Privacy Policy — Proofed

Last updated: 4 March 2026

1. Who We Are

Proofed is a Shopify app built and operated by Craig Lubbe t/a Lubbe Labs, based in South Africa.

If you have any questions about this policy or how we handle your data, please contact us:
Email: info@lubbelabs.com

When we say "we", "us", or "our", we mean Lubbe Labs. When we say "merchant", we mean the Shopify store owner who has installed Proofed. When we say "customer", we mean the end customer of that merchant who receives a proof for approval.

2. What Data We Collect

Merchant data

When you install Proofed, we receive the following from Shopify:

Your Shopify store domain (e.g. yourstore.myshopify.com)
Your merchant email address (fetched live from the Shopify API as needed — we do not permanently store this)

Customer data

When one of your orders triggers our system, we collect and store:

Customer name and email address
Order details (order ID, line items)
Proof files you upload on behalf of that order (images or PDFs)
The customer's approval decision (approved or revision requested)
Any revision comments the customer submits

We do not collect payment information, passwords, or any sensitive personal data.

3. Why We Collect It

Data	Purpose	Legal basis (GDPR)
Merchant store domain	To identify your store and route data correctly	Performance of contract
Customer name & email	To send proof approval notifications and link customers to their proofs	Performance of contract (on behalf of merchant)
Proof files	To store and display the design proofs for customer review	Performance of contract
Approval decisions & comments	To give merchants a record of what was approved or revised	Performance of contract / Legitimate interest

We process customer data on behalf of merchants. The merchant is the data controller for their customers' personal data. Lubbe Labs acts as a data processor in that relationship.

4. How Long We Keep Your Data

Data type	Retention period
Merchant store domain	Retained while the app is installed. Deleted within 30 days of uninstall.
Customer name, email, order details	Retained while the app is installed on the merchant's store. Deleted within 30 days of the merchant uninstalling the app.
Proof files (images/PDFs)	Retained while the app is installed. Deleted within 30 days of uninstall.
Approval decisions & comments	Retained while the app is installed. Deleted within 30 days of uninstall.

If a merchant or customer submits a data erasure request, we will action it within 30 days (see Section 8).

5. Who We Share Data With

We do not sell personal data. We do not share data with third parties for marketing purposes.

We use the following sub-processors to operate the app:

Provider	Role	Location
Fly.io	Application hosting and infrastructure	Global
Cloudflare R2	Proof file storage	Global edge (Cloudflare network)
Resend	Transactional email delivery (proof notification emails)	US
Shopify	E-commerce platform; order and merchant data originates here	Global

Each provider processes only the data necessary for their specific function and is bound by their own data processing terms.

6. Your Rights

If you are in the EU or EEA (GDPR)

You have the right to:

Access — request a copy of the personal data we hold about you (Article 15)
Rectification — ask us to correct inaccurate data (Article 16)
Erasure — ask us to delete your data ("right to be forgotten") (Article 17)
Portability — receive your data in a structured, machine-readable format (Article 20)
Object — object to processing based on legitimate interest (Article 21)
Restrict processing — ask us to limit how we use your data in certain circumstances (Article 18)

To exercise any of these rights, contact us at info@lubbelabs.com. We will respond within 30 days.

If you are unsatisfied with our response, you have the right to lodge a complaint with your local supervisory authority.

If you are a California resident (CCPA)

You have the right to:

Know what personal information we collect about you and how it is used
Delete your personal information (subject to certain exceptions)
Opt out of sale — we do not sell personal data, so this right is not applicable

To submit a request, contact us at info@lubbelabs.com.

7. Shopify GDPR Webhooks

Proofed complies with Shopify's mandatory GDPR webhook requirements:

customers/data_request — When a merchant's customer requests their data, we will compile and provide all personal data we hold related to that customer.
customers/redact — When a customer requests erasure, we will permanently delete all personal data associated with that customer from our systems within 30 days.
shop/redact — When a merchant uninstalls the app, we will delete all data associated with their store within 30 days.

8. Cookies and Tracking

We use no marketing cookies and do not engage in any cross-site tracking or behavioural advertising.

We use a minimal session cookie solely to authenticate merchant sessions within the Proofed admin interface. This cookie is strictly necessary for the app to function and does not track you across other websites.

9. Data Security

We take reasonable technical and organisational measures to protect personal data against unauthorised access, loss, or misuse. This includes encrypted data transmission (HTTPS), access controls, and use of reputable infrastructure providers (see Section 5).

No method of transmission over the internet is 100% secure. If you have concerns about the security of your data, contact us at info@lubbelabs.com.

10. Changes to This Policy

We may update this policy from time to time. When we do, we will update the "Last updated" date at the top. If changes are significant, we will make reasonable efforts to notify affected merchants.

11. Contact Us

To exercise your rights, ask a question, or raise a concern about how we handle personal data:

Craig Lubbe t/a Lubbe Labs
Email: info@lubbelabs.com

This policy applies specifically to the Proofed app. Lubbe Labs operates other apps which have their own separate privacy policies.