Postfit privacy policy
Last updated: 2026-11-11
Postfit is a Shopify app by Ecom Studio Nimma, a sole proprietorship of Jasper Reijnen (Kwakkenbergweg 150-05, 6571 GB Berg en Dal, Nederland, Chamber of Commerce 96695536). This policy explains what data Postfit processes, why, and for how long. In short: Postfit doesn't process your customers' data.
1. Roles
For your account and store data (such as your store domain and settings) we are the controller.
For the order data Postfit uses to count letterbox orders, you, the store, are the controller and we are the processor. The processing terms are in section 9 of the terms.
2. What data
Store: the myshopify domain, Shopify access tokens, your settings, rules and plan.
Products: the number per letterbox parcel, stored as a metafield in your own Shopify store.
Letterbox orders: per order only the Shopify order ID, the date, the name and price of the chosen shipping rate and the currency.
Postfit does not store your customers' names, addresses, email addresses, phone numbers or payment details. At checkout, Postfit only looks at the products in the cart and the available shipping rates.
3. Why
To make the app work (showing the right shipping rate), to count letterbox orders for your dashboard and plan limit, and to help you when you contact us. We don't use the data for advertising and don't sell it.
Legal basis: performance of the contract with you (Art. 6(1)(b) GDPR).
4. Retention
Letterbox orders: 24 months, then deleted automatically.
If you uninstall the app, Postfit automatically deletes all your data on our side 48 hours later (on Shopify's shop/redact request). Metafields in your own store remain yours.
5. Sub-processors
Shopify (platform and billing), Supabase (database, servers in Frankfurt, EU) and Vercel (app hosting, EU region). Data processing agreements apply with each of them.
6. Security
All connections are encrypted (TLS). The database is encrypted at rest and not publicly reachable. Only the app itself has access. If we discover a data breach affecting you, we'll notify you within 48 hours.
7. Your rights
You can access, correct or delete your data. Email hallo@ecomstudionimma.nl. If you disagree with us, you can lodge a complaint with your data protection authority (in the Netherlands: Autoriteit Persoonsgegevens).