Shopify app · Privacy policy
Privacy policy of the Testamur app
1. Who we are
Testamur is a Shopify app that tests a store's public pages for accessibility barriers, maps them to the European standard EN 301 549 and helps the merchant prepare its accessibility statement. It is operated by Sieghart Michielsen, sole proprietorship, De Sevillastraat 84, 2100 Antwerpen, Belgium, enterprise number (KBO/BCE) 1044.458.386 ("we"). Privacy questions: hello@testamur.app.
For the data described here we are the controller, except for the contact details you publish in your accessibility statement, which we host on your instruction as your processor.
2. What we collect
From Shopify when you install the app: your store's myshopify domain, shop id, primary domain and country, and an access token for the permissions the app asks for. Your plan for the app comes from Shopify; Shopify handles payment and we never see card or bank details.
Permissions and why:
- Read themes: to know which theme is live, to re-scan when it changes and to compare its files with verified fixes. We do not change your theme.
- Write products and write files: only for the alt-text assistant, which lists product and collection images without a text alternative and writes the alt text you approve. It never overwrites an existing alt text.
From your public storefront: results of automated accessibility tests on public pages (home, collections, products, cart, policy and legal pages): page addresses, the rules that failed, where in the page code they occur, whether your theme or an app causes them, and the date. We do not log in as a customer and we do not store page text, images or screenshots.
From you: what you enter for your accessibility statement (organisation name, contact email and phone, support channel). If you publish the statement, these details become public on purpose; we recommend a role address such as accessibility@yourstore.com. If your storefront is password-protected and you enter its storefront password so the scan can open it, we store it encrypted, use it only to scan and delete it when you remove it or uninstall. If you connect GitHub, we store the installation id, repository and branch, never a password or a long-lived token. When you apply alt text or a fix, we record what changed, when and by which staff account (as Shopify identifies it), as part of your record.
About your customers: none. Testamur does not request access to customers or orders and does not collect data about people who visit or buy from your store. When Shopify forwards a customer's data or deletion request to us, we record only that it arrived (with Shopify's numeric customer id) and that we hold no data about that customer.
Technical data: server logs with your shop domain, request paths and error messages, and page-speed measurements of the app's admin pages (load times only). No cookies for tracking, no analytics or advertising trackers.
3. Why we use it, and on which legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Providing the app: scans, reports, monitoring, conformance report, statement drafts, alt-text assistant | Contract, Art. 6(1)(b) |
| Hosting your published statement | On your instruction, as your processor (Art. 28) |
| Handling privacy requests sent through Shopify | Legal obligation and legitimate interest in showing we handled them, Art. 6(1)(c) and (f) |
| Security, fixing errors, keeping the app fast | Legitimate interest, Art. 6(1)(f) |
| Accounting | Legal obligation, Art. 6(1)(c) |
We do not sell data, do not use it for advertising and do not use your store's data to train AI models. The app currently sends none of your data to an AI service; if that changes, we update this policy first.
4. Where the data is and who processes it
| Provider | Why | Where |
|---|---|---|
| DigitalOcean LLC | Servers, database and backups, under its data processing agreement | Frankfurt, Germany |
| Shopify | App platform, installation and billing | Shopify's own privacy terms apply |
| GitHub (only if you connect it) | Opening pull requests in the repository you choose | GitHub's own terms apply |
DigitalOcean is a US company; where it could access data from outside the EEA, its data processing agreement uses the European Commission's standard contractual clauses (GDPR Art. 46).
5. How long we keep it
| Data | Kept |
|---|---|
| Scans, reports, conformance reports, statements, change records | While the app is installed; erased after uninstall (section 6) |
| Access token | Deleted when you uninstall |
| Records of privacy and deletion requests (shop domain, dates) | 3 years |
| Server logs | About 30 days |
| Server backups | Up to 5 weeks |
6. When you uninstall
Your test history may be evidence you need later, for example if a market-surveillance authority asks what you tested and published. Before you uninstall, copy your statement text, download the conformance report (Pro plan) or ask hello@testamur.app for an export of your scan history.
When you uninstall, we stop monitoring and delete the access token at once. About 48 hours later Shopify asks us to erase your store's data; we then delete your scans, reports, statements (published statements go offline) and store record. We keep only a record that the request arrived and was completed. Backups that still contain your data expire within 5 weeks.
7. Your rights
You have the right to access, correct, delete, restrict or object to the processing of your personal data, and to data portability (GDPR Arts. 15–21). Write to hello@testamur.app; we answer within one month. For statement contact details we process for you, we help you answer requests you receive.
You can complain to a data protection authority, in particular in your country or ours: the Belgian Data Protection Authority, www.dataprotectionauthority.be.
8. Security
Encrypted connections (HTTPS), Shopify webhooks verified by signature, the smallest set of permissions the features need, no customer data, server access limited to the operator by key, and a database that is not reachable from the internet.
9. Changes
We post changes here with a new date and, for material changes, tell installed merchants in the app.