credentials: the access tokens Shopify issues so the App can work with your store.
• Staff sign-in details: when a staff member opens the App, Shopify provides their user ID, name, email address, language, and whether they are the account owner or a collaborator. We keep these to sign them in and greet them. On Pro and Advanced plans, a staff member's user ID and email address are also recorded in the App's activity log when they view, reveal, download, export, resend or delete a submission, or change or publish a form.
• Billing status: the subscription/entitlement state Shopify reports for your store, used to apply plan limits. Billing itself is handled by Shopify; we do not receive payment card details.

b. Respondent information (the data your forms collect)

The App stores the information a Respondent submits through your form. You choose what those fields are, so the categories depend on your form and can include:

• Contact and identity details a Respondent types — for example name, email address, postal address, phone number, company, and any other text, selection, number, or date fields you define.
• A typed signature — where you use a signature field, the App stores the name the Respondent types, the fact that they checked the accompanying agreement box, and the date/time (see the Terms of Service, §7, for what this signature is and is not).
• File attachments the Respondent uploads (for example a document, image, or PDF), stored as files.
• Generated PDFs — where your form produces a PDF, the App renders the submission into a PDF for email delivery and download. The PDF is generated each time it is needed and is not stored.
• Submission metadata — a submission timestamp, the form and form-version submitted, and, where the form collects it, a Respondent email used for confirmation replies and to match data-subject requests.

This is first-party data collected directly through your form. The App requests no Shopify Admin scopes and does not access Shopify "Protected customer data" (your customers' Shopify records). Respondents are storefront visitors submitting a form, not necessarily Shopify customers.

c. Spam protection

Because forms are public to anonymous visitors, the App uses Cloudflare Turnstile and a hidden honeypot field to detect bots. Turnstile runs in the Respondent's browser, and when the form is submitted we check its result with Cloudflare, together with the Respondent's IP address. The App also limits how many submissions can come from one IP address in a short time. We do not build Respondent profiles from this data.

d. Technical logs

Our hosting provider, Cloudflare, logs requests to the App so we can run it, secure it and fix faults. This includes requests from your staff's admin, from Respondents loading and submitting your forms, and from recipients opening download links in the App's emails. A log entry can include:

• the time and the web address requested, which can contain your store's domain, a form's address and Shopify identifiers;
• the requester's IP address, browser details and approximate location;
• error messages.

Technical logs are kept for up to 7 days.

e. Operational telemetry

To find faults and to notice when the App stops working for a store, we keep operational records labeled with the store's myshopify.com domain:

• daily counts, for example of form page requests, errors, uninstalls and privacy requests;
• a limited number of error details: the type of error, the kind of page with identifiers removed, and a shortened, filtered error message.

These records are designed to exclude Respondent Data and have no fields for IP addresses or form answers. We also keep technical traffic statistics (request type, result and response time) with no store label. A daily summary of these records is emailed to DPD, and the records can be viewed on a private DPD dashboard.

f. Support email and business records

If you email us, we receive whatever you send. We also keep business records about each installation, such as the store's name and domain, install and uninstall dates, plan and billing events reported by Shopify, and support history.

g. Information we do not process

We do not collect Respondent browsing/behavioral analytics, marketing or cross-site tracking data, or payment card details.

We use the information above solely to:

• provide and operate the App's form functionality — render forms, accept and store submissions and attachments, optionally generate PDFs, and email submissions to the recipients you configure;
• send the optional submitter confirmation/auto-reply email where you enable it;
• provide the admin tools you use to review submissions (view, mask/reveal sensitive fields, export CSV, resend, and delete), and record those actions in an audit log (Pro and Advanced);
• protect the App against spam and abuse, keep it secure and reliable, find and fix faults, and recover it from data loss;
• apply your plan's limits and bill the App through Shopify;
• support you and answer questions about the App;
• keep business records of installations for our business, accounting and legal purposes;
• meet our legal obligations and respond to Shopify's privacy requests (section 5).

We limit our use of personal data to these purposes, and we use Respondent Data only to provide, secure and support the App and to meet our legal obligations. We do not use Respondent Data for advertising, marketing or profiling. Apart from the technical logs and telemetry in section 1, we use no analytics, advertising or tracking services. We do not sell or rent personal data to anyone.

The App does not perform automated decision-making or profiling that produces legal or similarly significant effects for any individual. A signature field records a typed name and agreement; it does not evaluate or decide anything.

Delivery you direct. When a Respondent submits a form, the App emails the submission — and any generated PDF or file links — to the recipient email addresses you have configured. Those recipients are chosen and controlled by you, not by us.

Service providers. Otherwise, we share information only with the service providers and AI tools described in this section, with our professional advisers as described below, and where required by law.

• Shopify — The platform the App runs on, the source of store and staff sign-in data, and billing — Per Shopify
• Cloudflare — App hosting, databases, file storage, spam protection (Turnstile), technical logs, operational telemetry, backups, sending DPD's internal summary email, and sign-in to DPD's dashboard — Cloudflare global network; see section 7
• Resend — Sending the App's emails (submission notifications, Respondent confirmations, secure download links) — Resend and its providers
• Google (Google Workspace) — DPD's email, including support email and the internal daily summary — Per Google

We use AI tools, including Anthropic's Claude, to develop, operate and troubleshoot the App. In that work they may see technical and store-level information, such as store domains, form definitions, error messages and record IDs. We do not give them the contents of submissions or uploaded files, or the names or contact details of Respondents or Merchant staff, and we have turned off the setting that lets Anthropic train its models on our conversations. What they see can remain in our working records, and with Anthropic under its own terms.

