Privacy Policy
Last updated: March 2026
Granted Assets (“we”, “our”, or “us”) helps Shopify merchants deliver digital products to their customers. This Privacy Policy explains what data we collect, how we use it, and how it is handled.
What We Collect
Merchant (Store) Data
We collect store information such as your shop domain, app settings (download limits, expiry rules, email customization), Shopify authentication data, and merchant account details provided by Shopify.
Order & Delivery Data
We store order IDs, product-file relationships, download tokens, download activity (counts and timestamps), and delivery status.
Files
We store files you upload and related metadata (name, size, type). Files are stored in Cloudflare R2.
Customer Data
We do not store customer personal data. Customer email addresses are accessed temporarily from Shopify order data to send download emails and are not stored. We do not store customer names, addresses, or phone numbers.
How We Use Data
We use data to deliver files, generate secure download links, send emails, enforce download limits and expiry, prevent duplicate processing, and maintain the app.
Infrastructure & Storage
We use:
- PostgreSQL for application data
- Cloudflare R2 for file storage
- Postmark for email delivery
- Sentry for error monitoring (no personal data sent)
We do not store payment information or sensitive personal data.
Data Sharing
We only share data as needed to operate the app:
- Shopify (store and order data)
- Postmark (customer email for delivery)
- Cloudflare R2 (file storage)
- Sentry (error monitoring, no personal data)
We do not sell or rent data.
Data Retention
Download links expire based on your settings (default 7 days). Files remain until deleted or the app is uninstalled. Operational data may be retained for reliability.
On uninstall, all store data and files are permanently deleted and all download access is revoked.
Security
We use secure download tokens, signed URLs, and rate limiting. Files are never publicly accessible.
Your Control
You can delete files, revoke access, configure limits, and uninstall the app to remove all data.
Updates
We may update this policy from time to time.