1. Overview & Scope
MakeItCustom is a specialized Shopify application designed for merchants to offer interactive product personalization on their online stores, compute authoritative customization pricing, and automate the generation of print-ready production files (PNG and PDF).
This Privacy Policy explains the nature, scope, and purpose of the personal and operational data processed by MakeItCustom when merchants install the application, configure customization templates, and when store customers personalize products and place orders.
2. Data Controller & Processor Roles
In the context of data protection regulations:
- Merchant as Data Controller: The merchant installing MakeItCustom is the primary data controller for all end-customer orders, store interactions, and uploaded customer content.
- MakeItCustom as Technical Data Processor: MakeItCustom (operated by Codify System, accessible at
support@codifysystem.com) acts strictly as a data processor providing technical software infrastructure to facilitate customization rendering, pricing verification, and manufacturing asset generation.
3. Categories of Data Processed
MakeItCustom processes only the specific data categories necessary to provide customization and print production features:
| Data Category | Specific Data Elements | Processing Purpose |
|---|---|---|
| Shopify Store Identity | Store domain (e.g. store.myshopify.com), internal shop ID, currency code, and OAuth installation session tokens. | Multi-tenant authentication, tenant data isolation, and Shopify Admin API communication. |
| Catalog & Templates | Shopify Product GIDs, Variant GIDs, print area coordinates, physical dimensions (inches/mm), allowed tool types. | Binding customized products to merchant print templates and enforcing layout boundaries. |
| Design Configurations | Design JSON (canvas elements, text layers, font families, colors, position coordinates, scale factors, rotation angles). | Persisting user customizations so items can be previewed, added to cart, and rendered. |
| Customer Uploaded Artwork | Images (PNG, JPG, SVG) uploaded by end-customers to personalize their items, stored in private object storage. | Incorporating user graphics into the high-resolution output files for merchant print fulfillment. |
| Pricing Snapshots | Cryptographic hashes of designs, minor unit fee amounts, currency, server timestamp, and TTL expiration dates. | Authoritative server-side pricing verification and checkout tampering prevention. |
| Order Identifiers & Line Items | Shopify Order ID, Order Number (e.g. #1001), Line Item IDs, line item custom attributes (_design_id, _customization_snapshot). | Linking completed checkout orders to saved designs to generate and organize merchant production jobs. |
| Generated Production Assets | High-resolution PNG files and vector/print-ready PDF documents generated at configured DPI. | Delivering print-ready manufacturing files to authenticated merchants via Shopify Admin. |
| Operational Logs | Server timestamps, error traces, job claim tokens, and HTTP status codes. | Monitoring platform uptime, debugging errors, and ensuring reliable queue processing. |
4. Protected Customer Data (PCD) Statement
MakeItCustom does not request, collect, or store optional Shopify Protected Customer Fields, including:
- Customer Full Name
- Customer Email Address
- Customer Phone Number
- Customer Shipping or Billing Street Addresses
The application operates under the Shopify Protected Customer Data reason of Store Management. While raw Shopify webhook payloads transit through platform infrastructure, MakeItCustom persists only order IDs, order numbers, line item IDs, and line item custom customization attributes strictly required for manufacturing workflows.
5. Purposes of Data Processing
MakeItCustom uses collected information strictly for:
- Interactive Customization: Rendering the visual customizer interface in the merchant storefront.
- Pricing Verification: Authoritatively calculating fees and signing cryptographic Ed25519 authorization tokens to prevent cart and checkout tampering.
- Production Automation: Ingesting order webhooks to trigger asynchronous background workers that render print-ready PNG and PDF documents.
- Merchant Order Management: Displaying production job status, attempt logs, and secure asset download links inside Shopify Admin.
- System Reliability & Security: Detecting and mitigating malicious traffic, verifying webhook HMAC signatures, and maintaining service health.
6. Prohibited Uses of Data
MakeItCustom maintains strict data minimization and purpose limitations:
- We never sell, rent, or trade merchant, customer, or order data to third parties.
- We do not use customer data for advertising, retargeting, or behavioral marketing.
- We do not perform customer profiling or automated credit or legal decision-making.
- We do not aggregate or monetize cross-merchant consumer trends.
7. Infrastructure & Subprocessors
To provide secure, scalable services, MakeItCustom utilizes reputable cloud infrastructure providers under enterprise data processing terms:
| Subprocessor | Role & Function | Data Stored / Handled |
|---|---|---|
| Shopify Inc. | E-commerce platform, App Bridge host, App Proxy routing, Webhook dispatcher. | Storefront customization traffic, authenticated Admin sessions, order webhook events. |
| Railway Corp. | Application server hosting, container runtime, API routing, background worker execution. | Application code execution, transient memory processing, and operational logging. |
| Neon, Inc. | Serverless PostgreSQL database provider (Encrypted at rest). | Shop records, template bindings, design JSON, pricing snapshots, production job states. |
| Cloudflare, Inc. | Cloudflare R2 private object storage (Encrypted at rest). | Customer-uploaded personalization artwork and generated high-resolution PNG/PDF production files. |
8. Security & Technical Safeguards
We implement comprehensive security controls across the application architecture:
- Encryption in Transit: All HTTP traffic across public storefronts, Shopify Admin, App Proxy routes, and internal microservices is enforced over HTTPS/TLS.
- Encryption at Rest: Managed databases (Neon) and private object storage (Cloudflare R2) utilize provider-managed AES-256 encryption at rest.
- Multi-Tenant Isolation: Database queries strictly enforce tenant scoping using internal shop IDs resolved from verified Shopify authentication sessions.
- Private Storage Access: R2 storage buckets are private. Customer uploads and production files cannot be accessed anonymously and are served only through authenticated merchant routes.
- Cryptographic Authorization: Customization pricing is verified fail-closed using Ed25519 digital signatures and SHA-256 canonical hashing.
9. Merchant & Customer Data Rights
Merchants and their customers have the right to request access, verification, or deletion of data processed by the application:
- Access & Export: Merchants can view all customized orders, designs, and production assets directly within the Shopify Admin interface.
- Data Deletion Requests: Merchants may request complete removal of their store configuration, saved designs, uploaded assets, and generated files by contacting our support team.
- Customer Requests: End-customers wishing to delete uploaded images or custom design records should contact the merchant directly; the merchant can then forward the deletion request to our support team.
10. Contact Information
For inquiries regarding this Privacy Policy, data protection practices, or deletion requests, please contact:
Email: support@codifysystem.com
Technical Support: Codify System Developer Team