DRAFT — FACTUAL ITEMS MUST BE CONFIRMED BEFORE PUBLICATION

This is the full working Privacy Policy for Utfix. It is written around the current product and inspected data flows, but the bracketed items must be completed before this policy is treated as final or published as an approved legal notice. In particular: legal provider identity/address, final hosting and subprocessor list, international-transfer safeguards, production log/backup treatment, final retention schedule, and closure of the Shopify deletion/data-map work.

Version: 1.0
Effective date: [EFFECTIVE DATE]

This Privacy Policy explains how Utfix handles personal data when you visit utfix.shop, install or use the Utfix Shopify application, contact us, take part in a beta or promotional programme, or otherwise interact with the Utfix service.

Utfix is a business-to-business service for Shopify merchants. It is not intended as a consumer-facing shopping service.

Utfix is provided by [LEGAL NAME], trading as Utfix (“Utfix”, “we”, “us” or “our”).

Business/service address: [BUSINESS / SERVICE ADDRESS]
Privacy contact: Utfix@Utfix.shop
Website: https://utfix.shop

Depending on the activity, Utfix may act in different data-protection roles.

For information we use for our own business purposes — for example website enquiries, merchant account administration, billing/Credit records, service security, fraud prevention, support and legal compliance — Utfix will normally determine the purposes and means of processing and will act as controller where applicable law uses that concept.

Where Utfix processes store-related personal data solely to provide a merchant-requested diagnostic, repair, monitoring or related service on that merchant’s instructions, Utfix may act as processor or service provider where applicable law requires that classification. Where required, the parties are also bound by the applicable Utfix Data Processing Addendum (“DPA”).

The correct role depends on the particular processing activity and applicable law; this policy does not override the role created by the actual facts.

This policy applies to personal data handled through:

• the Utfix Shopify application;
• supported diagnostics, repair proposals, approved repairs, verification and rollback records;
• Monitoring and event-triggered checks;
• Credits, billing and merchant-account administration;
• reports, receipts, History and downloadable audit evidence;
• the Utfix website at utfix.shop;
• support and product enquiries; and
• beta, feedback and promotional activity.

This policy does not govern Shopify, Printful, Google, Meta, carriers, suppliers or other third-party services. Those organisations have their own privacy notices and responsibilities.

Depending on how you use Utfix, we may process:

• your name and business contact details;
• your email address and other contact information you provide;
• the Shopify store/domain and business you are acting for;
• authenticated Shopify user identifiers and, where supplied through Shopify authentication, authorised-user name/email details;
• permissions, scopes and connection status associated with your Utfix installation;
• account, subscription, Credit-balance, billing-reference and commercial-entitlement information;
• choices, approvals, acknowledgements, settings and policies you configure in Utfix;
• notes or explanations you deliberately enter into supported Utfix fields;
• support correspondence, product questions and feedback; and
• records showing when and how you approved or declined supported actions.

Please do not send passwords, one-time codes, private API keys, full access tokens or customer personal data through ordinary support messages or contact forms.

Utfix is not designed to require shopper/customer, order or payment data as a routine input to its supported diagnostic functions. The current product does not intentionally use a customer/order database as part of its core diagnostic model. However, free-text or generic data fields can contain information a merchant chooses to enter, so merchants should avoid entering customer personal data unless a supported feature specifically requires it and the merchant is authorised to provide it.

When you install or use Utfix, we may receive or retrieve store and operational information from Shopify and supported services that you choose to connect.

Depending on the feature, this can include:

• Shopify shop identifiers, store name, domain, currency and time-zone information;
• product, variant, SKU, option, catalogue and publication information;
• Markets, country, availability and sales-channel configuration;
• shipping, delivery-profile and live-rate configuration;
• product identifiers, attributes and metadata;
• supplier, fulfilment, carrier or channel account/install identifiers and connection status;
• profitability inputs and merchant-approved commercial policies;
• Shopify webhook event identifiers and event metadata needed to process relevant store changes;
• scope/permission information; and
• information returned by supported connected services where needed for the merchant-requested feature.

Utfix is designed to use the minimum supported access needed for the feature being used. A read permission does not itself authorise Utfix to make a repair. Write-capable activity is subject to the relevant permission and merchant approval boundary.

Utfix creates service records so that it can explain what it found, carry out approved work, verify outcomes and provide merchant-facing history.

These records may include:

• diagnostic runs, evidence references, timestamps, confidence/freshness information and coverage status;
• Findings and affected store resources;
• Repair Proposals, manifests, before/after intent and preflight state;
• merchant approvals, decisions and acknowledgements;
• Credit reservations, debits, releases and adjustments;
• execution batches, provider responses, errors and verification results;
• rollback/recovery information where supported;
• Monitoring rules, change/drift events and event receipts;
• operational cost/usage telemetry needed to run and improve the service; and
• receipts, History and downloadable audit evidence.

