Privacy Policy for SerializeIt

Last updated: 15 August 2026 · Provider: TGProd, Netherlands · Contact: tom@tgprod.dev

SerializeIt (the "App") is a Shopify admin app for serial number tracking, serialized returns, and warranty management. It is built and operated by TGProd ("we", "us", "our"), a business established in the Netherlands and the operator of tgprod.dev. This policy explains what data the App accesses, what it stores, who it is shared with, how long it is kept, and what rights you have.

This policy is written for two audiences: merchants who install the App, and customers of those merchants who register a product for warranty. If you registered a product you bought and want to know what we hold about you, read sections 3, 5 and 8.

1. Our role

When a merchant installs the App, the merchant is the data controller for their store and customer data. We act as a data processor on their behalf, processing data only to provide the App's functionality and only as instructed by the merchant and permitted by Shopify.

This matters if you are a shopper who registered a product: the store you bought from decides what is collected and why. We hold the record for them. You can contact either of us — see section 8.

2. What the App accesses from Shopify

Using only the access scopes a merchant grants at install, the App reads:

  • Products, variants, and inventory, and the store's locations
  • Orders, line items, and fulfillment status, including historical orders
  • Refunds, so returned serialized units are freed automatically
  • Customer name, email, and shipping address on an order — read on demand when a merchant prints a document for an order or generates a CSV export. This data is not otherwise stored (see section 3)
  • Staff identity and session tokens issued by Shopify when a merchant authenticates, so the App can operate on the store

3. What we store — and what we deliberately do not

Store data. Per shop, we store the serial numbers you create and their status, the Shopify identifiers (order, line item, product, variant, location) that link a serial to where it lives, serialized return records, warranty policies and their product assignments, your app settings and API keys, and Shopify session tokens. Apart from the identifiers, none of this contains personal data about shoppers — no names, no emails, no addresses.

Warranty registrations. If a merchant enables warranty registration, customers of that store can register a product they have bought. When they do, we store on the merchant's behalf: the email address they provide, their name if they choose to give it (it is optional), the serial number of the unit registered, the order reference where one exists, the purchase date, and the warranty start and expiry dates that applied at the time of registration. This is the only place the App stores personal data about a shopper.

Exports. When a merchant generates a CSV export, the file is written to our file storage and returned through a signed link that expires after one hour. Depending on the columns selected, that file may contain customer names, email addresses, and shipping addresses taken from the store's orders. Export files are retained until deleted at the merchant's request — see section 6.

Printed documents are rendered on request and are not stored by us.

Error reports. When something fails, the App sends a diagnostic report containing the error message, stack trace, a short context label, and the shop domain. Request bodies, customer names, and email addresses are deliberately not included.

Storefront visitors. Registration and serial-lookup requests arrive through Shopify's app proxy. We use Shopify's bot-detection signal and a per-store rate limit to block abuse; we do not store visitor IP addresses or set our own tracking cookies. Our hosting provider's server logs may contain IP addresses transiently, as any web host's do.

4. How we use data

We process data solely to provide the App to the merchant, namely to:

  • Create, assign, and track serial numbers across orders, inventory, and returns
  • Print serial labels, certificates, and related documents
  • Apply warranty policies and calculate warranty coverage and expiry
  • Record warranty registrations and show the merchant who owns which unit
  • Trigger the merchant's own Shopify Flow automations on registration
  • Export data at the merchant's request
  • Operate, secure, debug, and improve the App

We do not sell personal data. We do not share it for cross-context behavioural advertising, we do not use registration data for our own marketing, and we do not profile shoppers or make automated decisions about them.

We may contact merchants with service messages about the App, such as breaking changes, incidents, or billing.

5. If you registered a product for warranty

We hold the fields listed in section 3, and nothing else. We use them only to record who owns a registered unit and to show that record to the store you bought from.

Who to contact. The store you registered with is responsible for this data. Ask them first — they can correct or delete your registration directly. You can also write to tom@tgprod.dev and we will act on the merchant's instruction, or forward your request to them if we cannot identify your store.

