Privacy policy: Vinyl Lettering Designer for Shopify
Last updated: 18 October 2026
Who we are
Vinyl Lettering Designer for Shopify ("the app") is offered by Twilper.com (KvK 98440217), Merelstraat 64, 8916 AX Leeuwarden, the Netherlands. Contact: [email protected].
For the personal data of a store's customers, the merchant is the controller and we are the processor. Our data processing agreement (GDPR Article 28) applies to every store that installs the app: https://vinylletteringplugin.com/legal/vinyl-designer-app-dpa.
This page covers the Shopify app only. For this website and the WordPress plugin, see our general privacy policy.
What the app does
The app adds a lettering designer to a product page. A customer designs a sticker or lettering; the app calculates the price, adds the design to the normal Shopify cart and, after checkout, shows the merchant the production files (SVG cut file; PDF print file on the Pro plan) for each order.
Data we process
| Data | Why | Where | How long |
|---|---|---|---|
| Store details: shop domain, store name, contact e-mail, currency, tax setting, primary language, plan | Running the app, billing plan, price display | App database | Until 48 hours after uninstalling (shop/redact) |
| Shopify access token | Calling the Shopify Admin API for this store | App database, encrypted (AES-256-GCM) | Deleted immediately on uninstall |
| Design: texts, font, size, material, colour, quantity, and the generated SVG/PDF files | Price calculation and production files. Design text can contain personal data (for example a name on a sign) | Design service | 31 days if the design is never ordered; 365 days after the order if it is ordered |
| Hashed IP address of the browser that uploaded the design files (one-way keyed hash, never the IP itself). The app also sends its own hashed client IP with the design order, but only when it knows one (requests through the Shopify app proxy carry no customer IP, so normally it does not) | Rate limits against upload and order abuse in the design service | Design service, with the uploaded files | Same as the design files: 31 days, or 365 days after the order |
| Design summary: design text (up to 80 characters, all text layers), material, colour and colour code, size, and whether a PDF file exists | Showing the order and the design in the app | App database | Without an order: the summary is deleted when the design variant is removed (30 days without activity) and the row 60 days after the design was last added to a cart. With an order: 365 days after the last order of that design. The last remaining variant of a carrier product that was set to draft keeps its row (without summary) until shop/redact |
| Order reference: order name and ID, order date, payment/cancellation status, line quantities and prices | Linking order lines to production files, price check | App database | 365 days after the order was received by the app |
Privacy request references (customers/data_request): customer ID and data request ID from Shopify, order IDs, design codes and design-service order IDs | Showing the request to the merchant so they can export the data | App database | 90 days after the request, or 30 days after the merchant marks it as handled (whichever is earlier) |
Erasure jobs (customers/redact, shop/redact): the order IDs to erase | Making sure an erasure is completed, with retries | App database | 30 days after the job is done |
| Hashed client IP address (one-way keyed hash, never the IP itself), only when a request carries a client IP; requests through the Shopify app proxy do not, so normally none is stored | Rate limits against abuse of the storefront endpoints | App database | 2 days |
Raw client IP addresses (X-Forwarded-For) | Only during the one-time setup of a development store, to check the proxy chain; switched off afterwards and never in normal operation | Application log (Railway) | Railway log retention: 30 days on our current Railway plan (Pro); it depends on the Railway plan |
Technical records without personal data are also kept: carrier products that a merchant removed or set to draft themselves ("gone") stay until shop/redact; the status of the daily job is one row for the whole app, without store or customer data.
We do not store the customer's name, e-mail address, phone number or address. The order in the app links to the order in Shopify, where the merchant already has those details. The app only requests protected customer data level 1 (order access without customer fields).
The designer runs in the customer's browser. It does not set cookies and does not use tracking or analytics. It keeps the design in progress and whether the short introduction was shown in the browser's localStorage, so a reload does not lose work; that stays on the customer's device. Fonts are loaded from Google Fonts (fonts.gstatic.com), which receives the visitor's IP address as part of the request.
Application logs contain shop domains and internal IDs, not customer data. One exception: when Shopify rejects a token request, the log keeps up to 300 characters of Shopify's error message.
Sharing
We do not sell data and do not use it for marketing or profiling. Sub-processors:
- Railway (hosting and database of the app and the design service), EU region europe-west4 (Netherlands) for both services.
- Cloudflare (DNS only for the app domain; CDN for the designer files).
- Google Fonts (font files for the designer, loaded by the customer's browser).
- Shopify (the platform the merchant uses).
Privacy requests
customers/data_request: the app lists the orders, design summaries and files it holds for the requested orders in the app, so the merchant can export them and send them to the customer.customers/redact: we delete the order references and design summaries for the requested orders, and the designs and files in the design service. One exception: an identical design that is also part of another customer's order (the app reuses the same design variant) keeps its summary and files for that other order.shop/redact(48 hours after uninstalling): we delete everything we hold for the store, in both services.
Customers can contact the merchant (the controller) about their data. Merchants can contact us at [email protected].
Security
See our security policy: https://vinylletteringplugin.com/security/vinyl-designer-app. Data is transferred over TLS only. Access tokens are encrypted at rest.
Changes
We will update this page when the app changes how it processes data, and change the date at the top.