InkSurf Shopify app privacy policy

Last updated: October 23, 2026. Applies to the InkSurf app for Shopify, run by InkSurf Studios LLC. Our general privacy policy covers inksurfstudios.com.

What we collect

• About your store: your shop’s myshopify.com address, store name, Shopify plan (to know whether live shipping rates are available) and currency. An access token from Shopify, stored encrypted, so the app can work for you.
• About you: the name and email you give us for your InkSurf account and billing. Your card or bank details go directly to Stripe; we only keep a label such as “Visa ••4242”.
• Products: the InkSurf products you create (titles, descriptions, prices, variant IDs) and the mockup images we make for them.
• Orders sent to InkSurf to fulfill: for each order line we print, the Shopify order number and the ship-to name, address and phone number. We need these to make the shipping label. We do not collect your customers’ email addresses, Shopify customer records, payment details or order totals.
• Webhooks: we log the type of each notification Shopify sends and a short summary (for example “Order #1001”), never the full message.

How we use it

• To print, pack and ship your orders, and to send tracking back to Shopify (Shopify emails your customer, not us).
• To bill your account for production and shipping, and to show invoices and receipts.
• To support you and fix problems. We don’t sell data, and we don’t use your customers’ details for marketing.

Who we share it with

• Cloudflare (hosting and database), Stripe (billing you), EasyPost and the carrier on the label (USPS, UPS or FedEx), and Klaviyo (emails to you about your account, never to your customers).
• Shopify, through its API, as the app works.

How long we keep it, and deletion

• A customer’s ship-to details stay with the order while it’s made and shipped. When Shopify sends us a customer redact request, we delete that customer’s name, street address and phone from our orders (and our copy of their shipping labels). If an order is still being made, we delete them right after it ships. We keep state and ZIP code, and order totals, because sales tax and bookkeeping law require it.
• When Shopify sends a customer data request, we send the store everything we hold for that customer within 30 days.
• When you uninstall, we delete your access token at once. 48 hours later (Shopify’s shop redact), we delete your store’s products, mappings, branding and customers’ details. We keep our invoices to you.

Security

Access tokens and app secrets are encrypted (AES-256-GCM). Every request from Shopify is checked with its HMAC signature. Our staff’s production logins never see prices or customers’ contact details beyond the shipping address.

Your rights and contact

To see, correct or delete your data, or with any privacy question, email support@inksurfstudios.com (subject “Privacy”). InkSurf Studios LLC, Florida, USA.