Privacy policy

Customei is a product of Nexlify (“Customei”, “we”, “us”). This policy covers the Customei marketing website, the Customei app that merchants install on Shopify, the storefront widget that app renders on a merchant’s product pages, and the back-office and programmatic interfaces that go with them.

It does not cover a merchant’s own store. Once a shopper is on a merchant’s storefront, that merchant’s privacy policy governs their relationship with the shopper, and Shopify’s policy governs the platform underneath. We are one processor inside that arrangement, not the shop.

Data-protection law asks whether a company decides why data is used (a controller) or only handles it on someone else’s instructions (a processor). Customei is both, depending on whose data it is.

Controller (for merchants)

The account you create, the store you connect, your billing and usage, and the emails you send us. We decide what to collect and why, and this policy is your notice.

Processor (for shoppers)

The personalization a shopper types or uploads on a merchant’s storefront, and the order it becomes. We hold and render it on the merchant’s instructions. If you are a shopper asking us to find, change or delete something, start with the store you bought from. They are the controller, and we act on their request.

The pages you are reading now are a marketing site. There is no login and no account, and you can read every page without telling us who you are. Three things still run in your browser:

Microsoft Clarity

Product analytics with session replay. It records page views, clicks, scrolling and cursor movement, and reconstructs them as a replay of the visit, along with a device and approximate location derived from your IP address. It is what tells us which parts of a page people actually read. It runs on every page of this site.

Featurebase

The feedback and changelog widget, loaded only when it is switched on for the deployment you are visiting. If you open it and write to us, it collects what you submit.

Hosting logs

The site runs on Vercel, which keeps the ordinary request logs any web host keeps (IP address, user agent, the path requested and the response) for operating and protecting the service.

Two things this site deliberately does not do. Web fonts are served from our own domain rather than fetched from Google at page load, so reading a page does not announce you to a font CDN. And the editor demo on the homepage runs entirely in your browser: the artwork you build, the text you type and any photo you drop into it are rendered on your own device and never uploaded. This site has no upload endpoint at all.

The one exception is the map and star-map demos. When you search for a place, that search term, and only that term, is passed through our server to Mapbox so it can return coordinates and a map image. We do not store the query or the result.

When you install Customei on a Shopify store we create an account and a record of the shop, and we keep what is needed to run and bill the service:

Your account

Email address, name and avatar. If you sign in with a password rather than through Shopify, we store a hash of it and never the password itself.

Your store

Shop name and display name, myshopify domain, Shopify shop ID, the store contact email and timezone, the platform, and the Shopify user ID of whoever installed the app.

Your work

The templates, option sets, design layers, fonts, colours and library assets you build, and the images you upload into your library.

Billing and usage

Your plan and subscription state, trial state, credit balance and transactions, usage-fee records, and metered counts such as renders and API calls.

Access and audit

Sessions, OAuth grants and personal access tokens issued to AI clients and scripts, and an audit log of the calls those tokens make.

Support

Whatever you put in an email to us, and the address you sent it from.

If you attach your own API key for a third-party image service, that key is encrypted before it is stored and is verified against the provider that issued it before we accept it.

This is the part that matters most, so here it is in full. When a shopper personalizes a product and places the order, Shopify sends us the order and we keep the parts needed to produce and support it.

The personalization itself

Every value the shopper entered (names, dates, messages, coordinates, chosen colours and options), together with any photo or artwork they uploaded, the preview image generated from it, and the production file rendered for the printer. This is free-text and free-upload, so what it contains is whatever the shopper chose to put on a mug.

The order it belongs to

Order name and number, order notes and tags, currency, line-item prices, discounts, tax and totals, financial and fulfilment status, and the timestamps around them: what a merchant needs to find the order, produce it and be paid for it.

Not the shopper’s identity

We do not store the buyer’s email address, phone number or Shopify customer ID against an order, and we no longer store the full order payload Shopify sends. The app used to hold all four, and it stopped: nothing in the product ever read them, and an identity nobody reads is a liability rather than a feature. Those columns are now cleared on every write.

Production state

The status of each line item through rendering, proofing, printing and shipping, and the audit trail of changes to it.

The delivered webhook body, briefly

Every webhook Shopify sends is stored exactly as delivered, because that record is what stops a re-delivery being processed twice, and an order body nests the customer object, both addresses and the browser IP. So this is the one place a buyer’s identity still lands. It is emptied ninety days after delivery by a scheduled job, and immediately when an erasure request arrives; see “How long we keep it”.

We do not receive card numbers or any payment instrument. Payment is handled by Shopify and its payment providers, and never reaches Customei.

We use this data to render artwork, deliver print files, show the merchant their orders, support them when something goes wrong, and meter the plan. We do not sell it, we do not share it with advertisers, and we do not use a merchant’s or a shopper’s content to train machine-learning models of our own.

