Privacy Policy

Effective date: 20 September 2026

About this Privacy Policy

This Privacy Policy explains how HelpCraft.shop and the HelpCraft Shopify app, together referred to as “HelpCraft” or the “Service”, process personal and operational information.

HelpCraft is operated by DIGILAB EOOD, with registered / business address at Bulgaria, Sofia, zh.k. Ilinden 1712

This Policy applies to:

• merchants and authorized users who install or use the HelpCraft Shopify app;
• visitors to HelpCraft.shop;
• people who contact HelpCraft Support.

This Policy does not replace the privacy policy of a Shopify merchant. Merchants remain responsible for informing their own customers about the processing of personal data through their Shopify store and customer-facing content where required by applicable law.

Our role and Shopify

For personal data processed for operating HelpCraft, managing the merchant relationship, providing support, securing the Service and operating HelpCraft.shop, DIGILAB EOOD acts as the data controller where applicable.

Shopify is an independent platform and processes data under its own agreements and privacy practices.

Where a merchant chooses to include personal data in Help Center content, the merchant determines the purpose of that content. Depending on the circumstances and applicable law, HelpCraft may process such information only as necessary to provide the Service on the merchant's behalf.

Information processed by the Shopify app

HelpCraft stores limited local operational information required to install, secure and operate the app.

This can include:

• Shopify shop domain and platform identifiers;
• installation, reinstall and uninstall state;
• Shopify app lifecycle and compliance-event information;
• encrypted Shopify offline access and refresh tokens;
• token expiry and permission metadata;
• HelpCraft plan and billing-entitlement reconciliation state;
• operational timestamps and security-related state;
• internal administrative audit information relating to operation of the Service.

HelpCraft does not store merchant payment-card information. Paid HelpCraft subscriptions are handled through Shopify's billing infrastructure.

Shopify access and refresh tokens are encrypted at rest and are not exposed in plaintext through the HelpCraft internal administration interface.

Merchant Help Center content

Merchant Help Center content is stored authoritatively in Shopify app-owned resources rather than in a separate HelpCraft database copy.

This includes structured Help Center content managed by HelpCraft, such as Categories, Articles, Sections, Tabs, Accordion items, Links and related translations.

HelpCraft accesses and processes this content through Shopify APIs when necessary to provide authoring, preview, publishing, translation and related app functionality.

Merchants are responsible for deciding what information they place in their Help Center. Sensitive personal information, passwords, access credentials, API keys and other secrets should not be placed in Help Center content.

Customer-facing Help Centers

The HelpCraft storefront Help Center and Customer Account Help Center render customer-facing content from Shopify-hosted resources.

Normal customer Help Center pageviews do not require a request to HelpCraft's PHP application server.

The current Customer Account Help Center does not query Shopify customer profile, order or address data and does not rely on protected customer data for its Help Center functionality.

HelpCraft does not maintain a separate local customer-profile, order or address database for this feature.

Shopify privacy requests

HelpCraft supports Shopify privacy and compliance processes, including:

• `customers/data_request`;
• `customers/redact`;
• `shop/redact`.

These mechanisms can be used by Shopify to notify installed apps about applicable access or deletion requests.

Because the current HelpCraft customer-facing Help Center does not store Shopify customer profile, order or address records, customer-specific privacy requests will generally not correspond to a separate HelpCraft customer database.

Verified requests are nevertheless processed according to the data actually held by HelpCraft and applicable legal requirements.

How we use information

We process information only where reasonably necessary for purposes such as:

• providing, maintaining and securing HelpCraft;
• authenticating Shopify app installations and API access;
• enabling merchant authoring, publishing and translation functionality;
• determining and enforcing applicable HelpCraft plan capabilities;
• responding to support requests;
• preventing abuse and protecting the security and integrity of the Service;
• maintaining operational and audit records;
• complying with Shopify platform requirements and applicable legal obligations;
• improving HelpCraft.shop through optional analytics where consent has been provided.

Legal bases

Where the GDPR or similar law applies, the legal basis for processing depends on the context.

We may process personal data because:

• processing is necessary to provide the Service or take requested steps in connection with it;
• processing is necessary for our legitimate interests in operating, securing and improving HelpCraft, provided those interests do not override the rights and freedoms of the individual;
• processing is necessary to comply with a legal obligation;
• the individual has given consent, including for optional analytics where consent is required.

Where processing relies on consent, consent can be withdrawn at any time without affecting processing that was lawful before withdrawal.

HelpCraft.shop analytics and cookies

HelpCraft.shop can use Google Analytics 4 (“GA4”) to understand how the public website is used.

Optional analytics are activated only when analytics are enabled for HelpCraft.shop and the visitor has given the required consent.

Google Analytics may process information about website interactions, devices and browsers in accordance with Google's services and privacy terms.

Rejecting optional analytics does not prevent use of the essential HelpCraft.shop website functionality.

Visitors can change their analytics choice by reopening Cookie settings from the HelpCraft.shop footer.

