Privacy Policy
Last updated: August 2026
Granted Assets (“we”, “our”, or “us”) helps Shopify merchants deliver digital products to their customers. This Privacy Policy explains what data we collect, how we use it, and how it is handled.
What We Collect
Merchant (Store) Data
We collect store information such as your shop domain, app settings (download limits, expiry rules, email customization), Shopify authentication data, and merchant account details provided by Shopify.
Order & Delivery Data
We store order IDs, product-file relationships, download tokens, download activity (counts and timestamps), and delivery status.
Files
We store files you upload and related metadata (name, size, type). Files are stored in Cloudflare R2.
Customer Data
We store the customer email address associated with an order so we can provide digital-download delivery and customer access features, including helping merchants look up a customer’s download history and access status. We do not store customer names, physical addresses, or phone numbers.
How We Use Data
We use data to deliver files, generate secure download links, send emails, enforce download limits and expiry, prevent duplicate processing, and maintain the app.
Infrastructure & Storage
We use:
- PostgreSQL for application data
- Cloudflare R2 for file storage
- Postmark for email delivery
- Sentry for error monitoring (no personal data sent)
We do not store payment information or sensitive personal data.
Website Analytics
On the public Granted Assets marketing website (grantedassets.com), we use Google Analytics to understand how visitors use the site, including page views and interactions. Google Analytics may collect usage information through cookies or similar technologies. We do not intentionally send customer email addresses, names, order IDs, download tokens, or other customer or merchant data from the Granted Assets app to Google Analytics.
Data Sharing
We only share data as needed to operate the app:
- Shopify (store and order data)
- Postmark (customer email for delivery)
- Cloudflare R2 (file storage)
- Sentry (error monitoring, no personal data)
We do not sell or rent data.
Data Retention
Download links expire based on your settings (default 7 days). Files remain until deleted or the app is uninstalled. Operational data may be retained for reliability.
When Granted Assets is uninstalled, download access is revoked immediately and most store data and uploaded files are deleted immediately. Records associated with individual download links, including the related customer email address, may be retained for up to 48 hours before being permanently deleted as part of Shopify’s required data-erasure process.
Security
We use secure download tokens, signed URLs, and rate limiting. Files are never publicly accessible.
Your Control
You can delete files, revoke access, configure limits, and uninstall the app to initiate removal of your app data.
Updates
We may update this policy from time to time.