Brightshelf Catalog Backup privacy policy

Last updated 21 October 2026.

Brightshelf Catalog Backup ("Catalog Backup") is a Shopify app operated by Niv Goldner, Shoshana Damari St 2, Kfar Saba 4464701, Israel ("we"). Contact: hello@brightshelfapps.com.

Who this covers

Merchants who install Catalog Backup. The app backs up a store's product catalog so the merchant can see what changed and undo it. It doesn't handle shopper or customer data.

Roles

For the store data the app backs up, the merchant is the controller and we are the processor: we process it only on the merchant's behalf, to provide the backups and restores the merchant asks for, under Shopify's terms that govern apps on its platform (the Shopify Partner Program Agreement and API terms).

Access the app asks Shopify for

• read_products, write_products: to back up products, variants, images, metafields and collections, and to write them back when you ask for a restore.
• read_inventory, write_inventory: to back up inventory settings and stock counts per location, and to restore them when you choose to.
• read_publications, write_publications: to back up and restore which sales channels a product is published to.
• read_locations: to show location names when you preview a stock restore.

The app doesn't request access to customers, orders, payments or staff accounts. It writes to your store only when you start a restore.

What the app stores

• Catalog backups: versions of your products (title, description, handle, vendor, type, status, tags, SEO fields, category, template, options, variants with prices, SKUs, barcodes, tax and inventory settings, product and variant metafields, and sales channels) and collections (title, description, conditions or selected products, and sort order). A new version is saved when something changes.
• Nightly stock counts: once a night, the available count of each variant at each location, with the product's ID and title. They're kept separately from the version history, for 7 days on Free and 14 days on paid plans, so a restore can offer the counts from the night before (restoring stock is optional), and so the app can point out unusual overnight jumps.
• Copies of your product image files, downloaded from Shopify's file servers, and an index of which image each copy belongs to.
• Your shop's myshopify.com domain, install and uninstall dates, the access granted to the app, and whether the app's connection to your store is working.
• The access token and refresh token Shopify issues to the app. They are stored encrypted (AES-256-GCM), with the key kept separately as a secret on our hosting provider.
• A webhook log: for each change notification Shopify sends, the topic (for example "product updated"), the product or collection ID, when it was sent and received, Shopify's delivery IDs and API version, and a hash of the payload. The notification body itself isn't stored. Changes waiting to be backed up are kept in a short queue (item ID and time).

The app doesn't store staff names or email addresses, and it doesn't store IP addresses.

Where data is kept

The app and its database run on Fly.io servers in the United States (Ashburn, Virginia), on an encrypted storage volume. Copies are kept in a private Cloudflare R2 bucket (Eastern North America): database backups are replicated continuously; product images are copied when a backup runs. Data is sent over HTTPS. During a restore, the app uploads the saved image copies to Shopify over HTTPS. Image copies are never public: any download link the app creates for one is signed and expires within 15 minutes. Access to the server is limited to the developer.

Subprocessors

• Fly.io, Inc. (United States): hosting, database and storage, under a data processing agreement.
• Cloudflare, Inc. (United States): storage for image copies and backups of the app's database (R2, Eastern North America).

International transfers

Data is stored in the United States. Fly.io is certified under the EU-U.S. Data Privacy Framework, the UK Extension to it and the Swiss-U.S. Data Privacy Framework, which we rely on for transfers of personal data from the EU, the UK and Switzerland to the United States. Cloudflare is certified under the EU-U.S. Data Privacy Framework, the UK Extension to it and the Swiss-U.S. Data Privacy Framework, which we rely on for transfers of personal data from the EU, the UK and Switzerland to the United States. Cloudflare's Data Processing Addendum also includes the EU Standard Contractual Clauses (with the UK Addendum and Swiss terms), which apply if that certification lapses.

Sharing

We don't sell your data or share it except with the hosting providers listed here. We don't use it for advertising.

Retention and deletion

• While the app is installed, history is kept for your plan's period (7 days on Free, 1 year on paid plans). The latest version of each item is always kept. Nightly stock counts are kept for 7 days on Free and 14 days on paid plans.
• When you uninstall, the app deletes its access token right away and stops backing up. About 48 hours later Shopify sends a deletion request (shop/redact) and the app deletes everything it stored for your shop: backups, image copies, tokens, the webhook log, the queue and your shop record.
• Our hosting provider takes daily snapshots of the storage volume, kept for 5 days. Deleted data can remain in those snapshots for up to 5 days after deletion, and then it's gone.
• Database backups in Cloudflare R2 are kept for 7 days. Deleted data can remain in them for up to 7 days after deletion, and then it's gone.
• Customer data requests and customer erasure requests (customers/data_request, customers/redact) are acknowledged. The app holds no customer data, so there is nothing to return or erase.

Your rights

You can ask us to access, correct, delete or restrict the data we hold about your shop, or object to its processing, by emailing hello@brightshelfapps.com. We reply within 30 days. You can also complain to your local data protection authority.

Changes

If this policy changes, we'll update this page and the date above.