Features Security Case Studies Blog Pricing
Start Free Trial

Privacy Policy

Effective date: August 19, 2026

TinyBackup ("we", "us", or "our") provides an automated Shopify data backup and restore application ("Service"). The Service is operated by TK DIGITAL LTD, a company registered in England with company number 09164546 and registered office at 93 Fernside Road, Poole, Dorset, BH15 2JQ, United Kingdom. We are committed to protecting user privacy and processing data lawfully and transparently.

1. General information

TinyBackup automatically backs up Shopify store data and allows merchants to restore previous versions when needed. This Privacy Policy explains how we collect, process, store, and protect personal data.

2. Data controller and processor roles

For website visitors and marketing purposes, TinyBackup acts as the data controller.

For backup and restore operations performed within Shopify stores, TinyBackup acts as the data processor, while the Shopify merchant acts as the data controller.

Our processing is governed by applicable data protection laws, including the GDPR and UK GDPR, and by our Data Processing Addendum (DPA).

3. What data we collect

When using TinyBackup, we process the following types of information:

  • Account information: Store name, store URL, Shopify shop ID, and owner contact details provided by Shopify OAuth connection.
  • Service and backup data: Store data accessible via Shopify APIs, including products, collections, pages, blogs, articles, themes, files, and related metadata.
  • Webhook data: Shopify event data such as object IDs, timestamps, event type, and job results.
  • Support data: Messages and attachments sent to our support team.
  • Technical data: IP address, device and browser type, operating system, log timestamps, and performance metrics.
  • Billing data: Subscription status, plan type, and transaction identifiers. We do not store full payment card information.
  • Cookies and analytics data: Non-sensitive website interaction data.

We do not sell or rent personal data to third parties.

4. How TinyBackup works

TinyBackup continuously protects every Shopify store connected to the Service. Once installed, the system automatically backs up all available store data. Merchants cannot select or exclude specific data from backups.

The Service listens to Shopify webhooks for create, update, and delete events. Each event triggers an incremental backup, ensuring all changes are saved automatically.

Backups run continuously in the background and require no manual action.

5. Purpose and legal basis for processing

We process personal data to:

  • Provide automatic backups, incremental updates, and restore functionality
  • Maintain security and reliability of the Service
  • Detect and resolve operational issues
  • Manage billing and subscriptions
  • Respond to service and support communications
  • Comply with legal obligations

The legal bases for processing are:

  • Article 6(1)(b) GDPR - performance of a contract
  • Article 6(1)(f) GDPR - legitimate interests
  • Article 6(1)(c) GDPR - legal obligations
  • Article 6(1)(a) GDPR - consent for marketing communications

6. Data retention

We retain data only for as long as necessary:

  • Account and billing data during the subscription period and as required by law
  • Backup data while the app is installed; after uninstallation, all backup data is automatically and permanently deleted from our systems within 14 days (the window allows a reinstall without losing backup history; earlier deletion is available on request)
  • Webhook and event logs for limited operational periods
  • Support data for up to 24 months after resolution
  • Analytics data in aggregated or anonymized form

Data is deleted or irreversibly anonymized when no longer required.

7. Data sharing and service providers

We use a small number of service providers. They act only under our instructions and contractual safeguards, and we never sell personal data.

Providers that process backed-up store data on behalf of merchants (sub-processors under our DPA), both processing exclusively in Frankfurt, Germany:

  • DigitalOcean, LLC - cloud infrastructure, databases, and encrypted backup storage (Frankfurt, Germany)
  • Google Cloud EMEA Ltd - webhook event pipeline for change detection (Frankfurt, Germany)

Providers that process only our own customer-relationship data (store owner contact details, not backed-up store data):

  • Mailgun (Sinch) - transactional email such as backup reports and alerts (USA)
  • Crisp IM SAS - in-app support chat (EU, France)
  • Google Analytics - website analytics on this marketing site, loaded only after cookie consent (see Section 10)

Our application error monitoring (Sentry) is configured so that no personal data is transmitted: request contents, user data, and email addresses are stripped before error events leave our systems.

The current sub-processor list, including pending changes, is published in our Help Center.

We may also disclose data:

  • To public authorities when legally required
  • During mergers or acquisitions with appropriate safeguards

8. International transfers

Backup data is stored in Frankfurt, Germany. If personal data is transferred outside the EEA or the UK (for example to US-based providers listed in Section 7), we apply safeguards such as the EU Standard Contractual Clauses, the UK International Data Transfer Addendum, or the EU-US Data Privacy Framework where the provider is certified.

9. Data security

We use industry-standard security measures, including:

  • Encryption at rest and in transit
  • Multi-factor authentication and role-based access
  • Continuous monitoring and security reviews
  • Network and system isolation for backup data

10. Cookies and tracking

Essential cookies are used to operate the website and maintain sessions. Optional analytics cookies measure performance and feature usage.

You can manage non-essential cookies through browser settings or the website cookie banner.

11. Your data protection rights

You may have the right to:

  • Access personal data
  • Request correction or deletion
  • Object to or restrict processing
  • Request data portability
  • Withdraw consent

If data relates to Shopify store backups, requests should be directed to the store owner. We assist store owners in responding.

Contact us at [email protected] for data-related requests.

12. Changes to this policy

This Privacy Policy may be updated to reflect legal, technical, or business changes. Updates are published with a new effective date.

13. Contact information

Email: [email protected]
Website: https://tinybackup.io

14. Data Processing Addendum

The Data Processing Addendum forms part of the Terms of Service and defines processor obligations, sub-processors, and deletion policies. Read the Data Processing Addendum (DPA).