6. How long we keep data

  • Warranty registrations are kept until the merchant deletes them, the merchant uninstalls the App, or an erasure request reaches us.
  • Store data (serials, warranty policies, returns, settings, sessions) is kept for as long as the App is installed.
  • On uninstall, Shopify sends a shop/redact request approximately 48 hours later. On receipt we permanently delete every database record we hold for that store, including all warranty registrations.
  • Export files in our file storage are not covered by that automatic deletion. Their links expire after one hour, but the files persist. Email tom@tgprod.dev to have a store's export files erased and we will delete them.

7. Shopify's mandatory privacy webhooks

The App implements all three, HMAC-verified:

  • customers/data_request — we gather every warranty registration held for that email address so the merchant can answer their customer's access request.
  • customers/redact — we delete the registration record outright rather than blanking its fields. A row keyed to a person with their name and email nulled is still a record that they registered something, so erasure means deletion. The warranty itself stays with the merchant: the policy, start date, and expiry live on the serial and contain no personal data. Only the record of who owns the unit is removed.
  • shop/redact — deletes all data for the store, as described in section 6.

8. Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict, or object to our processing of your personal data, and to receive a copy of it in a portable format. Under the CCPA/CPRA you may have the right to know, delete, and correct, and to opt out of sale or sharing — we do not sell or share personal data, so there is nothing to opt out of.

  • Shoppers: contact the store you purchased from, or write to us at tom@tgprod.dev.
  • Merchants: email tom@tgprod.dev, or uninstall the App to trigger deletion of your store's data.

We respond within one month, as required by the GDPR. You also have the right to complain to your local data protection authority.

9. Sub-processors and international transfers

We share data only with the providers needed to run the App:

  • Shopify — the platform the App runs on and the source of all store data. Processed globally under Shopify's own terms.
  • Railway — application hosting and the PostgreSQL database where all stored records live, including warranty registrations. Hosted in the United States (US West).
  • Amazon Web Services (S3) — file storage for exports and uploads. Hosted in the European Union (Frankfurt, eu-central-1).
  • n8n — receives the error and diagnostic reports described in section 3. This is a self-hosted instance operated by TGProd in the Netherlands, not a third-party service.

We may also disclose data where required by law — for example to comply with a subpoena or similar legal process — or where we believe in good faith that disclosure is necessary to protect our rights, investigate fraud, or protect the safety of others.

International transfers. Because our application hosting and database are in the United States, personal data of individuals in the EEA or UK is transferred outside those areas. We rely on the European Commission's Standard Contractual Clauses, and the UK Addendum where applicable, as the transfer mechanism.

10. Security

  • Encryption in transit (HTTPS/TLS) for all admin, API, and webhook traffic, and encryption at rest for the database and its backups.
  • HMAC signature verification on every inbound Shopify webhook.
  • Bot-score and rate-limit guards on all public storefront endpoints, and uniform generic responses on the registration endpoint so that no caller can probe which serial numbers exist.
  • Data minimization by design: registration asks for an email and nothing more that is mandatory, and diagnostic reports exclude request payloads.
  • Access control: API tokens and secrets are held as protected environment secrets, and access to production data is limited to those who need it.

No system is perfectly secure, but we investigate suspected incidents and will notify affected merchants and the relevant authorities where the law requires it.

11. Children

SerializeIt is a business tool sold to merchants and is not directed at children. We do not knowingly collect personal data from children under 13, or under 16 where that is the age of consent for data processing in the user's country. If you believe a child has provided personal data through the App, contact tom@tgprod.dev and we will delete it.

12. Changes to this policy

We may update this policy from time to time. Material changes will be reflected in the "Last updated" date at the top of this page, and we will notify merchants in the App or by email where the change is significant. Continued use of the App after an update constitutes acceptance of the revised policy.

13. Contact

Questions about this policy, or a request about your data:

TGProd — Netherlands Email: tom@tgprod.dev

See also the SerializeIt Terms of Service.