Privacy Policy
1. Who we are
Cloudlift GmbH, Bächaustrasse 61, 8806 Bäch, Schwyz, Switzerland (CHE-309.805.112) makes apps for Shopify merchants and runs www.cloudlift.app. This policy covers all our apps: they run on one platform and process the same kinds of data. It explains what personal data we process, why, for how long, and with whom.
Contact for privacy questions and requests: privacy@cloudlift.app.
We handle privacy requests from the EU, the EEA and the UK directly from Switzerland, in English or German, at the same address. You can also contact the data protection authority of your country (section 10).
Our role depends on whose data it is. For merchants and their staff, who install our apps, use the app admin or contact support, we are the controller and this policy applies in full. For shoppers who upload a file or personalise a product in a store that uses our apps, the store is the controller and we process their data on its behalf under our Data Processing Agreement; if you are a shopper, please contact the store first. For visitors of www.cloudlift.app, we are the controller.
2. Data we process
| Who | Data | Source |
|---|---|---|
| Merchants | Shop domain and name, shop owner name and email, shop address and country, plan and billing history, app settings and content (configurations) | Shopify when you install, and you |
| Merchants and staff | Support conversations, emails with us | You |
| Merchants and staff | Usage events in the app admin, IP address, browser and device | The app |
| Shoppers (for the store) | Uploaded files and file names, personalisation and option choices, order and Shopify customer references, the order details Shopify sends with a new order, IP address and browser in logs. An email typed for a guest save goes straight to Shopify; we do not store it. Details in DPA Annex 1 | The shopper, Shopify |
| Website visitors | Pages visited, IP address, browser | You, Shopify (our website runs on Shopify) |
We do not receive payment card details: Shopify bills app charges. We do not intend to process special categories of data.
3. Purposes and legal bases
For merchant, staff and visitor data we rely on the legal bases below (GDPR Art. 6(1); under the FADP, processing in line with its principles needs no legal basis). Shopper data is processed on the store's instructions under the DPA.
| Purpose | Data | Legal basis |
|---|---|---|
| Providing the apps: install, settings, storage | Merchant, staff, app content | Contract, Art. 6(1)(b) |
| Billing and accounting records | Merchant, plan and charges | Legal obligation, Art. 6(1)(c) (Swiss Code of Obligations Art. 958f) |
| Support and service emails | Merchant, staff, conversations | Contract, Art. 6(1)(b) |
| AI assistant and AI features you use | Your prompts and the content you select | Contract, Art. 6(1)(b) |
| Product analytics to improve the apps | Usage events, IP address | Legitimate interest, Art. 6(1)(f) |
| Website statistics | Pages visited, IP address, browser | Legitimate interest, Art. 6(1)(f) |
| News about our apps to existing customers | Merchant email | Legitimate interest, Art. 6(1)(f); you can unsubscribe in every email |
| Security, abuse prevention, error analysis | Logs, IP address | Legitimate interest, Art. 6(1)(f) |
| Legal claims and requests from authorities | As needed | Legal obligation or legitimate interest |
We do not make decisions with legal or similarly significant effects by automated means only (GDPR Art. 22, FADP Art. 21).
4. How long we keep data
Shopper data follows the deletion schedule in the DPA. Other data is kept as described below.
| Data | Kept for |
|---|---|
| Shopper files, records and order details | As set in DPA section 11 |
| Merchant account, shop and staff records, support conversations | As long as needed to provide our apps to you and support you |
| Billing and accounting records | 10 years (Swiss Code of Obligations Art. 958f) |
| Email lists | Until you unsubscribe or uninstall the app the list belongs to |
| Application logs (IP, browser, request) | Up to 30 days |
| Storage and privacy log of a shop | Up to 365 days |
We keep data longer only where the law requires it or to defend a legal claim, and only for that purpose.
