This policy explains what information the Gurkha Shoppable Videos & UGC app (the “App”) collects when a merchant installs it on a Shopify store, how that information is used, who it is shared with, and how it can be deleted. It applies to merchants who install the App and to visitors who view the App’s video widgets on a merchant’s storefront.
The App is developed and operated by GurkhaDevs. For anything in this policy, including requests to access or delete your data, contact gurkhadevs@gmail.com.
Under the GDPR and comparable laws, the merchant is the data controller for their store’s data and GurkhaDevs acts as a data processor on the merchant’s instructions. For the merchant’s own account and support correspondence, GurkhaDevs is the controller.
When you install the App, Shopify provides an access token and your store’s
.myshopify.com domain. The App requests offline access tokens, which
are not tied to an individual staff account, so no staff member’s name or email address is
stored as part of installation.
| What | Why |
|---|---|
| Store domain and Shopify access token | To authenticate requests to the Shopify Admin API on your behalf |
| Install date, plan, and billing subscription reference | To apply the correct plan limits and billing state |
| Onboarding progress | To stop showing setup steps you have already completed |
Connecting an Instagram or TikTok account is optional, and it never requires you to log in to either network. You give us a public handle or profile URL, and we retrieve the account’s public branding: username, display name, verified status, the platform’s account identifier, and the profile picture. Because both networks serve profile pictures from URLs that expire, we copy the picture into your own Shopify Files and store only that permanent Shopify CDN address.
For each video you import, the App stores its public metadata: the platform, the post’s identifier and permalink, the caption, the duration and dimensions, the audio track title, the posting date, and the public like, comment and view counts. It also stores the username and display name of the account that posted the video, so the video can be attributed correctly.
The video file and its poster image are uploaded to your own Shopify Files. We store only the resulting Shopify CDN addresses — we do not host your video files.
When you link a product to a video, the App stores a snapshot of that product — its Shopify identifier, handle, title, image, price and default variant — so the storefront can render without calling an API at page load. It also stores your widget configuration: layout, styling settings, headings, placement and any custom CSS you enter.
/products/… and /cart/add.js) — the same origin as the page they are already on.
Because the App holds no customer personal information, Shopify’s mandatory
customers/data_request and customers/redact requests return nothing —
there is nothing to disclose and nothing to erase.
We do not use your data to train machine learning models, we do not sell or rent it, and we do not share it for advertising.
| Recipient | What it receives | Why |
|---|---|---|
| Shopify | Your store data, video files, poster images and widget configuration | The App is built on Shopify’s APIs. Your media and published widget settings are stored in your own Shopify account. See Shopify’s privacy policy. |
| Content retrieval providers | The public handle, post URL or video identifier you enter | To retrieve publicly available Instagram and TikTok content when you ask the App to import it. These providers receive nothing else — no store data, no customer data and no Shopify access token. |
We maintain a current list of the service providers we use. If you need it for a vendor review or a data processing agreement, email gurkhadevs@gmail.com and we will send it to you.
We may also disclose information where we are legally required to, or to protect our rights or the safety of others. If the App is ever transferred to another owner, we will tell merchants before their data moves.
Store configuration is held in a PostgreSQL database on servers operated by GurkhaDevs, protected by encrypted transport (HTTPS/TLS) and restricted administrative access. Your video and image files are held in your own Shopify account and served from Shopify’s CDN.
Depending on where you are located, your data may be processed outside your own country. Where that involves a transfer out of the European Economic Area or the United Kingdom, we rely on appropriate safeguards. Write to gurkhadevs@gmail.com for details of the current hosting location.
shop/redact request, which arrives 48 hours after uninstall, triggers the same deletion again as a safeguard.Video and image files that were uploaded to your Shopify Files are not deleted on uninstall. They belong to you and remain in your Shopify admin, where you can remove them yourself. We could not delete them even if we wanted to: Shopify revokes our access token the moment you uninstall.
The App retrieves publicly available content from Instagram and TikTok at your direction. You are responsible for having the right to use any video you import and display on your store. If you did not create a video, obtain the creator’s permission before publishing it.
If you are a creator and a merchant has published your content without permission, contact the merchant in the first instance. You can also write to gurkhadevs@gmail.com and we will pass the report to the merchant concerned.
Depending on where you live, you may have the right to access the personal data we hold about you, correct it, delete it, object to or restrict how we use it, receive a portable copy, and withdraw consent. Exercise any of these by emailing gurkhadevs@gmail.com. We aim to respond within 30 days.
We do not sell personal information as that term is defined under the California Consumer Privacy Act, and we have not done so in the preceding twelve months. If you are in the EEA or the UK and are unhappy with our response, you may complain to your local data protection authority.
All traffic to the App is encrypted in transit with TLS. Access tokens are stored server-side and never exposed to the browser or to the storefront. Administrative access to the database is restricted. No system is perfectly secure, but if a breach affects your data we will notify you and the relevant authorities as the law requires.
The App is a business tool for merchants and is not directed at children. We do not knowingly collect personal information from anyone under 16.
We may update this policy as the App changes. The date at the top always reflects the current version. Where a change materially affects how we handle your data, we will tell merchants through the App or by email before it takes effect.
Questions, data requests or complaints: gurkhadevs@gmail.com.