1. Introduction
This Privacy Policy explains how Lowcora ("Lowcora", "we", "us") processes personal data when you visit our websites, install or use the Lowcora Backup & Restore Shopify app, or contact us for support. We process data for business merchants who use Shopify stores. We do not sell personal data and we do not use store data for advertising or to train generalised machine-learning models.
2. Data controller
The data controller for the processing described in this policy (except where we act as a processor — see section 3) is:
Sultan Murat Ebeş, self-employed individual (autónomo) established in Spain
Carrer Del Peix, 43892 Mont-roig del Camp, Tarragona, Spain
Privacy and support contact: murat@lowcora.com
Support community: Discord
No data protection officer is appointed. We are established in Spain; an EU representative under GDPR Article 27 is not required for that reason.
3. Two roles: processor and controller
We are a processor for store content we copy from Shopify on the merchant's instructions (products, catalogues, content, themes, files, and — when the installed app has been granted those permissions — customers, orders, draft orders and gift cards). The merchant is the controller for its customers, staff and anyone else named in that store data. The merchant decides the legal basis for collecting that data. Our Data Processing Agreement covers this processing.
We are a controller for our own activities: app install and session, agency sign-in, security and operations logs, billing status held in the app, support messages, and visits to our websites.
If you are a customer of a Shopify store that uses Lowcora, contact that store. If a request reaches us, we forward it to the merchant and we run the Shopify privacy webhooks described in section 10 to the extent the app is configured to receive them.
4. Categories of personal data we process
- Store connection: store domain, granted scopes, Shopify access and refresh tokens.
- Store content (processor): products, collections, pages, blogs, menus, files, images, themes, translations, discounts, and other types allowed by the granted scopes; customer and order content only when those scopes are granted.
- Billing status: plan name and subscription status returned by Shopify Billing. We do not store full payment card numbers.
- Agency account: email, hashed sign-in token, session cookie, IP address used for rate limiting.
- Usage and security: server logs (IP address, user agent), feature use needed to operate the service, error reports, restore and activity records (action, time, actor such as store domain or "system", counts and job identifiers).
- Communications: messages you send to murat@lowcora.com or via Discord support.
- Optional export: a ZIP of the latest backed-up types plus media bytes, sent only to a destination the merchant connects (for example Google Drive or an S3-compatible bucket).
Free-text fields in store content can contain whatever the merchant or its customers typed. We do not ask for special-category data. We do not receive customer passwords or full payment-card numbers.
5. Purposes and legal bases
- Providing backup, versioning, restore and optional export — for store content we act on the merchant's instructions under the DPA; for the merchant contract itself, GDPR Art. 6(1)(b).
- Billing and accounting records when billing is enabled — Art. 6(1)(b) and, where tax law requires a record, Art. 6(1)(c).
- Security, fraud prevention and abuse monitoring — Art. 6(1)(f), legitimate interest in keeping a multi-tenant backup service safe.
- Service communications (transactional notices, material policy updates) — Art. 6(1)(b) and 6(1)(f).
- Website server logs and necessary session cookies — Art. 6(1)(f).
Installing the app requires a Shopify store and the OAuth grant for the published scopes. Without that grant we cannot take backups. Connecting Google Drive, setting an alert email, and creating an agency login are optional.
We do not profile individuals and we do not make decisions based solely on automated processing that produce legal or similarly significant effects for a person.
6. Sources of data
Most data is collected from you when you install the app, sign in as an agency user, or contact us. When you connect a Shopify store, additional data is received from Shopify on your instructions. Optional export destinations (Google Drive, S3) receive data only after you connect them.
7. Recipients and processors
We share personal data only with processors that act on our documented instructions and offer appropriate safeguards:
- Shopify — store authentication, Admin API, webhooks, app distribution and billing.
- Hetzner Online GmbH — servers and object storage (application host recorded in Germany).
- Google (Drive) — only if the merchant connects Drive; ZIP files land in the merchant's Google account.
- Merchant-chosen S3-compatible storage — only if the merchant saves those credentials.
- Discord — if you join our support community or if operational health alerts are configured to a webhook.
- Email delivery — only if SMTP is configured for transactional mail; not used until configured.
We do not sell personal data and we do not share it for third-party advertising.