Some fields used for evidence, provider responses, notes or generic structured data are capable of containing incidental personal data even though customer personal data is not the intended content. We therefore aim to minimise free text, sanitise merchant-facing artifacts where appropriate and avoid collecting personal data that is not needed for the service.

Where UK GDPR or similar law requires a lawful basis, the basis depends on the purpose.

We use merchant-user, store and account information to authenticate users, provide diagnostics, prepare and execute approved work, verify results, operate Monitoring, provide History/audit evidence and administer Credits or paid entitlements.

For individual merchants/sole traders this processing may be necessary to perform a contract or take steps at your request before entering one. For users acting for a company or other organisation, we may rely on our legitimate interests and the merchant organisation’s legitimate interests in administering and providing the requested business service.

We process limited account, event, log and operational information to authenticate requests, protect merchant accounts, prevent fraud/abuse, investigate faults and maintain service integrity. We rely on legitimate interests and, where applicable, legal obligations.

We process subscription, Credit, transaction/reference and account records to administer purchases, account balances, billing, refunds where applicable, accounting and dispute records. Depending on the data and context, the lawful basis may be contract, legitimate interests and/or legal obligation.

We use contact details and the content of an enquiry to respond, troubleshoot Utfix and administer our relationship with merchants. The lawful basis is normally contract/pre-contract steps or legitimate interests.

We may use aggregated or appropriately minimised service telemetry, fault information and merchant feedback to improve reliability, performance, product design, cost control and merchant experience. Where personal data is involved, we rely on legitimate interests unless another basis is more appropriate.

Where we send optional marketing communications that require consent, we rely on consent and you can withdraw it at any time. Product/service messages necessary to operate an existing Utfix relationship are not treated as optional marketing merely because they are sent by email.

Where applicable law requires consent for non-essential cookies or similar technologies, we rely on the choice made through the website cookie controls. Essential technologies required to provide/security-protect the site may operate without optional consent where law permits.

[FINAL COOKIE/ANALYTICS INVENTORY TO CONFIRM BEFORE PUBLICATION.]

Utfix uses software rules and automated analysis to examine store configuration, classify supported findings, calculate proposed changes and verify outcomes.

The automated diagnostic process concerns the configuration and operation of a merchant’s store. Utfix is not designed to make automated decisions about shoppers as individuals.

Where a live repair requires merchant approval, Utfix presents the relevant proposal/approval boundary before carrying out the authorised work. Missing evidence is intended to remain missing/unknown rather than being converted into a fabricated conclusion.

We disclose personal or Merchant Data only where reasonably necessary for the service, security, legal compliance or a merchant-authorised integration.

Recipients may include:

• Shopify, where required to operate an embedded Shopify application, authenticate merchants, use Shopify APIs/webhooks, administer Shopify billing where applicable, or comply with Shopify platform requirements;
• connected suppliers, fulfilment providers, carriers, sales channels or other services that the merchant chooses to connect and where information must be exchanged to provide the requested feature;
• hosting, database, infrastructure, logging, security, support and other technical service providers acting for Utfix;
• GoDaddy and website-service providers involved in operating utfix.shop;
• Google/reCAPTCHA or similar anti-abuse providers where used by the website/contact functionality;
• professional advisers, insurers, auditors or legal advisers where reasonably necessary; and
• regulators, courts, law enforcement or other authorities where disclosure is legally required.

We do not sell personal data to advertisers.

[FINAL NAMED SUBPROCESSOR/SERVICE-PROVIDER LIST TO CONFIRM BEFORE PUBLICATION. Hosting/database/logging/backup providers and their locations must be verified against the deployed production stack.]

Some service providers or connected third-party services may process data outside the United Kingdom or the country in which a merchant/user is located.

Where Utfix is responsible for an international transfer of personal data, we will use an applicable lawful transfer mechanism, such as an adequacy regulation/decision or approved contractual safeguards, where required.

Where the merchant directly connects an independent third-party service, that third party’s own privacy terms and transfer arrangements may also apply.

[PRODUCTION HOSTING LOCATIONS, SUBPROCESSOR LOCATIONS AND THE SPECIFIC UK/EU TRANSFER SAFEGUARDS MUST BE CONFIRMED BEFORE PUBLICATION.]

We aim to keep personal and Merchant Data only for as long as it is needed for the purpose for which it was collected, to provide the service/history expected by merchants, meet legal/accounting obligations, resolve disputes, maintain security or comply with Shopify requirements.

Different records have different purposes. For example:

• Shopify authentication/session information is operational authentication data and may be deleted when the app is uninstalled or the session ends in accordance with the service design;
• diagnostic, Finding, Repair, verification, Monitoring, Credit and audit/history records may need to survive an uninstall for a period so that reinstall/history, merchant evidence, accounting and dispute handling remain possible;
• billing/accounting records may need to be retained for applicable legal or accounting periods;
• security logs may be kept for a limited period appropriate to fraud, abuse and incident investigation; and
• backups may persist for a limited rolling period before being overwritten/deleted.

