Privacy Policy

Last updated 25 August 2026

This policy explains what data the Konform app for Shopify accesses, what we store, who we share it with, and how long we keep it. It applies to the Konform app and to the pages on this site. It is written to be read by the merchants who install Konform, not by lawyers.

What the Shopify App Store listing says. Shopify shows a data access summary on every app listing, describing what an app's permissions could reach rather than what it actually reads. Konform holds five permissions and no more: read and write products, read your published languages, and read and write files. It holds no permission over orders, customers, checkouts or payments, so there is no version of this app that can reach your customers' data even by mistake.

1. Who we are

Konform is operated by Rel8 CX Ltd, a company registered in England and Wales under company number 10154735, with its registered office at 124 City Road, London, EC1V 2NX, United Kingdom. We are registered with the Information Commissioner's Office under registration number ZC028999.

For any question about this policy or about your data, contact privacy@rel8.cx.

2. Our role and yours

For the store data that Konform reads from your Shopify account, you are the data controller and Rel8 CX Ltd acts as your data processor. We process that data only to provide the service to you, and only on your instructions, which you give by installing the app and pressing the buttons in it.

3. What Konform reads from your store

Your product list. The app reads the status of each product, whether it is a gift card, and whether it requires shipping. That is enough to tell you how many of your products count as goods for the purposes of the Regulation. It does not read your product titles, descriptions, images, prices or costs, and it does not store any of it. The count is calculated when you open the app and discarded when you close it.

Your published languages. So it knows which language versions of the official notice to publish.

Your files. So it can tell whether it has already published the notice to your account and avoid uploading duplicates.

Your shop name and primary domain. So it can check your storefront and tell you whether the notice is actually live.

4. What Konform writes to your store

The official artefacts, as files in your Shopify account. These are the European Commission's published files, unmodified. They belong to you, sit in your own Files area, and stay there if you uninstall the app.

Two shop settings recording where those files live, so your theme can display them.

Optional guarantee details on individual products, if you choose to use the EU GARAN label. These are the values you enter yourself: the guarantee duration and whether the producer offers it free of charge for the entire product.

5. What we store on our systems

One record per shop, holding your .myshopify.com domain, the access token Shopify issues so the app can talk to your store, and the permissions you granted. That is the entire contents of our database.

We do not store your product data, your language settings, your file list, your storefront contents, or anything derived from them. Everything the app shows you is read from Shopify at the moment you look at it.

6. What we deliberately do not collect

No customer names, email addresses, shipping addresses, phone numbers or payment details. No order data of any kind, including totals, dates and line items. No browsing or analytics data about the people who visit your storefront. The notice is displayed by your own theme, and the artefacts are served by Shopify's content network, so we never see a shopper's request at all.

Konform uses no artificial intelligence and sends nothing to any AI provider. There is nothing to send: the artefacts are fixed files published by the European Commission.

7. Who else processes your data

Shopify Inc. Your store data lives with Shopify. We access it through their API under the permissions you granted.

Fly.io. Hosts the application and the database holding the shop records described in section 5. Our instance runs in London.

That is the complete list. We use no analytics, advertising, tracking or profiling services, and we do not sell or share your data with anyone.

8. International transfers

Our application and database run in the United Kingdom. Shopify processes data in accordance with its own privacy policy and transfer mechanisms.

9. How we protect your data

All traffic is encrypted in transit. Access tokens are held in an encrypted database reachable only from the application, on a private network with no public address. Access to production systems is limited to Rel8 CX Ltd personnel who need it.

10. How long we keep it

Your shop record is deleted when you uninstall the app. Shopify additionally sends a deletion request 48 hours after uninstall, and we delete on that too, so the record is removed whichever signal arrives.

The artefacts Konform published into your Shopify account are yours and are not deleted. We leave them alone deliberately: removing files from a merchant's account without being asked is more surprising than leaving them, and if you reinstall they are reused rather than uploaded again. You can delete them yourself from your Files area at any time.

11. Your rights

Under the UK GDPR and the EU GDPR you have the right to access, correct, erase, restrict and port your personal data, and to object to processing. Given what we hold, in practice this usually means asking us to confirm or delete your shop record. Write to privacy@rel8.cx and we will respond within 30 days.

If you are unhappy with our response you can complain to the Information Commissioner's Office at ico.org.uk, or to your local supervisory authority in the EU.

12. Changes to this policy

If we change what we access or store, we will update this page and change the date at the top. Material changes will be notified in the app.

13. Contact

Data and privacy: privacy@rel8.cx. Everything else: support@rel8.cx.