Privacy policy
Wallprint is a Shopify app that lets merchants sell wallpaper (or any product sold by the square metre) to the customer's exact dimensions. This policy describes the data the app processes on behalf of the merchants who install it, why, for how long, and the rights attached to it.
1. Publisher and controller
Wallprint is published by Sylvain Dienst, sole trader established in France.
Contact for any question about data: sylvain.dienst@gmail.com.
The merchant who installs Wallprint remains the controller of their own customers' data. Wallprint acts as a processor for the order data described below.
2. Data processed
Configuration data (quotes): wall width and height, chosen material, position of the pattern crop (relative coordinates), mirror and repeat options, computed price and currency, the id of the temporary variant created in the store, and the crop preview image (an excerpt of the pattern supplied by the merchant).
Order data: id, name (e.g. #1001) and date of the Shopify order, ids and quantities of the line items concerned, and the generated production file (dimensions, strips, margins, scale, cutting plan).
Store data: store domain, currency, admin language, subscribed plan and the Shopify API access token (an “offline” token, required for the app to work).
No identifying data about the end customer is read or retained: no name, no email address, no postal address, no phone number. The app's requests to Shopify do not ask for these fields, and the part of the webhook payload that contains them is neither stored nor logged.
IP address: the IP address of the visitor using the configurator is used only to limit the number of quote requests (abuse protection). It is counted in memory and never written to the database or to logs.
The app sets no cookies and stores no identifying data locally on the online store.
3. Purposes
Compute the price of a made-to-measure product from the merchant's settings and create, in the store, the temporary variant at the exact price that makes adding to cart possible.
Link each custom order line to its configuration, generate the production file (JSON and SVG) for the merchant's workshop, and annotate the Shopify order (“wallprint” tag and production summary).
Manage the merchant's subscription through Shopify billing and answer their support requests.
No other use: no audience analytics, no profiling, no marketing, no resale or sharing of data.
4. Legal basis
Processing is necessary for the performance of the contract entered into with the merchant when installing the app (Article 6(1)(b) GDPR): without this data the configurator, the add-to-cart at the exact price and the production file cannot work.
This policy and the terms of service describe the subject matter, duration, nature and purpose of the processing, as well as Wallprint's obligations as a processor; together they serve as the data processing agreement between the merchant and Wallprint (Article 28 GDPR).
5. Hosting and location
Data is hosted on a server located in France (European Union), administered by the publisher. The database is not exposed to the Internet: it is reachable only from the application.
Wallprint performs no transfer of data to a country outside the European Union. Exchanges with Shopify are governed by Shopify's terms and privacy policy.
6. Sub-processors and recipients
Wallprint uses no sub-processor with access to configuration or order data. The only data that leaves the app is what is sent to the Shopify API of the merchant's own store (temporary variant, preview image, tag and summary on the order).
The publisher (a single person) is the only one with access to the infrastructure, by SSH key.
7. Retention periods
Unordered quotes: the temporary variant and the preview image are automatically deleted from the store 7 days after the quote is created. The quote record (dimensions, material, crop, price — with no personal identifier) is kept in the app, for the merchant's statistics, until the store is purged.
Order lines and production files: kept for 24 months (730 days) after creation, so the merchant can re-download the production file; they are then deleted automatically, together with the linked quote and its preview image.
Uninstalling the app: the store's access token is deleted immediately. The other store data (materials, configured products, quotes, order lines) is kept for 48 hours, so that a merchant who reinstalls the app finds their settings again, then fully erased upon receipt of Shopify's “shop/redact” notification.
Customer erasure request (“customers/redact” sent by Shopify): the order lines and quotes attached to the orders listed by Shopify are deleted. Access request (“customers/data_request”): as Wallprint holds no personal data about the customer, there is nothing to provide; the request is logged (number of lines concerned only).
8. Your rights
End customers: the rights of access, rectification, erasure, restriction and objection are exercised with the merchant, as controller, who has Shopify's tools to relay them to Wallprint. Wallprint handles these requests automatically (see section 7).
Merchants: you can review the retained data at any time in the app's Orders screen, have it deleted by uninstalling the app, or write to us at the address below. You also have the right to lodge a complaint with the French supervisory authority, the CNIL (www.cnil.fr), or your local authority.
9. Security
All communications (app admin, configurator, webhooks, calls to the Shopify API) are encrypted over HTTPS (TLS). Requests coming from Shopify are verified by signature (HMAC) before any processing.
The database is not exposed on the network and sits on an encrypted volume. The app's logs contain only the store domain, the order name and counters, never personal data.
10. Contact and updates
For any question about this policy or your data: sylvain.dienst@gmail.com.
This policy may be updated as the app evolves; the date of the last update is shown at the top of the page. The version in force is the one published at this address.