Shopify app privacy policy

Last updated: October 19, 2026

This policy explains how the Polotno Product Image Editor app for Shopify ("the app") handles data. It covers the app as installed from the Shopify App Store. For the Polotno SDK, see the SDK privacy policy.

The data controller is Lavrton LLC, a Wyoming limited liability company registered at 1309 Coffeen Avenue, Ste 1200, Sheridan, WY 82801, USA. You can reach us about privacy at team@polotno.com.

1. Summary

The app edits your product images inside your Shopify admin. Editing happens in your browser, and edited images are uploaded directly to your store's Shopify file storage. Your images are not stored on our servers.
To keep the app installed and authorized, we store one record per store: your shop's domain, the access token Shopify issues to the app, and the permissions it was granted.
The app does not access or store customer data — no customer names, emails, addresses, or orders.
We do not sell data.

2. Data the app accesses

The app asks Shopify for these permissions:

Read and write products, to list a product's images and attach an edited image to the product.
Write files, to upload an edited image and to replace an existing product image.

When you open the editor, the app loads the image you chose from Shopify. Any changes you make, and the exported image, are processed in your browser and sent from your browser to Shopify. They do not pass through our servers.

3. Data we store

We store a session record for your store so Shopify can authenticate the app: your shop's myshopify.com domain, the app's access token, the granted permissions, and token expiry dates. We use it only to authorize the app's requests to Shopify.

Our hosting provider keeps standard request logs (such as IP address, time, and requested URL) for security and troubleshooting.

4. Editor services

The editor loads fonts, text presets, shapes, and other design assets from Polotno's servers. These requests include standard technical information such as your IP address and browser details. If you use an optional feature that calls a service, such as AI image editing, the content you send to that feature is processed to return the result. See the Security overview for what is stored and for how long.

5. How we share data

We share data only with providers needed to run the app:

Railway — application hosting and the session database.
Cloudflare — DNS and network delivery.
Shopify — the platform the app runs on. Your images and products stay in your Shopify store, under Shopify's own privacy policy.

We do not sell or rent data, and we do not share it for advertising.

6. Data retention and deletion

When you uninstall the app, we delete your store's session record. When Shopify asks us to delete a store's data (the shop/redact request, sent after uninstall), we delete anything that remains for that store. Because the app stores no customer data, customer data requests from Shopify have nothing to return or delete.

Images you saved with the app are part of your Shopify store and stay there until you remove them in Shopify.

7. International transfers

The app is hosted in the United States. If you use it from elsewhere, the data described above is processed in the United States, with safeguards appropriate to the transfer.

8. Security

Data is sent over encrypted connections (TLS). Requests from Shopify to the app are verified with Shopify's signatures, and access tokens are stored on access-restricted infrastructure.

9. Your rights

Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal data, and to object to or restrict certain processing. To exercise these rights, email team@polotno.com. Uninstalling the app removes its stored data for your store.