MindFlash StudioLast updated: 9 October 2026
1. Who operates the app
Gift Wrap & Messages is operated by MindFlash Studio. Privacy and support contact: support@mindflashstudio.com.
This notice covers the Shopify app and its supporting service. The MindFlash Studio website has a separate Privacy Policy.
2. Our role
Where we process personal data for the merchant, the Data Processing Addendum applies.
For store customer and order information processed to provide the merchant's gift service, the merchant determines the purpose and we act on the merchant's instructions. For our own merchant support, service security and business administration, we determine the purposes of processing. Shopify operates its own platform under its own terms and privacy notices. The Data Processing Addendum describes the applicable processor obligations.
3. Information processed
Store and authorization information: the myshopify.com domain, Shopify identifiers, currency, time zone, granted scopes, authentication state and API tokens. Shopify session serialization may also contain staff account names, email addresses and other authorized-user details supplied by Shopify. The app does not ask shoppers to provide their Shopify password.
Products and configuration: product and variant identifiers, titles, prices, product images, availability, catalog selections, eligibility rules, localized labels and card/print layouts. Merchant-uploaded images are uploaded through Shopify's staged product-media process and associated with Shopify products; they are not stored as a separate app image library in Firestore.
Cart and order information: selected gift options, messages, print-font and layout choices, order identifiers and dates, order-line titles and attributes, quantities, payment status and payment transaction timestamps used for gift-order accounting. Cart and order contents are processed through Shopify APIs and rendered in the merchant interface or print document. A message can contain personal information about its sender or recipient.
App-side records: Shopify sessions; aggregate analytics snapshots; webhook receipt identifiers, topics and associated order identifiers; preparation timestamps and status; monthly usage counters, hashed per-order usage receipts, cached plan/time-zone status; review invitation choices and timing; customer data request reports and delivery-status timestamps.
Support information: information you choose to send to support, including your address, store domain, message and attachments. HTTP infrastructure and application error logs can contain technical information such as IP addresses, request paths, timestamps, store domains and diagnostic messages. These are distinct from the deliberately restricted webhook receipt records.
4. What is stored where
Gift messages and saved gift specifications are kept in Shopify cart/order attributes and order-line properties. They are read for display and printing, but the code does not deliberately copy gift messages or Shopify customer contact/address fields into the app's Firestore records. This does not mean the app never processes personal information: messages, identifiers, staff sessions, reports and support correspondence can be personal data.
Settings, catalog configuration, products, images, and cart/order contents are held in Shopify. App-side service records are stored in Google Cloud Firestore. Hashed order/customer keys are pseudonymous identifiers, not a guarantee of anonymous data. Downloaded reports, print outputs and emails may create copies on the merchant's device, printer or mail service.
5. Purposes and legal grounds
We process information to authenticate authorized merchants; provide gift selection, preparation and printing; calculate usage and gift-option analytics; confirm the subscription; detect duplicate event processing; respond to support and privacy requests; and keep the service reliable and secure. We do not use gift messages for advertising profiles or AI model training as part of this app's implemented functions.
Where European data protection law applies, the merchant is responsible for an appropriate legal basis for customer processing, such as performing the customer's order or another lawful basis. For our own processing, relevant bases may include performing our contract with the merchant, legitimate interests in service security and support, and compliance with legal obligations. We assess these bases for the particular processing; installation is not blanket consent to every use. Applicable consent-based uses, if introduced, require their own controls.
6. Providers, recipients and location
Shopify provides the commerce platform, authorization, APIs, product-media storage and subscription interface. Google Cloud supplies application hosting, Firestore, logging and supporting cloud infrastructure. The application runtime and Firestore database are configured in Google Cloud’s Belgium region (europe-west1) within the European Economic Area.
Some service providers may process data outside the EEA as necessary to provide their services. Where applicable, such transfers are subject to appropriate safeguards made available by the relevant provider, such as adequacy decisions or contractual safeguards.
Information sent to support is used to answer and manage the enquiry and maintain necessary support records. We may disclose information where required by applicable law or to protect the service and legal rights. Website-specific processing is covered separately in the website notice.
7. Retention and deletion
Merchant configuration, sessions and service records are retained while needed to provide the installed service. The app does not apply a single automatic expiry to all operational records and privacy reports. Marking a report as provided records delivery status and does not delete the report.
Authenticated Shopify app/uninstalled and shop/redact events trigger removal of the store’s app-database sessions, analytics state, webhook records, preparation and review data, usage records and privacy reports. Failed processing may be retried; a temporary outage can delay cleanup.
Authenticated customers/redact requests remove app-side preparation, usage receipts and event metadata for the supplied orders, and associated customer reports. Store-wide aggregate counters and analytics are retained; redaction does not reset the Free allowance.
Cleanup does not remove Shopify products, images, orders, merchant theme customizations, or downloaded and printed copies. The merchant and Shopify manage these separately. Infrastructure logs, mailbox messages, backups and legally required business records are managed separately and retained only for their necessary purpose or applicable legal obligations.
8. Access requests and other rights
Depending on applicable law, you may request access, correction, deletion, restriction, portability or object to processing; you may withdraw consent where it is the basis and complain to the competent supervisory authority. Contact support@mindflashstudio.com. We may ask for proportionate verification and coordinate with the merchant responsible for the order.
Shopify customer data requests create an app-side report for the supplied order identifiers. The report includes customer/request identifiers and relevant preparation, usage and event metadata; it excludes Shopify order contents, gift text and staff authorization tokens. The merchant downloads the report in Help, provides it securely to the customer, and marks it as provided only after actual delivery. The app does not automatically email that report to the customer. Shopify records and greeting text must be addressed separately through the merchant/Shopify process. Shopify compliance requests must be completed within the applicable required timeframe, generally 30 days after receipt; we do not promise that a generated report alone fulfills the entire request.
9. Browser storage and security
The admin interface stores its language preference in localStorage. The storefront uses sessionStorage for temporary operation notices, focus and availability/reload markers. The app uses authenticated Shopify requests and verifies mandatory privacy webhook signatures. Download endpoints require the authenticated merchant and prevent browser caching of reports. Access credentials are sensitive service data and are not included in customer exports.
No system or print/email workflow is risk-free. Merchants should restrict staff access, avoid unnecessary sensitive data in greetings and protect downloaded files and printed cards. We notify affected merchants of a personal data breach as required by the applicable agreement and law; contact support@mindflashstudio.com.
10. Changes
We may update this policy when the service, processing practices or legal requirements change. Updates are posted on this page with a revised date.