A Shopify app can only reach what its access scopes allow, and the list is worth publishing rather than paraphrasing. Customei requests:

Customei runs on infrastructure we do not own, and some features work by calling a specialist service. These are the companies that can process data on our behalf:

The image services above are the only ones that receive shopper-uploaded photographs, and only for the image the action was invoked on. Nothing is sent to them in the background.

When this list changes we update it on this page, and we tell merchants before a new sub-processor begins handling their data rather than after.

A private bucket, asserted at boot

Uploads and rendered print files are stored in a private Cloudflare R2 bucket. The service checks at startup that the bucket is not public and refuses to start if it is, so a misconfiguration takes the service down rather than quietly exposing customer artwork.

Signed, expiring links

Files are handed out through signed URLs with a limited lifetime rather than guessable public paths.

Encrypted in transit

Traffic to and from Customei is HTTPS, including the calls the storefront widget makes.

Secrets at rest

Merchant passwords are stored as hashes. Merchant-supplied provider keys and third-party OAuth tokens are encrypted before storage.

Scoped, logged programmatic access

OAuth clients and personal access tokens carry scopes, can be revoked, and every call they make is written to an audit log.

We would rather describe the controls we have than the certifications we do not. Customei does not currently hold a SOC 2 or ISO 27001 attestation, and this page will say so until that changes.

While the app is installed

Orders, personalization values, uploads and rendered files are kept so the merchant can reprint, reissue and answer a customer about an order they placed months ago. Deleting them sooner would break the job the app is installed to do, so there is no automatic expiry on them today.

When a shopper asks

A customer-redact request from Shopify is carried out when it arrives rather than on a queue: in one operation it clears the buyer’s identity from the orders the request names and from the stored webhook bodies for that store. A request relayed to us by the merchant is completed within 30 days.

Delivered webhook bodies

Emptied ninety days after delivery by a daily job. The row survives, because it is what stops Shopify re-delivering the same webhook twice, but the payload it carried is replaced with an empty one.

Library files a merchant deletes

Removed from view immediately, then hard-deleted and scrubbed from storage 30 days later by a daily purge, so a deletion made by mistake can still be undone inside that window.

After a merchant uninstalls

Shopify sends us a shop-redact request 48 hours after uninstall, and we complete it within the 30 days Shopify allows. Today we do that by hand: the request is received and recorded, but no job yet erases a store on its own. We would rather tell you it is a manual process than imply an automation that does not exist, and automating it is work in progress.

Records we must keep

Billing and tax records are retained for as long as the law requires, even after an account closes.

A retention window for shopper uploads and rendered print files is being introduced, so that files nobody has asked about stop accumulating for ever. It is not switched on yet, and merchants will be told the window before the first deletion: a purged print file is gone, and re-rendering an old order runs today’s template through today’s pipeline rather than reproducing the file that was actually sold.

Where a request would conflict with a legal obligation to retain something, we keep the minimum the obligation requires and delete the rest.

Depending on where you live, you may have the right to ask for a copy of your data, correct it, delete it, restrict or object to how it is used, take it elsewhere in a portable form, and withdraw a consent you gave. You also have the right to complain to your local data-protection authority.

If you are a merchant

Email us and we will handle it directly. We answer within 30 days.

If you are a shopper

Ask the store you bought from. They can raise it with us through Shopify, and Shopify has a built-in path for exactly this. If you write to us directly we will help, but we will usually need the merchant to confirm the request, because the data is theirs to direct.

Data processing agreement

Merchants who need a DPA in place can request one by email and we will work through it with you.

Shopify requires every app to handle three privacy requests, and what happens to each of them differs enough to be worth saying. A request to delete a customer’s data is automated and runs the moment it reaches us. A request to view stored customer data is acknowledged, and the merchant answers it from Shopify’s own record of the order, because the app no longer holds a buyer identity to export. A request to delete a store’s data is handled by hand, within the 30 days Shopify allows.

Customei runs as a single global deployment. Our storage is one Cloudflare R2 account, and the sub-processors listed above operate internationally, so data may be processed outside the country you are in, including outside the EEA and the UK. Where that involves a transfer that needs a safeguard, we rely on the standard contractual clauses in our agreements with those providers.

There is no region or residency setting today. We cannot pin a store’s uploads to the EU, or to anywhere else, and we would rather tell you that than imply an option that does not exist. If this is a blocker for you, say so. Knowing who needs it is how it gets built.

The app uses cookies that are necessary to keep you signed in and to keep a session attached to the right store. Those cannot be turned off without breaking the app.

This marketing site additionally loads Microsoft Clarity, described above, which sets its own identifiers to stitch a visit together. It currently loads on every visit rather than behind a consent prompt. You can stop it at the browser level with a tracker blocker or a Do Not Track / Global Privacy Control signal, and Microsoft publishes its own opt-out.

Customei is a tool for businesses and is not directed at children. We do not knowingly collect data from a child. If you believe a child’s personal data reached us through a personalized order, tell us and we will remove it.

When this policy changes we update the date at the top of the page. If a change materially affects how we handle merchant or shopper data, we will tell merchants in the app or by email rather than relying on you to re-read the page.