Safefield

Privacy Policy

Last updated: 8 October 2026

This Privacy Policy describes how Safefield (“we”, “us”, “the app”) collects, processes, and stores data when a Shopify merchant installs and uses the app. We are operated by Michal Bajcar, a sole trader based in Prague, Czech Republic (EU).

1. What we collect

When you install Safefield on your Shopify store, we receive and store:

  • Your shop domain (e.g. your-store.myshopify.com) and the OAuth access token Shopify issues to the app, so we can call the Admin API on your behalf.
  • Product data we need to perform GPSR extraction: product titles, descriptions, product types, Shopify product category, tags, vendor, options, product images (up to three per product), and for each variant its barcode, SKU, country of origin and Harmonized System code. Country of origin and HS code come from Shopify’s inventory record for the variant, which is why the app asks for inventory read access; we read no stock levels or locations. We also read your store’s published languages and billing address (used only to pre-fill Settings when you ask us to) and your live theme’s template files (to tell you whether the Safefield block is installed). We do not read customers, orders, or any other objects.
  • Extraction results — the structured GPSR fields Claude AI returns (manufacturer, warnings, safety instructions, CE directives, material composition, etc.) plus per-field and overall confidence scores.
  • Merchant settings you configure in the app: default manufacturer, default EU Responsible Person, default languages.
  • Billing state — the Shopify AppSubscription ID associated with your shop (if you subscribe to a paid plan).

We do not collect customer personal data from your store. We do not read orders, carts, customer records, checkouts, or any personally identifiable information about your shoppers.

2. How we process product data

To extract GPSR-required fields from your product listings, we send the product data listed above (with the description’s HTML stripped, and up to three product images) together with the default manufacturer, default EU Responsible Person and target languages you set in Settings to Anthropic PBC via the Claude API. If you are a sole trader, those defaults can be personal data. Anthropic processes the data to generate the structured GPSR output and does not use Safefield customer data to train its models (see Anthropic’s privacy policy).

We cache each extraction result, keyed by a SHA-256 hash of its inputs, so that re-running extraction on an unchanged product returns the cached result instead of a new API call. A cached result contains the same fields as the extraction, including your defaults. Cached entries expire after 7 days and are then deleted.

3. Where data is stored

All merchant and extraction data is stored in a PostgreSQL database hosted on Railway in the europe-west4 (Amsterdam, EU) region. The application itself also runs on Railway europe-west4. DNS and the CDN in front of safefield.app are provided by Cloudflare, which may route traffic through Cloudflare edges worldwide while terminating TLS within the EU when possible.

4. Data retention

  • Extraction records remain in our database until you change the product’s content in Shopify (title, description and the other inputs above — our products/update webhook then clears the stored extraction and the metafields on the product), or until your shop data is deleted after uninstall.
  • Cached extraction results are deleted 7 days after they are written.
  • Shop records, sessions, extractions and cached results are deleted when Shopify sends the shop/redact webhook, about 48 hours after you uninstall.

5. Third-party processors

We use the following sub-processors to operate Safefield:

  • Anthropic PBC — Claude AI extraction (product data processing).
  • Railway Corporation — application hosting and database (EU region).
  • Cloudflare Inc. — DNS, TLS, edge caching, and routing for mail sent to safefield.app addresses.
  • Google LLC — the mailbox that receives support correspondence sent to safefield.app addresses.
  • Resend (Plus Five Five, Inc.) — transmits replies we send from safefield.app addresses, and internal operational notices to our own inbox: install and uninstall notices, a daily summary and service alerts. These contain stores' myshopify domains, plans, theme names and usage counts.
  • Functional Software, Inc. (Sentry) — application error monitoring, hosted in Sentry’s EU (Germany) data region. An error report carries the technical error and your shop’s myshopify domain. Request bodies, product content, and the manufacturer and EU Responsible Person details you enter are removed before a report is sent, and email addresses are redacted from error text.
  • Shopify Inc. — the platform on which Safefield operates.

6. Your GDPR rights

If you are a merchant based in the EU/EEA or UK, you have the right to access, rectify, erase, restrict processing of, and port your data under the GDPR. You can exercise these rights by emailing [email protected]. We will respond within 30 days.

You can also uninstall the app at any time from your Shopify admin; all shop-scoped data is deleted when Shopify sends the shop/redact webhook, about 48 hours after uninstall.

7. We do not sell data

We do not sell, rent, or trade merchant data with third parties. Data is shared only with the processors listed above, for the purposes stated there; product data goes to Anthropic solely for GPSR extraction. We do not use your data to train any models.

8. Cookies

The Safefield admin app runs as an embedded Shopify app. It sets only the short-lived cookies the Shopify sign-in flow needs while the app is being installed or re-authorised. Shopify may set session cookies in the admin context to support authentication; these are governed by Shopify’s privacy policy. Our public marketing pages (homepage, FAQ, privacy, terms, support) do not set tracking cookies.

9. Data subject requests via Shopify

Safefield implements the three mandatory Shopify compliance webhooks:

  • customers/data_request — acknowledged with a 200 response; Safefield does not store customer data.
  • customers/redact — acknowledged with a 200 response; Safefield does not store customer data.
  • shop/redact — deletes all shop-scoped data (Shop record, Extraction records, cached extraction results, Sessions) in a database transaction.

10. Security

OAuth access tokens and merchant data are stored in our Railway Postgres database in the EU, which is not publicly reachable without credentials. Transport security is provided by TLS. HMAC signatures are verified on every Shopify webhook before the request is processed. We do not store any payment information — billing is handled entirely by Shopify.

11. Changes to this policy

We may update this policy as the app evolves. The “Last updated” date above reflects the most recent change. For material changes we will publish the updated policy here before the changes take effect, and say so in the app.

12. Contact

For privacy questions, data subject requests, or any other inquiry, email [email protected].