Privacy Policy

Last updated: October 21, 2026

QuickFiles ("we", "our", or "us") is a Shopify app built by NerdLabs. This Privacy Policy explains how we collect, use, and protect information when you use our app.

1. Information We Collect

When you install QuickFiles, we access certain information from your Shopify store to provide our services:

• Store Information: Your shop name, domain, email address, and Shopify plan information — used for authentication and billing.
• Product Data: Product titles, IDs, tags, collections, and variant information — used to target upload fields to the correct products.
• Theme Data: Active theme information — used to detect whether the QuickFiles block is installed.
• Order Data: Order information related to file upload line item properties — used to associate uploaded files with orders.
• Support Messages: If you message us from inside the app (including a free-setup request), we store your messages, your shop domain, the reply-to email address and name you provide or that Shopify lists for your store, and your admin language — used only to answer you and to email you when we reply.
• Error Reports: If a page of the app in your Shopify admin hits a technical error, your browser sends us the error message and stack trace, the page address (with login tokens removed), the browser type, and your shop domain (when the browser provides it), so we can find and fix the bug. The QuickFiles upload fields on your storefront and cart report their own errors the same way from the shopper's browser (page address without its query string, the shopper's browser type and your shop domain). They are not designed to contain customer names, emails or uploaded files. Our support service on our DigitalOcean server stores the report and, through Mailgun, emails an alert with the error text and stack trace, page address and shop domain to our team's mailbox, which Google hosts. When Shopify's SHOP_REDACT request arrives, your shop domain in the stored reports is replaced with an anonymous identifier and the page address and browser type are removed. That does not cover the alert emails: we keep them while we need them to fix the bug and delete them on request.

2. Customer File Uploads

When your customers upload files through QuickFiles:

• Files are uploaded directly from the customer's browser to Cloudflare R2 cloud storage. Files do not pass through our application servers.
• File metadata (filename, size, type, upload timestamp) is stored in our database to manage uploads and enforce plan limits.
• We do not access, view, or analyze the contents of uploaded files, and we never use uploaded files for AI or machine-learning training, marketing, advertising, or any purpose beyond providing the QuickFiles service.
• Files are retained for a set period based on your plan — Free: 3 months; Starter and Micro: 12 months; Pro: 24 months, measured from the upload date — and are removed from storage after that period.

3. How We Use Information

We use the information we collect to:

• Provide, maintain, and improve the QuickFiles app
• Display upload fields on your storefront
• Store and serve uploaded files via Cloudflare R2
• Attach file URLs to Shopify orders as line item properties
• Enforce storage limits, upload caps, and file retention policies
• Detect theme block installation status
• Manage your subscription and billing
• Provide customer support, including in-app support messages and free setup help
• Find and fix bugs, using the technical error reports described above

4. Data Storage & Security

Your data is stored on secure servers hosted by DigitalOcean (United States). Customer-uploaded files are stored on Cloudflare R2 (global edge network). We use industry-standard security measures including:

• Encrypted connections (TLS/SSL) for all data transmission
• Encryption at rest — all uploaded files are encrypted at rest (AES-256) by default in Cloudflare R2
• Private, expiring file links — uploaded files are never publicly accessible; every file is served through a private, cryptographically signed URL that expires after 24 hours and is regenerated on each access
• Direct browser-to-storage uploads (files never touch our servers)
• Secure database with restricted access
• OAuth 2.0 authentication with Shopify
• No storage of Shopify API tokens beyond what's required for app functionality

Data breach notification. In the unlikely event of a data breach affecting your data, we will notify affected merchants without undue delay and within 72 hours of becoming aware, including the nature of the incident and the steps we are taking in response.

5. Data Sharing

We do not sell, rent, or share your data with third parties, except:

• Infrastructure providers: DigitalOcean (hosting), Cloudflare (file storage), and Mailgun (transactional email) process data on our behalf under strict confidentiality.
• Google: hosts our team's mailbox, which receives error alerts.
• Legal requirements: We may disclose data if required by law or to protect our rights.

6. Data Retention

Uploaded files are retained for the plan-based period described in Section 2 (Free: 3 months; Starter and Micro: 12 months; Pro: 24 months), after which they are removed from storage. When a file is deleted — by you, by a customer before checkout, at the end of its retention period, or through a data-erasure request — the file object is permanently removed from Cloudflare R2. We do not keep separate backups, replicas, or cached copies of uploaded files.

We retain your data for as long as you have QuickFiles installed. When you uninstall the app:

• Session data is deleted immediately
• Upload field configurations are preserved for 48 hours (in case of accidental uninstall), then deleted via Shopify's SHOP_REDACT webhook
• Uploaded files are deleted within 48 hours of uninstallation
• All store data is permanently deleted within 48 hours of uninstallation, except technical error reports and their alert emails, which are handled as described in Section 1
• Support messages are deleted together with your store data when Shopify sends its store-deletion (SHOP_REDACT) request, or sooner on request; backup copies age out within 30 days

7. GDPR Compliance

We comply with the General Data Protection Regulation (GDPR) and Shopify's data protection requirements:

• We respond to Customer Data Requests — we can report what customer data we store (file metadata associated with orders)
• We respond to Customer Data Erasure requests — uploaded files and metadata are deleted
• We process Shop Data Erasure requests within 48 hours of receiving them from Shopify

If you're a merchant in the EU/EEA, you have the right to access, correct, or delete your data. Contact us to exercise these rights. A Data Processing Addendum (DPA) is available on request at support@nerdlabs.us.

8. Cookies & Tracking

QuickFiles does not use cookies or tracking technologies on your storefront. The app only operates within the Shopify admin (authenticated session) and your product pages (via the theme app block).

9. Children's Privacy

QuickFiles is a business tool for Shopify merchants and is not directed at children under 13. We do not knowingly collect information from children.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We'll notify you of significant changes by updating the "Last updated" date and, where appropriate, through the Shopify admin.

11. Contact Us

If you have questions about this Privacy Policy or our data practices, contact us:

• Email: support@nerdlabs.us
• Website: nerdlabs.us
• Company: NerdLabs