Privacy Policy
The short version
- ImportKit only accesses your store to run the imports you ask for. It doesn't request access to your customers or orders.
- The rows of files you upload are stored with each import so you can see results and resume. That includes columns you told the app to ignore, so leave out data you don't need.
- We don't sell data, run ads, use analytics or tracking in the app, or train AI models on your data.
- Uninstall and Shopify asks us to delete all of your store's data, normally 48 hours later. You can ask us to delete it sooner.
- 1. Who we are and what this covers
- 2. Controller and processor
- 3. What we collect
- 4. Personal data in your files
- 5. How we use it, and legal bases
- 6. What we don't do
- 7. Sub-processors and sharing
- 8. International transfers
- 9. Retention and deletion
- 10. Security
- 11. Your rights
- 12. US state privacy notice
- 13. Cookies and the website
- 14. Children
- 15. Changes
- 16. Contact
1. Who we are and what this covers
ImportKit ("ImportKit", "we", "us"). This policy explains how we handle information when you use the ImportKit Shopify app (the "App"), this website, and our support. It should be read with our Terms of Service. Words defined in the Terms have the same meaning here.
ImportKit is a business tool. It is used by merchants, their staff and agencies, not by shoppers.
2. Controller and processor
- Merchant Data (the files you upload and the store data the App reads or writes): you are the controller and we are your processor or service provider. We process it only on your instructions, under the data processing terms in Schedule 1 of the Terms. If an individual asks us about their data in your files, we will refer them to you.
- Account, billing, support and website data (for example your store domain, purchase records and support emails): we are the controller, and this policy explains how we handle it.
3. What we collect
| Category | What, specifically | Source |
|---|---|---|
| Store and access | Your .myshopify.com domain, the access scopes granted, the access and refresh tokens Shopify issues, token expiry, and install and uninstall dates. If Shopify ever provides a staff member's name, email, locale or account-owner status as part of an online session, that is stored with the session. The App doesn't currently request those. |
Shopify, when you install and use the App |
| Import data | For each import: the import type, target (such as a blog or content type), file name and size, column mapping and conflict mode, status, row counts and credits used. For each row: the full row as uploaded, including columns set to Ignore or left unmapped, its outcome, the Shopify ID of anything created, and any error or warning message. | You, when you upload a file and run an import |
| Uploaded files | Larger uploads may be held briefly as a file in cloud storage (or temporary server storage) while they are read into the import, then deleted. Smaller uploads are read directly. | You |
| Store data read during an import | The records needed to check and complete an import, such as existing definitions, handles, SKUs and IDs. These are read at the time and are not copied into our database, except the Shopify IDs recorded against each row. | Shopify, via the access you granted |
| Billing | Credit purchases, deductions and returns, with amounts, dates, descriptions and Shopify charge IDs. We never receive card or bank details. | Shopify and the App |
| Support | Your name, email address and anything you choose to tell us or attach when you contact us. | You |
| Technical logs | Server logs containing your store domain, job IDs, timestamps and error details. Error details can occasionally include a value from your file, for example when Shopify rejects a cell. Our hosting provider may also log IP addresses and request details. | Automatically |
ImportKit does not request Shopify access to customers, orders, draft orders, gift cards or purchase options, so it cannot read that data from your store. The full list of scopes and what each is for is in the permissions reference.
4. Personal data in your files
ImportKit doesn't need personal data to work, but files are yours and may contain it, for example an author's name on a blog article, a staff name in a metaobject entry, or a customer email typed into a reference column. Anything in an uploaded row is stored with the import, as described above, until it's deleted.
- Only upload personal data you have a lawful basis to process.
- Remove columns you don't need from the file before uploading. Setting a column to Ignore stops it reaching Shopify, but it is still stored with the import.
- Don't upload special category data (such as health information) or payment card data.
- You can ask us to delete an import, or everything for your store, at any time (section 9).
5. How we use it, and legal bases
| Purpose | Data | Legal basis (EEA/UK) |
|---|---|---|
| Running pre-import checks and imports, showing results, and letting you resume or re-run imports | Store and access, import data, uploaded files | Performance of our contract with you. For Merchant Data, your instructions as controller |
| Selling credits and keeping your balance accurate | Billing, store | Performance of contract |
| Answering support requests | Support, and import data you ask us to look at | Performance of contract, and our legitimate interest in helping you |
| Keeping the Service secure, preventing abuse and fixing faults | Technical logs, store, import data where needed | Legitimate interests in operating a secure, working service |
| Meeting legal, tax and accounting obligations, and enforcing our Terms | Billing, support, store | Legal obligation, and legitimate interests |
| Telling you about material changes to the Service, these policies or your account | Contact details you've given us | Performance of contract, and legitimate interests |
6. What we don't do
- We don't sell personal information, or share it for cross-context behavioural advertising.
- We don't use analytics, advertising, session-recording or tracking tools in the App.
- We don't use your data to train artificial intelligence or machine learning models.
- We don't make decisions with legal or similarly significant effects about anyone by automated means.
- We don't send marketing emails without your consent.
