Tikkivo Catalog Sync privacy policy

Effective date: 6 October 2026.

Operator and contact

Tikkivo Catalog Sync is operated by Arturas Gotceitas, Įgulos g. 7-2, Šakių km., Kauno raj., Lietuva (Lithuania). For privacy requests and support, email arthugot@gmail.com.

Scope and responsibilities

This policy covers the Shopify app, its public information pages and support communications. Merchants decide which catalog and supplier information to submit. We process that information on their instructions to deliver the service and act as their processor where data protection law applies. We act as controller for necessary service administration, security and our own support correspondence. Merchants remain responsible for a lawful basis for information they provide. Contact us if your use requires additional data processing terms.

Information we process

• Store domain, installation records, Shopify session and access credentials, granted permissions and inventory location identifiers.
• Product and variant identifiers, SKUs, barcodes, descriptions, prices, inventory, image references, categories and mapped metafields.
• Supplier URLs, optional connection credentials, uploaded source files, mappings, schedules, approved change plans, results and evidence needed to resolve uncertain writes.
• Plan usage and subscription verification state. Shopify handles billing approval and payment; we do not collect payment card details.
• Necessary technical logs and webhook metadata, and information you voluntarily include in support messages.

The app does not request Shopify customer or order records. Do not submit customer lists, payment information or unnecessary personal or sensitive data. Catalog files and support messages may nevertheless contain information supplied by a merchant.

Purposes and legal bases

We use information to authenticate stores, fetch authorized feeds, map and preview products, apply approved changes or explicitly enabled scheduled updates, verify results, enforce plan limits, provide reports and support, prevent unsafe repeated writes, maintain security and handle Shopify lifecycle and privacy requests.

Where GDPR applies, our necessary service administration relies on performance of the service agreement; security and abuse prevention rely on our legitimate interests in protecting the service and its users; required statutory records and disclosures rely on legal obligations. Processing on a merchant's behalf follows the merchant's lawful instructions. We do not enroll merchants in marketing campaigns through this app or sell their information.

Providers and connections

• Shopify: store authorization, embedded administration, catalog operations, subscription approval and billing. Shopify may fetch mapped image URLs to process product media. Its services follow its own terms and privacy notices.
• Heroku (Salesforce): app hosting and Heroku Postgres Essential-0 database hosting. The app is deployed in Heroku's EU region.
• Bucketeer and Amazon Web Services: private, encrypted uploaded artifacts are stored in Amazon S3 in eu-west-1 (Ireland), provisioned through Bucketeer.
• Configured suppliers: requests are sent to the feed or API you authorize, including any credentials required for that connection. Their processing is governed by their own arrangements with you.
• Support email: messages sent to our published Gmail address are handled through Google's email service. Do not send passwords, access tokens or confidential source files unless a suitable secure transfer has been arranged.

We disclose information only as needed to provide the service, follow lawful instructions, comply with law or protect the service and its users. EU hosting does not mean all vendor processing stays within the EEA: provider operations and support, Shopify and support email may involve other countries under the relevant providers' terms. We do not claim that every processing location is in the EU or that a particular international-transfer safeguard has been independently verified. Contact us for current provider and transfer information relevant to your use.

Retention and deletion

• Uploaded source files become eligible for deletion after seven days; affected sources are paused and need a fresh upload. Raw remote feed response bodies are discarded after processing.
• Resolved detailed run reports become eligible for deletion after 30 days; minimal run totals remain for up to 90 days. Ordinary webhook receipts become eligible for deletion after 30 days.
• Unresolved write evidence remains until resolution or shop redaction so uncertain Shopify writes are not blindly repeated. Pending shop-redaction requests remain until processed.
• Mappings, settings, linked-variant history and current catalog snapshots remain while installed. Refreshes replace prior snapshots.
• Uninstall disables automation, pauses sources and removes supplier connection credentials and Shopify sessions. Shopify shop-redaction requests queue deletion of shop records and encrypted uploads, with checks to protect a newer installation.
• Support correspondence is retained for up to 90 days after resolution unless a legal obligation, security investigation or legal claim requires longer retention.

Application deletion is performed by maintenance jobs and may be delayed by outages, pending work or unresolved writes. Daily database backups are scheduled for 02:00 Europe/Vilnius. Backup copies follow the provider's retention and rotation schedules; deletion from the live database does not immediately erase existing backups, which roll off through provider rotation. Contact us for the current backup schedule and retention information. Backups are not a merchant-facing product rollback service, and restoration has not yet been validated as of this policy's effective date. Records required by law may be kept for the required period.

Security

The app encrypts supplier connection credentials and uploaded artifacts, restricts processing by shop, verifies Shopify webhook signatures and checks authorization for changes. The artifact bucket is private. Not every database field is encrypted by the application. We do not claim a security certification, guaranteed uptime or absolute protection against incidents.

Your choices and rights

You can pause sources, cancel remaining work and uninstall the app. These actions do not reverse catalog changes already applied to Shopify. Email us to request access, correction, deletion, restriction or a copy of applicable information, or to object to processing based on legitimate interests. Portability and withdrawal of consent apply where the law provides them. We verify the requester's authority and respond within applicable legal deadlines. For data controlled by a merchant, contact that merchant; we can assist on its instructions. You may complain to a competent supervisory authority, including Lithuania's State Data Protection Inspectorate.

Cookies, analytics and children

The app uses necessary Shopify authentication and service functionality. We add no optional analytics, advertising pixel or marketing tracking to the app or these information pages. Shopify's own services follow Shopify's policies. The service is intended for merchants and authorized business users, not children.

Changes

We will update the effective date when this policy changes and provide notice of material changes where required.