Shopify also requires App Store apps to support mandatory privacy-compliance processes, including requests concerning customer data and shop data. Utfix is designed to respond to authenticated Shopify privacy requests in accordance with Shopify’s requirements and applicable law.

[FINAL RETENTION SCHEDULE TO CONFIRM BEFORE PUBLICATION: ordinary TTLs for diagnostics/evidence, telemetry, Findings, receipts, Credit ledger, Monitoring/history, audit artifacts, logs and backups; exact post-uninstall period; deletion timetable; and any legally required exceptions.]

The current inspected implementation retains some canonical Utfix history after ordinary uninstall and intends broader store deletion through Shopify’s shop-redact process. The deletion/data-map implementation is still being verified before beta/publication; this policy must not promise immediate or complete deletion on uninstall until that work is proven.

Shopify requires public App Store apps to support mandatory privacy-compliance webhooks for:

• requests for access to stored customer data;
• requests to delete customer data; and
• requests to delete shop data.

Utfix authenticates Shopify compliance webhook requests before acting on them.

The current Utfix product is not designed to intentionally ingest customer/order data as part of its core model. However, because generic/free-text/evidence fields can theoretically contain incidental personal data, the final data classification and handling of customer access/redaction requests must be verified against the production data map before beta/publication.

[THIS SECTION REQUIRES FINAL TECHNICAL SIGN-OFF AFTER CUSTOMER-DATA CLASSIFICATION AND END-TO-END SHOP-REDACT TESTING.]

Utfix uses technical and organisational measures intended to protect account and store information and to reduce unauthorised access, disclosure, alteration or loss.

The inspected application architecture includes authenticated Shopify sessions/webhooks, store-scoped merchant access controls, constrained Shopify network clients and store-scoped audit-artifact access. The product is also designed around least privilege, read/write separation and merchant approval before supported write operations.

No internet service can promise absolute security. Do not send credentials or sensitive information through channels that are not intended to receive them.

[FINAL SECURITY/PRIVACY SIGN-OFF IS REQUIRED BEFORE PUBLICATION. Production infrastructure/IAM, log access/retention, backup handling, deletion behavior and the outstanding audit items must be verified rather than inferred from source code alone.]

Depending on the law that applies to you and the nature of our role, you may have rights concerning your personal data, including rights to:

• obtain information about how your data is used;
• request access to personal data we hold about you;
• ask for inaccurate data to be corrected;
• request deletion in circumstances where the law gives that right;
• request restriction of processing;
• object to processing based on legitimate interests;
• receive certain data in a portable form where applicable; and
• withdraw consent at any time where processing is based on consent, without affecting processing already lawfully carried out.

Not every right applies in every circumstance. For store/customer data that Utfix processes solely on behalf of a Shopify merchant, your request may need to be handled through that merchant as the relevant controller/business.

To make a privacy request concerning Utfix’s own processing, contact Utfix@Utfix.shop. We may need to verify your identity and relationship to the relevant merchant/store before responding.

Where we rely on legitimate interests, you may have a right to object to that processing. Contact Utfix@Utfix.shop and explain the processing you object to.

Please contact Utfix@Utfix.shop first if you have a privacy concern so we can investigate it.

If UK data-protection law applies, you also have the right to complain to the Information Commissioner’s Office (ICO). Information about making a complaint is available from the ICO at ico.org.uk.

If another supervisory authority has jurisdiction over your personal data, you may also have the right to complain to that authority.

Utfix uses Google Analytics 4 to understand how visitors find and use utfix.shop, including pages viewed, referring traffic sources, website engagement and general browser or device information.

Optional analytics tracking is subject to the visitor's cookie choices. Visitors can decline optional analytics cookies and continue using the website.

Our website is hosted using GoDaddy Websites + Marketing. Questions about our use of website analytics and personal data can be sent to Utfix@Utfix.shop.

[BEFORE PUBLICATION: confirm the live cookie inventory, analytics provider(s), contact-form destination, form retention, GoDaddy processing terms and reCAPTCHA configuration. The cookie notice and this policy must match the live implementation.]

Utfix is a business service intended for Shopify merchants and authorised business users. It is not directed to children and is not intended for personal or household use.

If we learn that personal data relating to a child has been provided to Utfix outside the intended business context, we will assess and handle it in accordance with applicable law.

We may update this Privacy Policy to reflect changes to Utfix, Shopify/platform requirements, service providers, legal requirements or our data-handling practices.

Where a change is material, we will provide appropriate notice where required. The current version and effective date will be shown on this page.

Questions or requests about this Privacy Policy or Utfix’s handling of personal data can be sent to:

Utfix Privacy
Email: Utfix@Utfix.shop
Legal provider: [LEGAL NAME]
Business/service address: [BUSINESS / SERVICE ADDRESS]
Website: https://utfix.shop

Data Processing Addendum: [DPA PAGE / URL]