5. Recipients and international transfers
We share personal data only with the providers below, each bound by a written data processing agreement, plus Shopify as the platform. We do not sell personal data.
| Provider | Purpose | Data | Country |
|---|---|---|---|
| Google Cloud | Hosting, database, file storage, logs | All | Customer data in the shop's storage location (US by default, EU or Asia where chosen); app configuration and our own data in the US |
| Google Gemini API | AI features: the AI assistant and AI actions in the app admin, and AI options the merchant enables in the storefront | Prompts and selected content | Global |
| Anthropic | AI features: the AI assistant and AI actions in the app admin, and AI options the merchant enables in the storefront | Prompts and selected content | Contract with Anthropic Ireland; inference worldwide, data stored in the United States |
| OpenAI | AI features: the AI assistant and AI actions in the app admin, and AI options the merchant enables in the storefront | Prompts, when selected | Contract with OpenAI Ireland; inference worldwide, data stored in the United States |
| Brevo | Email lists and service emails | Merchant email, shop details | EU (France) |
| Google Workspace | System and report emails | Merchant email | US |
| Help Scout | Support desk and in-app help | Merchant contact, shop, plan, conversations | US |
| Mixpanel | Product analytics | Usage events, shop, email | US |
| Google Analytics | Website statistics | Pages visited, IP address, browser and device of website visitors | US |
The providers that process shopper data for stores are listed, with their entities and transfer safeguards, on our subprocessor page.
Shopify receives data as the platform our apps run on and is an independent controller (Shopify privacy policy). A guest save creates the shopper as a customer in the store's Shopify account.
Transfers. Switzerland, the EU and the UK recognise each other as adequate. For the US we rely on the EU-US and Swiss-US Data Privacy Framework where the provider is certified, otherwise on the EU Standard Contractual Clauses with the Swiss and UK amendments.
We also disclose data where the law or an authority requires it, and to a buyer of our business, after notice to you.
6. AI features
AI runs only when a store enables an AI option or a merchant uses an AI action or the assistant. If no AI feature is enabled, no uploaded files, file names or order data are sent to AI providers. Conversion, colour changes and print exports run on our own servers.
If you are a shopper and the store offers an AI option (for example "generate an image" or "remove the background"), your prompt and image go to the AI provider the store has connected, to produce the result.
If you are a merchant, the AI assistant and AI actions in the app admin send your messages and the content you select (configurations, product data, and files you point it to) to the model provider you chose, listed on our subprocessor page.
We do not use your data or your shoppers' data to train AI models. AI output is a suggestion, and we do not let AI alone decide anything about a person.
7. Cookies and browser storage
Our apps in a store use only the cookies and browser storage needed for the feature you use, for example to keep the files of your visit together or to show option prices in the cart. They load no analytics or advertising scripts, so they need no consent banner of their own.
The app admin runs inside Shopify admin and uses Shopify's session. Our website www.cloudlift.app runs on Shopify, which sets its own cookies (Shopify cookie policy), and uses Google Analytics for visit statistics.
8. Your rights
Under the GDPR, the UK GDPR and the Swiss FADP you have the right to:
- get a copy of your personal data and information about its processing;
- have incorrect data corrected;
- have your data deleted, or its processing restricted;
- receive data you gave us in a machine-readable format, or have it sent to another provider;
- object to processing based on our legitimate interest, and to direct marketing at any time;
- withdraw a consent at any time, without affecting earlier processing.
Write to privacy@cloudlift.app. We answer within one month (30 days under the FADP) and may ask you to confirm your identity first.
Shoppers: the store you bought from decides about your data. Ask the store; it can delete your files in our app or erase your customer data in Shopify, which tells us to delete your files. If you write to us, we forward your request to the store.
9. California residents (CCPA/CPRA)
For shopper data we act as a service provider to the store and process it only for the store's business purposes under a written contract. We do not sell personal information and do not share it for cross-context behavioral advertising.
10. Security, changes and complaints
Security. We protect data with the measures in DPA Annex 3. No system is perfectly secure.
Changes. We publish changes on this page with a new effective date. For material changes we tell merchants in the app or by email before they take effect.
Complaints. Please contact us first. You may also complain to a data protection authority, for example the FDPIC in Switzerland.
Effective date: 2026-11-01. Version 1.0.