8. International transfers
Application storage for the live service is hosted in the European Economic Area (Germany). Some recipients may process data outside the EEA (for example Discord in the United States, or Google when Drive is connected). Where a transfer leaves the EEA, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (2021/914) and, where relevant, supplementary technical measures, or on the merchant's own choice of destination for optional exports.
9. Retention
- While the app is installed: backup versions are thinned by a nightly job (recent versions kept more densely; older versions sparsely) and removed when older than the store's retention period, except the newest version and versions still referenced by a restore item. Paid plans are configured for 365 days of history unless otherwise stated in the plan.
- Uninstall: schedules stop. Uninstall alone does not delete stored backups, tokens or export destinations.
- Shopify shop/redact: when Shopify delivers this webhook and the job completes, we clear store keys and tokens, delete objects under that store and delete the store row (subject to technical limits described to merchants in the DPA).
- Billing records: kept as long as Spanish accounting rules require (typically up to 10 years) when billing is enabled.
- Security logs: up to 12 months where retained.
- Support correspondence: up to 24 months after the case is closed, unless a longer period is required.
- Agency session cookie: 7 days. Agency sign-in link: 15 minutes.
- Copies already uploaded to Google Drive or S3 are controlled by the merchant's destination; uninstall or disconnect does not delete those remote files.
10. Shopify privacy webhooks
When Shopify delivers compliance webhooks to the app, the code:
- customers/data_request — builds an encrypted export of the latest matching customer-tagged resources for the merchant's process.
- customers/redact — deletes matching customer resources, listed orders, their versions and related blobs to the extent stored.
- shop/redact — clears credentials and deletes the store's stored backup objects and row as implemented in the erasure job.
These webhooks are configured on the public App Store app. Historical copies in merchant-controlled Drive/S3 buckets and encrypted database dumps are subject to the limits described in section 9 and the DPA.
11. Google API Services — Limited Use
Drive export is optional. The app requests only the Google scope https://www.googleapis.com/auth/drive.file. Lowcora's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data to develop, improve or train generalised AI or machine-learning models, and we do not sell it. Disconnecting Drive removes our stored token row; it does not delete ZIP files already in the merchant's Drive.
12. Security
We apply technical and organisational measures appropriate to a backup service, including:
- TLS for app traffic in transit
- AES-256-GCM sealing of backup blobs and media under a per-store key; the store key is wrapped with a master key
- Sealed storage of Shopify tokens and optional export credentials
- Role separation between public pages and the embedded admin app
No method of transmission or storage is completely secure. After becoming aware of a personal-data breach affecting processing we control or perform as processor, we aim to notify the merchant without undue delay and, as a working target, within 48 hours, with the information required under the DPA. Notification of store customers remains the merchant's role.
13. Your rights
Under the GDPR you may have the right to access your personal data, request rectification or erasure, restrict or object to processing, and request portability. Where processing is based on consent, you can withdraw consent at any time without affecting processing that has another basis.
To exercise these rights for data we control, email murat@lowcora.com. Store customers should contact the merchant first. You also have the right to lodge a complaint with a supervisory authority — in Spain, the Agencia Española de Protección de Datos (www.aepd.es).
14. Children
Lowcora is a B2B service and is not directed at children under 16. We do not knowingly collect personal data from children as end users of the app. Store data may include whatever a merchant collected from its own customers; the merchant controls that.
15. Cookies
- vault_agency — strictly necessary session for agency sign-in (HttpOnly, Secure), 7 days.
- vault_lang — language preference when enabled (en / tr / de), up to 1 year.
- We do not use analytics or advertising cookies on the marketing pages described here.
- The marketing pages may load fonts from Google Fonts; the browser then sends a request (including IP address) to Google. The embedded Shopify app is loaded inside Shopify Admin and is subject to Shopify's own cookies.
16. Updates
We may update this policy from time to time. The current version is always available at https://app.lowcora.com/legal/privacy. For material changes we will notify merchants at the contact email associated with the installation where practicable.
17. Contact
Questions about this privacy policy or your rights: murat@lowcora.com
Sultan Murat Ebeş · Carrer Del Peix, 43892 Mont-roig del Camp, Tarragona, Spain