The HelpCraft.shop analytics configuration does not automatically enable HelpCraft analytics on merchant Shopify stores or merchant Help Centers.

Additional information about cookies used on HelpCraft.shop is available in the HelpCraft Cookie Policy.

Support contact form

When you contact HelpCraft through the Support form, we process the information that you choose to submit, including:

• name;
• email address;
• optional Shopify store domain;
• selected support topic;
• message.

We use this information to receive, manage and respond to your request.

HelpCraft currently uses Brevo as outbound email infrastructure for Support form messages.

The Support form does not create a HelpCraft customer-support ticket, CRM profile or permanent HelpCraft message-history database solely by submitting the form.

Service providers involved in transmitting email may process relevant message and recipient information as necessary to provide their service and according to their applicable contractual and privacy obligations.

The Support form uses validation, abuse-rate controls and a short-lived signed form token for security.

Do not send passwords, Shopify access tokens, SMTP credentials, API keys or other secrets through the Support form.

Service providers and recipients

Personal or operational information can be made available, where necessary, to categories of recipients such as:

• Shopify, for operation of the Shopify app and Shopify-hosted resources;
• hosting and infrastructure providers, to operate and secure HelpCraft;
• Brevo, when processing Support form email delivery;
• Google Analytics, only where the applicable optional analytics functionality is enabled and consent has been provided;
• professional advisers, authorities or other recipients where disclosure is legally required.

We do not give service providers access to information beyond what is reasonably necessary for their role.

Each third-party service may also process data according to its own applicable terms and privacy documentation.

International data transfers

Some service providers may process information in countries outside the country in which you live or outside the European Economic Area.

Where personal data subject to the GDPR is transferred internationally and applicable law requires safeguards, the relevant transfer must be covered by an applicable legal transfer mechanism or other legally recognized safeguard.

Specific third-party transfer practices can depend on the services and configurations used by Shopify, Google, Brevo and infrastructure providers.

Data retention

We retain information only for as long as reasonably necessary for the purpose for which it was processed, including applicable security, operational and legal requirements.

In particular:

• the current Shopify access token is removed from HelpCraft's active local installation state when the app is uninstalled;
• eligible shop-related local data is deleted through the verified Shopify `shop/redact` lifecycle;
• limited information may be retained when required by law or where necessary to establish, exercise or defend legal claims;
• Support information is retained only for as long as reasonably necessary to respond to and manage the request and any necessary related records;
• analytics retention is subject to the configured Google Analytics settings and applicable Google services.

Uninstall and deletion

When HelpCraft is uninstalled through Shopify:

1. the current locally stored Shopify access token is removed from the active installation state;
2. limited lifecycle information can temporarily remain where required for safe uninstall/reinstall handling and operational integrity;
3. verified Shopify privacy and redaction events are processed;
4. eligible local shop data is removed through HelpCraft's controlled `shop/redact` process.

Shopify-hosted merchant Help Center resources remain subject to Shopify's platform behavior and the merchant's Shopify account and are not a HelpCraft local content mirror.

A plan downgrade alone does not intentionally delete Shopify-hosted merchant Help Center content or saved translations.

Security

We use technical and organizational safeguards designed to protect information appropriate to the nature of the Service.

Current measures include, where applicable:

• encryption of Shopify access and refresh tokens at rest;
• authenticated and role-restricted internal administration;
• CSRF protection for state-changing internal actions;
• session-security controls;
• verification of Shopify authentication and webhook requests;
• restricted handling of secrets and credentials;
• controlled lifecycle and deletion procedures.

No internet-connected system can guarantee absolute security.

If you believe that a security issue affects HelpCraft, contact us at support@helpcraft.shop or through the HelpCraft Support page.

Your privacy rights

Depending on the law that applies to you, you may have rights including the right to:

• request access to personal data about you;
• request correction of inaccurate information;
• request deletion of personal data;
• request restriction of processing;
• object to certain processing;
• receive eligible personal data in a portable form;
• withdraw consent where processing is based on consent;
• lodge a complaint with a competent data-protection supervisory authority.

Some rights are subject to legal conditions and exceptions.

If your request concerns data processed by a Shopify merchant about that merchant's customer, you should normally contact the merchant first. Shopify's privacy-request mechanisms can then notify installed apps where appropriate.

Automated decision-making

HelpCraft does not use the personal data described in this Policy to make solely automated decisions that produce legal or similarly significant effects on individuals.

Changes to this Privacy Policy

We may update this Privacy Policy when HelpCraft, our service providers, applicable law or Shopify platform requirements change.

When we make a material change, we will update the effective date and provide additional notice where reasonably appropriate or legally required.

Contact and data controller

Privacy questions and requests can be sent through the HelpCraft Support page or to support@helpcraft.shop.

Data controller / Operator: DIGILAB EOOD
Registered / business address: Bulgaria, Sofia, zh.k. Ilinden 1712
Email: support@helpcraft.shop
Company registration number: 208018721
VAT number: BG208018721

You also have the right to lodge a complaint with the competent data-protection supervisory authority applicable to you.