Privacy Policy

Last updated: October 24, 2026

Asset Packs: Downloads & Specs (“the App”) is operated by Hart & Heim Pty Ltd, a company established in Australia (“we”, “us”, “our”). This policy explains what information the App collects when you install and use it, how we use it, and how long we keep it.

What Data We Collect

The App stores only what it needs to work:

• Store access token and shop domain. Shopify gives the App an access token for your store when you install it. We store it with your myshopify.com domain so the App can act on your behalf. It contains no personal information.
• AI usage count. If your store uses AI image analysis, we store your shop domain, the month and the number of analyses, to apply the monthly plan limit.
• Download counts (Pro). When a shopper downloads a file from an Asset Packs block, we count it per day, pack and file name. We store no IP address, cookie or other information about the shopper.
• Emails from the download form (Pro). If you turn on “Ask for an email before showing downloads”, the email goes to Shopify as a customer in your store, through your theme’s own form. The App never receives or stores it.
• Server logs. Our server records technical events such as your shop domain, the time of a request and any errors. When Shopify sends a privacy request about one of your customers, we log the customer ID Shopify provides, never their name or email.

What Data We Do Not Collect

• Personal information about your customers, such as names, emails, addresses or payment details
• Browsing behaviour of your customers or storefront visitors, beyond the anonymous download counts above
• Tracking cookies

We do not sell any data.

Where Your Content Lives

Your asset pack content (images, videos, documents, specifications, FAQ content) is stored in your Shopify store, as Shopify metaobjects and files. We do not keep a copy on our servers.

Service Providers We Use

• Railway hosts the App and its database, which holds the data listed above. Data is encrypted in transit over HTTPS. Railway privacy policy
• Anthropic provides the optional AI image analysis (Pro plan). When you run it, the image, its file name and the product type are sent to Anthropic's Claude API to suggest a category and tags. We do not store the image on our servers. Anthropic handles this data under its commercial terms and privacy policy. Nothing is sent to Anthropic unless you use this feature.

GDPR and Shopify Privacy Requests

The App handles all three mandatory Shopify privacy webhooks:

• Customer data request: we hold no data about your customers, so there is nothing to return.
• Customer deletion: we hold no data about your customers, so there is nothing to delete.
• Shop deletion: we delete your store's access token and AI usage counts.

Data Retention

• The access token is deleted when you uninstall the App.
• AI usage counts are deleted when Shopify sends the shop data erasure request after you uninstall. They are kept until then so reinstalling does not reset the monthly limit.
• Server logs are kept by our hosting provider for a limited period for troubleshooting.
• Content in your Shopify store is governed by Shopify's own policies.

Your Rights

You can:

• Ask what data we hold about your store
• Ask us to delete it (uninstalling the App also does this)
• Ask questions about how we handle data

Changes to This Policy

We may update this policy. Changes will appear on this page with a new “Last updated” date.

Contact Us

For questions about this policy or our data practices, contact:

Email: walter.ceder@gmail.com
Company: Hart & Heim Pty Ltd