Privacy notice · Updated 15 September 2026
Your designs have a purpose.
Upproof helps Shopify merchants collect artwork, share proofs, record decisions, and prepare personalized products for production. It is operated by Yusuf Alperen ÖZ, Meltem Mahallesi, 3834 Sokak, Özgün Sitesi C4 No: 14, Muratpaşa, Antalya, Türkiye.
The store where you place your order decides why your order and artwork are processed. Upproof handles that information on the merchant’s instructions. The operator separately uses merchant account details, support correspondence, and security records to run the service. Merchant processing terms are described on our Data processing page.
What we receive and why
- From Shopify: shop domain, authentication credentials, and available merchant or staff session details; order, line, product and variant identifiers, quantities, and order information needed to match and check a job. These connect the app to the store and keep work associated with the correct order line.
- From uploads and proof activity: artwork, file names and integrity hashes, customer notes, proof versions, production specifications, approval or revision decisions, comments, and timestamps. These support the design and production workflow. Files and free text may contain personal information.
- From service use and correspondence: monthly proof-job counts, support messages and contact details, and technical request, error and security information. These support plan limits, troubleshooting, service security, and legal obligations. Shopify privacy requests can supply customer and order identifiers to locate affected records.
Collection happens electronically through Shopify, upload and review forms, app requests, and email. No customer account is needed for a design or proof link. Only submit information needed for your order; avoid sensitive personal information.
For processing we determine ourselves, our grounds, where applicable law permits, are performing our agreement with the merchant, complying with legal obligations, and our legitimate interests in providing support, preventing abuse and keeping the service reliable, balanced against your rights. The merchant is responsible for the grounds and notices for its customers’ order data. We do not sell personal information, use it for targeted advertising, or use customer artwork or notes to train AI models.
Who can access information
Merchants access their jobs through Shopify authentication. Anyone holding a valid customer link can access the operation that link permits, so keep links private. The operator can access records when needed for support, maintenance, security, or a data request.
When a merchant chooses to email a link, Upproof reads the recipient’s address from the Shopify order and sends it through Resend. The app does not persist that customer email address in its own job database. Resend processes the recipient, message, private link, and delivery records; its retention is separate from the app’s file cleanup. A merchant may instead send a copied link through its own provider.
Microsoft Azure hosts the app and its data in Belgium. Shopify supplies the store integration and, when enabled, app billing. Resend provides email delivery and stores email data in the United States. Google’s Gmail handles messages sent to our support address. Operation and support access take place from Türkiye. These providers may process data in other countries under their own service arrangements. We may also disclose information where legally required or necessary to protect the service and people from abuse.
These locations may differ from yours. The Data processing terms explain international processing and the need for any applicable transfer safeguards; this notice is not consent to an international transfer.
Security and how long records remain
We use encrypted web connections, authenticated merchant access, scoped customer links, upload structure and active-content checks, and file integrity checks. A hash mismatch holds a stored file from download. These file checks are not malware scanning or a guarantee that an uploaded file is safe.
A job closes when its production is completed, when its order is recorded as cancelled, or after 365 days without any recorded activity. Its source and proof files are deleted 90 days after closure, and the rest of the job — notes, production specifications, decisions, comments, proof history, file records and usage records — is deleted 180 days after closure. The longer second period lets the merchant answer a late payment dispute with the approval record. Uploads that never become part of an order are deleted within nine days.
Deletion runs automatically once a day. A job whose closing date cannot be read is kept for review rather than deleted on a guess. Shopify customer- and shop-redaction requests are handled sooner, as described below. Support and security records are retained as needed to resolve the issue, protect the service, and meet legal obligations; records of completed privacy requests are kept as evidence that the request was handled.
Downloaded files, printed production cards, merchant messaging copies, and recovery copies are separate from the live app. A live-file purge does not recall those copies. Deletion requests must account for recovery copies and must be reapplied before restored data is returned to service. Contact us about a specific record or recovery copy.
Your requests and choices
For order information, start with the store where you purchased. The merchant can use Upproof’s data-request inventory to help respond; the app does not automatically send a response to you. You can also contact us below. We may ask for proportionate information to verify your identity and locate the record; do not send passwords, private links, or artwork in your first message.
Shopify customer-redaction requests remove affected artwork and proof files, file names and hashes, production specifications, customer notes, and revision comments. Job records can still contain order and line identifiers, status and decision timestamps, and usage counts; those identifiers can remain linkable by the merchant and are not described as anonymous. Contact us if your request also concerns these remaining records. Shop-redaction requests remove that store’s files, app records and sessions. Failed file deletions remain retryable.
Depending on applicable law, you may ask whether we process your data, obtain access or a copy, learn the purposes and recipients, correct inaccurate data, request deletion or restriction, object to processing, request portability, or withdraw consent where consent is used. Where Turkish Law No. 6698 applies, rights also include requesting notification of correction or deletion to recipients, objecting to a result against you based exclusively on automated analysis, and seeking compensation for unlawful processing. You may complain to the relevant data protection authority. We respond within the period required by applicable law.
Contact and updates
Email upproofsupport@gmail.com.
You can also write to Yusuf Alperen ÖZ at the postal address above. We update this notice when our practices change and show the revision date here; material changes will be brought to merchants’ attention through the app or a service notice.