Privacy Policy

Effective date: July 31, 2026

This Privacy Policy describes how StreamVault ("StreamVault", "we", "us") collects, uses, and protects information in connection with the StreamVault website (streamvault.cloud) and the StreamVault app for Shopify (the "Service"). StreamVault helps Shopify merchants deliver digital products to their customers through secure, time-limited download links.

The two roles we play

For merchants who install the StreamVault app, we act as a service provider (a "data processor") handling their store's data — including their customers' personal data — on their behalf and under their instructions. Each merchant remains the data controller for their customers' personal data. For visitors to this website and for merchant account information, we act as the data controller.

Information we collect from merchants

• Store information: your Shopify store domain and the access token Shopify issues when you install the app, used solely to operate the Service for your store.
• App settings: your cloud storage configuration (provider, region, bucket, optional endpoint), email sender name and address, and default download limits and expiry settings.
• Storage credentials: the access keys for the cloud storage bucket you connect. These are encrypted at rest and used only to generate download links for your files.

Information we process about merchants' customers

When a customer buys a digital product from a store using StreamVault, we process, on the merchant's behalf:

• Order details: the Shopify order ID, customer ID (when available), and the digital items purchased.
• Contact details: the customer's email address, used to deliver download links.
• Download activity: download link tokens, timestamps, IP address, browser user agent, and success/failure of each download attempt. This is used to deliver files, enforce download limits and expiration, prevent abuse (such as rate limiting and shared-link detection), and give the merchant support and reporting tools.

We never collect or process payment card details. Payments are handled entirely by Shopify and the merchant's payment providers.

Information we collect on this website

If you use the contact form, we receive the name, email address, and message you submit, and we use them only to respond to your inquiry. This website does not use analytics or advertising trackers.

How we use information

• To operate the Service: generate secure download links, deliver them on the order confirmation page, by email, and in the customer's account, and mark orders fulfilled.
• To enforce merchant-configured download limits and link expiration.
• To protect the Service and merchants' storage from abuse (for example, rate limiting and invalid-link detection).
• To provide merchants with dashboards, download history, and support.
• To respond to inquiries and provide customer support.

We do not sell personal data, and we do not use it for advertising.

Sharing and subprocessors

We share data only with the infrastructure providers required to run the Service:

• Fly.io — application hosting (United States).
• Supabase — managed PostgreSQL database hosting (United States).
• SMTP2Go — transactional email delivery for download link emails.
• Shopify — the platform the app runs on, per Shopify's own privacy policy.
• Your storage provider — digital files themselves stay in the merchant's own cloud storage bucket (for example Amazon S3 or an S3-compatible service). StreamVault generates short-lived, signed URLs so files are served directly from the merchant's storage.

Data retention and deletion

We retain merchant and customer data for as long as the app is installed and as needed to provide the Service (for example, keeping download links valid and history available to the merchant). We honor Shopify's mandatory privacy webhooks: when a customer requests their data or requests deletion through their merchant, and when a shop uninstalls the app, we respond to Shopify's customers/data_request, customers/redact, and shop/redact requests within the timelines Shopify requires.

Security

• All traffic to the Service is encrypted with TLS (HTTPS).
• Merchant storage credentials are encrypted at rest.
• Download links use unique, cryptographically random tokens, expire automatically, and enforce download limits.
• Public download endpoints are rate limited to deter abuse.

International transfers

The Service is hosted in the United States. If you access it from elsewhere, your information will be processed in the United States.

Your rights

Depending on where you live, you may have rights to access, correct, or delete personal data. If you are a customer of a store that uses StreamVault, please contact that store first — they control your data, and we will assist them in fulfilling your request. Merchants and website visitors can reach us through the contact form.

Children

The Service is not directed at children under 16, and we do not knowingly collect their personal data.

Changes to this policy

We may update this policy from time to time. Material changes will be reflected on this page with an updated effective date.

Contact

Questions about this policy or our data practices? Reach us through the contact form on our homepage.