Privacy Policy

Last updated: August 2026

This Privacy Policy explains how we handle personal data in connection with the Metafield Forge website (metafieldforge.com) and the Metafield Forge app for Shopify (the “App”).

The website

• Contact: if you email us, we process your email address and message content to reply.
• Server logs: our hosting provider may record standard technical data (IP address, browser, pages requested) for security and to keep the site running.
• No tracking: we do not use analytics, advertising or profiling cookies. Fonts are self-hosted, so the site makes no third-party requests. See the Cookie Policy.

The App

When a merchant installs the App, we process data from their Shopify store to provide metafield management. For this store data we act as a data processor on the merchant’s behalf.

• Store & metafields: store domain and the metafield definitions and values you view or edit for products, variants, collections, pages and customers.
• Customer personal data: when you use the Customers section, we read customer identifiers (such as name and email) from the Shopify Admin API solely to display and edit their metafields. We do not build profiles or use this data for any other purpose.
• Sessions: we store your store’s offline access token/session in our database so the App can work; this is required for the App to function.
• Feedback: if you send a report from the App, we store the store domain, your message and any optional contact email you provide.
• Store sync: short-lived pairing codes you generate to sync data between your own stores.

Where data is stored & subprocessors

The App runs on DigitalOcean (hosting and database) and relies on Shopify for the underlying store data and API. Data is encrypted in transit (HTTPS) and at rest.

Retention

We keep session data only while the App is installed. When you uninstall the App, related data is deleted through Shopify’s app-uninstall and data-erasure (GDPR) webhooks. Feedback is kept until no longer needed to support the App.

Your rights

Under the GDPR you may request access to, correction or deletion of your personal data. For customer data held in a merchant’s store, requests are handled through Shopify’s data-request and redaction flows. To exercise your rights, contact support@rossimax.it.

Changes

We may update this policy; the “Last updated” date reflects the latest version.