Privacy Policy

Last updated: September 7, 2026

QuickFiles ("we", "our", or "us") is a Shopify app built by NerdLabs. This Privacy Policy explains how we collect, use, and protect information when you use our app.

1. Information We Collect

When you install QuickFiles, we access certain information from your Shopify store to provide our services:

• Store Information: Your shop name, domain, email address, and Shopify plan information — used for authentication and billing.
• Product Data: Product titles, IDs, tags, collections, and variant information — used to target upload fields to the correct products.
• Theme Data: Active theme information — used to detect whether the QuickFiles block is installed.
• Order Data: Order information related to file upload line item properties — used to associate uploaded files with orders.

2. Customer File Uploads

When your customers upload files through QuickFiles:

• Files are uploaded directly from the customer's browser to Cloudflare R2 cloud storage. Files do not pass through our application servers.
• File metadata (filename, size, type, upload timestamp) is stored in our database to manage uploads and enforce plan limits.
• We do not access, view, or analyze the contents of uploaded files, and we never use uploaded files for AI or machine-learning training, marketing, advertising, or any purpose beyond providing the QuickFiles service.
• Files are retained for a set period based on your plan — Free: 3 months; Starter and Micro: 12 months; Pro: 24 months, measured from the upload date — and are removed from storage after that period.

3. How We Use Information

We use the information we collect to:

• Provide, maintain, and improve the QuickFiles app
• Display upload fields on your storefront
• Store and serve uploaded files via Cloudflare R2
• Attach file URLs to Shopify orders as line item properties
• Enforce storage limits, upload caps, and file retention policies
• Detect theme block installation status
• Manage your subscription and billing
• Provide customer support

4. Data Storage & Security

Your data is stored on secure servers hosted by DigitalOcean (United States). Customer-uploaded files are stored on Cloudflare R2 (global edge network). We use industry-standard security measures including:

• Encrypted connections (TLS/SSL) for all data transmission
• Encryption at rest — all uploaded files are encrypted at rest (AES-256) by default in Cloudflare R2
• Private, expiring file links — uploaded files are never publicly accessible; every file is served through a private, cryptographically signed URL that expires after 24 hours and is regenerated on each access
• Direct browser-to-storage uploads (files never touch our servers)
• Secure database with restricted access
• OAuth 2.0 authentication with Shopify
• No storage of Shopify API tokens beyond what's required for app functionality

Data breach notification. In the unlikely event of a data breach affecting your data, we will notify affected merchants without undue delay and within 72 hours of becoming aware, including the nature of the incident and the steps we are taking in response.

5. Data Sharing

We do not sell, rent, or share your data with third parties, except:

• Infrastructure providers: DigitalOcean (hosting), Cloudflare (file storage), and Mailgun (transactional email) process data on our behalf under strict confidentiality.
• Legal requirements: We may disclose data if required by law or to protect our rights.

6. Data Retention

Uploaded files are retained for the plan-based period described in Section 2 (Free: 3 months; Starter and Micro: 12 months; Pro: 24 months), after which they are removed from storage. When a file is deleted — by you, by a customer before checkout, at the end of its retention period, or through a data-erasure request — the file object is permanently removed from Cloudflare R2. We do not keep separate backups, replicas, or cached copies of uploaded files.

We retain your data for as long as you have QuickFiles installed. When you uninstall the app:

• Session data is deleted immediately
• Upload field configurations are preserved for 48 hours (in case of accidental uninstall), then deleted via Shopify's SHOP_REDACT webhook
• Uploaded files are deleted within 48 hours of uninstallation
• All store data is permanently deleted within 48 hours of uninstallation

7. GDPR Compliance

We comply with the General Data Protection Regulation (GDPR) and Shopify's data protection requirements:

• We respond to Customer Data Requests — we can report what customer data we store (file metadata associated with orders)
• We respond to Customer Data Erasure requests — uploaded files and metadata are deleted
• We process Shop Data Erasure requests within 48 hours of receiving them from Shopify

If you're a merchant in the EU/EEA, you have the right to access, correct, or delete your data. Contact us to exercise these rights. A Data Processing Addendum (DPA) is available on request at support@nerdlabs.us.

8. Cookies & Tracking

QuickFiles does not use cookies or tracking technologies on your storefront. The app only operates within the Shopify admin (authenticated session) and your product pages (via the theme app block).

9. Children's Privacy

QuickFiles is a business tool for Shopify merchants and is not directed at children under 13. We do not knowingly collect information from children.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We'll notify you of significant changes by updating the "Last updated" date and, where appropriate, through the Shopify admin.

11. Contact Us

If you have questions about this Privacy Policy or our data practices, contact us:

• Email: support@nerdlabs.us
• Website: nerdlabs.us
• Company: NerdLabs