We may share business records with our professional advisers, such as accountants and lawyers, who must keep them confidential. We do not sell personal data, and we do not share personal data for cross-context behavioral advertising.

We retain data only as long as needed to provide the App and as configured by the Merchant:

• Configurable retention. Each form has retention windows for submission records and for file attachments, bounded by your plan (for example, shorter fixed windows on entry plans; longer, merchant-set windows on higher plans). A nightly process deletes records and attachments that have passed their retention window, including the underlying files in Cloudflare R2.
• Minimum-retention floor (Advanced). Where you set a statutory minimum-retention floor on a form, a matching record cannot be deleted before the floor expires; see the erasure handling below.
• Respondent erasure requests. The primary erasure route is a direct request to the Merchant, handled with the App's in-admin delete/erasure tools. The App also processes Shopify's customers/redact request: it matches submissions by Respondent email and erases them. A submission that is under an active minimum-retention floor is restricted (hidden and use-blocked) with deletion automatically queued for the moment the floor expires, rather than being refused (GDPR Art. 17(3)(b)).
• Data access requests. When Shopify sends a customers/data_request, the App records the request in our technical logs with Shopify's request and customer IDs and the number of matching submissions and files, but not the Respondent's email address or any submission content. The App does not send the data to you. To respond to the Respondent, find their submissions in the App's Submissions list, which shows each submitter's email address, and export them. If you need help, contact us at pfm@digitalprojectdesign.com.
• Uninstall. When the App is uninstalled, we delete your staff's sign-in details and the App's access tokens for your store. About 48 hours later Shopify sends a shop/redact request, and within 30 days of that request we delete your store's dedicated database (your forms, submissions and activity logs), the files stored for your store (Respondent uploads, PDF templates and logos), your plan record, the App's technical record of your installation, and the operational telemetry labeled with your store.
• Technical logs: kept by Cloudflare for up to 7 days and then deleted automatically. They are not deleted earlier by a deletion request or uninstall.
• Operational telemetry: kept for about 90 days. Records that mention a store without being labeled with it expire on that schedule, and technical traffic statistics, which carry no store label, expire after three months.
• Backups: every night we back up the App's databases, including the store databases that hold submissions, to private storage in North America, and Cloudflare keeps a 30-day recovery history of each live database. We also keep backup copies of the PDF templates and logos you upload. Deleted data can remain in backups and recovery history for about 30 days before it expires or is removed. Respondent file uploads are not backed up. We use backups only to recover the App from data loss or corruption.
• Email, business records and working records: support emails, internal summaries and working records are kept for as long as we need them to support, operate and fix the App. Our email provider, Resend, keeps a record of each email the App sends for a limited period. Business records are kept after uninstall for our business, accounting and legal purposes.

• Encryption in transit: the App's web addresses use HTTPS, and its connections to Shopify, to its Cloudflare databases and storage, and to Resend use TLS.
• Encryption at rest: Cloudflare encrypts the App's databases, stored files and backups at rest.
• Tenant isolation: each Merchant's data lives in its own dedicated, per-store database, so one Merchant's data is never co-mingled with another's.
• File-upload safety: uploads are checked at two gates — an enforced size/type limit at upload time and a content (magic-byte) check afterward — against an allowlist you configure over an executable denylist we enforce; risky types (e.g. SVG/HTML) are forced to download rather than render.
• Controlled access to submissions: sensitive fields can be masked and are revealed only on demand, with reveal and export actions recorded in an append-only audit log on Pro and Advanced plans; file downloads use signed, expiring links rather than public URLs.
• Access: only DPD, including through the AI tools described in section 4, can reach the App's production systems, logs and backups. DPD's dashboard requires a sign-in limited to DPD staff.
• Least privilege: the App requests no Shopify Admin scopes and holds only the access it needs to run.

No method of transmission or storage is completely secure, but we take reasonable measures to protect the information we process. Our incident-handling process is described in our Security Incident Response Policy.

Information may be processed in countries other than where the Merchant, its staff or its Respondents are located. Each store's database is stored in the Cloudflare region where it was created (currently North America or Europe). Uploaded files, the App's central database and backups are stored in North America. Logs and telemetry are processed on Cloudflare's global network, and emails are sent through Resend. Google and the AI tools in section 4 process information where they operate. DPD is based in the United States and operates the App from there. We rely on our service providers' safeguards for the transfers they carry out.

Depending on where you live, you (or, for Respondent Data, the Merchant on a Respondent's behalf) may have rights to access, correct, delete, or restrict the processing of personal data, and to object to certain processing.

• Respondents: please direct requests to the Merchant whose form you submitted; the Merchant is the controller of your data. The App provides the Merchant with the tools described in section 5 to honor access and deletion requests, and deletion requests sent through Shopify are handled automatically.
• Merchants, Merchant staff, email recipients, and people who contact us: contact us using the details in section 11. For staff details processed for a Merchant, we may refer your request to that Merchant.

The App is a business tool provided to Merchants and is not directed to children. We do not knowingly process the personal data of children. A Merchant is responsible for not configuring forms that solicit personal data from children without a lawful basis.

We may update this policy from time to time. When we do, we will revise the "Last updated" date above and post the new version at the published URL. Material changes will be communicated as required by applicable law.

Digital Project Design (DPD)
Digital Project Design LLC
10441 Chaney Ave, Downey, CA 90241, USA
Privacy/support email: pfm@digitalprojectdesign.com
Website: https://www.digitalprojectdesign.com