7. Sub-processors and sharing
We use a short list of providers to run the Service:
| Provider | Purpose | Location |
|---|---|---|
| Shopify Inc. and affiliates | Your store platform, the source and destination of imported data, and billing for credit purchases | Per Shopify's privacy policy |
| Cloud hosting provider | Runs the App and its background import worker, and holds server logs | Provider data centres |
| Database hosting provider | Hosts the database holding the records in section 3 | Provider data centres |
| Cloud storage provider (larger uploads only) | Holds larger uploaded files briefly while they are read | Provider data centres |
| Email provider | Sending and receiving support email | Provider data centres |
| Google LLC (Google Fonts) | Serves the fonts used on this website. Your browser requests them from Google, which receives your IP address | United States and other locations |
We may also disclose information:
- to professional advisers, such as lawyers and accountants, under confidentiality;
- where required by law, court order or a valid request from a public authority, and where lawful we will tell you first;
- to protect the rights, property or safety of ImportKit, our users or others; and
- to a buyer or successor in a merger, acquisition or sale of assets, subject to this policy.
We will update the list above, and notify merchants as set out in the Terms, before adding a new sub-processor.
8. International transfers
Our providers may process data in countries other than your own. Where personal data from the EEA, UK or Switzerland is transferred to a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or another lawful mechanism. You can ask us for a copy of the relevant safeguards.
9. Retention and deletion
| Data | Kept until |
|---|---|
| Shopify session and access tokens | Deleted as soon as you uninstall the App |
| Import jobs and stored rows | While the App is installed, so you can review and resume imports. Deleted on your request, or when we act on Shopify's shop redaction request after uninstall |
| Uploaded files in storage | Deleted once the file has been read into the import, or if the upload or import fails. Incomplete uploads are cleaned up within 7 days |
| Credit balance and billing records | Until Shopify's shop redaction request after uninstall. Shopify keeps its own record of charges on your Shopify bill |
| Support emails | 24 months after the conversation ends, unless needed for a legal claim |
| Server logs | 30 days |
When you uninstall
Shopify tells us immediately, and we delete your store's sessions and access tokens, so the App can no longer reach your store. Shopify then sends a shop redaction request, normally 48 hours later. When we act on it, we delete everything we hold for the store: import jobs and rows, stored files, credit balance, billing records and the store record. This can't be undone, and unused credits are lost.
Customer data requests from Shopify
Shopify may forward requests from your customers to see or erase their data. ImportKit doesn't keep customer records of its own. Because uploaded rows can contain whatever you put in them, when we receive such a request we will search the store's import data for the customer's identifiers and delete or return matching rows within 30 days.
Deleting sooner
Email legal@importkitapp.com from an address associated with the store, or from the store owner, and tell us whether you want a specific import or everything deleted. We will confirm when it's done, within 30 days and usually much sooner. Backups, if any, are overwritten within 30 days.
10. Security
- Traffic to the App and this website is encrypted in transit using TLS.
- Every request in the App is authenticated through Shopify, and all data queries are scoped to the store making the request.
- The App requests the narrowest set of Shopify permissions it needs, which is why customer and order access is absent.
- Access to production systems is limited to people who need it.
No system is perfectly secure. If we become aware of a breach affecting personal data we hold, we will notify affected merchants and authorities as the law requires, and without undue delay.
11. Your rights
Depending on where you are, you may have the right to access, correct, delete, restrict or object to our processing of your personal data, to receive a copy in a portable format, and to withdraw consent where we rely on it. To exercise any of these, email legal@importkitapp.com. We will respond within the time the law requires, and within 30 days at the latest in most cases. We may need to verify your identity first, and we won't treat you differently for exercising your rights.
Where your request concerns Merchant Data, such as your details inside a merchant's import file, please contact that merchant, who is the controller. We will help them respond.
If you are in the EEA, UK or Switzerland, you can complain to your local data protection authority. We would appreciate the chance to resolve your concern first.
12. US state privacy notice
This section supplements the policy for residents of California and other US states with comprehensive privacy laws. In the last 12 months we have collected these categories of personal information, for the purposes in section 5:
- Identifiers: store domain, email address and name (if you contact us), IP address (in server logs).
- Commercial information: records of credit purchases.
- Internet or network activity: server logs of your use of the App.
- Other information you choose to upload in import files, which we process as a service provider for the merchant.
We disclose these only to the providers in section 7, for business purposes. We do not sell or share personal information, and have not done so in the last 12 months. We do not use or disclose sensitive personal information for purposes that would give a right to limit it. You can use an authorised agent to make a request, and we may ask them to prove their authority. If we decline a request, you can appeal by replying to our decision. Retention periods are in section 9.
13. Cookies and the website
This website sets no cookies and uses no analytics or advertising scripts. It loads fonts from Google Fonts, which means your browser sends Google your IP address and standard request information. Our hosting provider may keep standard access logs.
The App sets no cookies of its own. It runs inside the Shopify admin, which uses its own cookies under Shopify's privacy policy, and it loads a font and images from Shopify's content delivery network.
14. Children
The Service is for businesses and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child's data has reached us, contact us and we will delete it.
15. Changes
We will update this policy when the Service or the law changes, and change the "last updated" date. For material changes, such as a new category of data, a new sub-processor or a longer retention period, we will give notice in the App or by email before they take effect.
16. Contact
Privacy: legal@importkitapp.com
Support: support@importkitapp.com