Security and GDPR FAQ
About this page
Last updated: 2026-11-01.
This page answers questions that merchants and their data protection advisers often ask about our apps. It is for information only and is not part of our Terms of Service or our Data Processing Agreement (DPA). Where this page and the DPA differ, the DPA applies.
Which documents apply to me?
Our Terms of Service, the DPA and the subprocessor list, which is Annex 2 of the DPA. They apply to every merchant from installation, and each shows its date. No signature is needed; we provide a signed copy of the DPA on request. Our Privacy Policy covers the data of merchants and their staff.
Who is Cloudlift?
Cloudlift GmbH, Bächaustrasse 61, 8806 Bäch, Switzerland (CHE-309.805.112). The European Commission and the UK recognise Switzerland as providing adequate data protection, so a transfer from the EEA or the UK to us needs no further safeguard. For shopper data we act as your processor under the DPA.
Where is my customers' data stored?
In your shop's storage location: the United States by default, or the European Union or Asia where offered and chosen. App configuration data is kept in the United States. The subprocessor list names each provider, its location and the transfer safeguard it relies on.
How are uploaded files protected?
- All traffic is encrypted in transit (HTTPS), and stored data is encrypted at rest.
- Files are stored under random identifiers that cannot be guessed.
- The link to a working copy is shared only with the cart and order it belongs to. Working copies expire after at most 30 days, and deleting a file disables its link at once.
- The links do not rely on a sign-in because shoppers often order as guests without an account.
- Archived files are kept in private storage and are reachable only through the app admin, which opens only from your Shopify admin.
- Production access is limited to authorised Cloudlift staff who need it for their work.
The full list of measures is in Annex 3 of the DPA.
Is any data sent to AI providers?
Only when an AI feature is used: the AI assistant or an AI action in the app admin, or an AI option you enable in your storefront. If no AI feature is enabled, no uploaded files, file names or order data are sent to AI providers. We do not use your data or your shoppers' data to train AI models.
How long do you keep data?
- Working copies of uploaded files and other temporary data: at most 30 days.
- Archived files: until you delete them or your storage retention setting removes them.
- Files you delete in the app, or that a Shopify customer erasure covers: offline at once, removed from storage within 7 days.
- After you uninstall: when Shopify sends us its shop deletion notice, the shop's data is deleted or made permanently inaccessible, and files are removed from storage within 7 days of that notice.
- Backups and application logs: at most 30 days. The log of deletion requests: up to 365 days, as proof of the deletion.
Section 11 of the DPA sets these periods.
Can I get my data back before I leave?
Yes. When the Services end, you choose whether we return your data or delete it: download your archived files in the app, one by one or as a ZIP, or ask privacy@cloudlift.app for an export. You can change your choice until the Services end. If you make no choice, we delete the data and, on request, confirm the deletion in writing. You can also ask us to delete your shop's data at any time, without waiting for Shopify's requests.
How do shopper access and deletion requests work?
You decide, as the controller. In the app you can find and delete a shopper's files. When you erase a customer's data in Shopify, Shopify tells us and we delete that customer's files. For other requests, including from guests without a customer account, you can find and delete the files of an order in the app, and we help on request. If a shopper writes to us, we refer them to you.
How do you tell me about new subprocessors?
We update the list at least 14 days before a new or replacement subprocessor starts processing your customers' data, announce the change with a notice in the app admin, and send an email if you ask for it at privacy@cloudlift.app. You may object within those 14 days on reasonable data protection grounds.
Can I audit you?
Yes. Once a year you can ask for the information you need to verify that we meet the DPA. A further audit is possible after a personal data breach affecting your data, when a supervisory authority requires it, or when that information is not enough. Section 8 of the DPA sets the details.
What happens in a data breach?
We notify you without undue delay, and where feasible within 48 hours, at your shop's contact email, with the information Art. 33(3) GDPR requires. We help you meet your own notification duties.
What if an authority asks for data?
We process your customers' data without your instruction only where EU or Member State law, or Swiss law, requires it. We disclose only the minimum the law requires and tell you, unless the law forbids it.
What should my own privacy notice say?
That you use Cloudlift as a processor for file uploads and product personalisation, where the data is stored, and how long you keep it, with a link to our DPA or subprocessor list.
Contact
privacy@cloudlift.app, in English or German.