Privacy Policy
This Privacy Policy explains how Digielicit Infotech Pvt. Ltd (“Digielicit,” “Digi,” “we,” “us”) processes information in connection with Digi Mobile Studio and related services (the “Services”), including the website at app-studio.in, the Shopify app / Mobile Studio Admin experience, Digi cloud publish infrastructure, and Digi-built merchant mobile apps (iOS/Android) distributed under Digielicit or a merchant white-label listing.
This policy covers both merchants/site visitors and, where Digi processes data from Digi-built apps, shoppers using those apps. End-customer Shopify storefront account data remains primarily governed by the merchant’s own privacy practices and Shopify’s terms; Digi only processes limited data needed to operate the white-label app and configuration path.
1. Who is responsible
Digielicit operates Digi Mobile Studio. For merchant account and configuration data we process to deliver the Services, Digi typically acts as a processor / service provider on your behalf (or as an independent controller for our own business records such as billing contacts). Roles may be clarified further in a data processing addendum if you require one.
2. Information we process
Depending on how you use the Services, we may process:
- Shop and merchant identifiers — Shopify shop domain, shop ID, app install status, and related Admin context needed to authenticate and serve your store’s configuration.
- Configuration & content — branding settings, layout sections, offers, feature toggles, product metafields used by features (e.g. Try On beta), and assets you upload or reference for the mobile experience.
- Auth & tokens — offline or session-related tokens required to call Shopify Admin / Storefront APIs on your behalf as authorized by the app install (stored and rotated according to Digi’s security practices).
- Device or other IDs (Digi-built mobile apps) — app-generated installation / device identifiers and related platform signals used to register the device for push delivery, diagnose install issues, and prevent abuse. These identifiers may be transmitted from the device to Digi’s servers (for example when registering for notifications). Depending on OS settings and linked SDKs (such as Firebase Cloud Messaging or Firebase / Google Analytics when a merchant enables analytics), advertising IDs or similar resettable device advertising identifiers may also be processed by those providers.
- Push tokens & optional analytics — FCM (or similar) registration tokens, campaign metadata, and measurement IDs needed to deliver notifications or analytics the merchant enables in Mobile Studio.
- App usage / diagnostics — crash and technical logs for reliability (may include device model, OS version, app version, IP address, timestamps, and error diagnostics).
- Shopper account & commerce data (in-app) — when shoppers sign in or check out through Shopify, email, name, addresses, order-related data, and cart contents may be processed via Shopify APIs / Checkout; Digi’s role is limited to enabling the branded app experience.
- Commercial contacts — names, emails, and billing details you provide for sales, onboarding, and invoicing.
- Website usage — standard server logs when you visit app-studio.in; see Cookies.
We do not sell personal data.
3. How we use information
- Provide, secure, and improve the Services (including Save → Publish to mobile cloud);
- Authenticate merchants and authorize API calls within installed scopes;
- Operate Digi-built apps, including push registration using device IDs / FCM tokens;
- Deliver optional push / analytics features merchants enable;
- Bill, support, and communicate about your account;
- Comply with law and enforce our Terms of Service and Child Safety Standards.
4. Infrastructure (including Supabase and Google / Firebase)
Published configuration and related backend functions may be hosted using Supabase and other cloud providers. Shopify hosts Admin APIs and Checkout. Railway (or similar) may host this marketing / App URL site. Digi-built apps may use Google Firebase (Messaging / Analytics) when configured — those SDKs may process device or advertising identifiers under Google’s terms. Processors are bound by contracts and security measures appropriate to the Service.
5. Sharing
We share data only as needed with:
- Infrastructure and subprocessors (hosting, databases, email/support tools, Firebase / Google when push or analytics are enabled);
- Shopify, when you use Shopify Billing, Admin, Storefront, or Checkout APIs;
- Professional advisors or authorities when legally required;
- A successor in a merger or asset transfer, subject to continued protection.
We do not share personal data with third parties for their own independent marketing.
6. Retention
We retain merchant configuration, device registration / push tokens, and operational data for as long as your subscription is active and for a reasonable period afterward for backups, dispute resolution, and legal obligations, unless a shorter period is required by agreement or law. You may request deletion of merchant-held configuration subject to technical and legal limits (e.g. billing records).
7. Security
We use industry-standard measures such as TLS in transit, access controls, and least-privilege secrets management. No method of transmission or storage is 100% secure; please protect Admin and Studio access on your side as well.
8. International transfers
Data may be processed in regions where Digi or its subprocessors operate. Where required, we use appropriate transfer safeguards.
9. Your rights
Depending on your location, you may have rights to access, correct, delete, or export personal data, or to object to certain processing. Merchants should contact Digi through their commercial channel; shoppers should contact the merchant (and Shopify as applicable) for storefront account requests, or Digi for Digi-held device / push registration data.
10. Children
Digi Mobile Studio and Digi-built merchant mobile apps are not directed to children under 13 (or the minimum age required in the user’s country, such as 16 in some regions).
We do not knowingly collect personal information from children. Digi-built shopping apps are intended for general audiences / adults making purchases, not as children’s or “designed for families” products.
Digielicit prohibits Child Sexual Abuse and Exploitation (CSAE). See our published Child Safety Standards for CSAE prohibitions and the child safety contact.
If you believe a child has provided personal data through the Services or a Digi-built app, contact Digi (or the merchant, for shopper account data) so we can help review and delete the information where appropriate.
Merchants are responsible for their own store policies, age gates, and compliance if they choose to market to minors.
11. Google Play Data safety alignment
For Digi-built Android apps, Digi’s practices relevant to Google Play’s Data safety form typically include collection (and limited sharing with service providers such as Firebase / Shopify) of:
- Device or other IDs — app installation / device IDs and, when SDKs are enabled, advertising IDs;
- App activity / diagnostics — as needed for push, analytics (if enabled), and crash reliability;
- Personal info / account & purchase data — when the shopper signs in or checks out via Shopify.
Merchants publishing a Digi-built listing must declare these data types accurately in Play Console Data safety, matching this policy and the SDKs linked in their binary.
12. Changes
We may update this Policy by posting a new version with a revised “Last updated” date. Material changes will be highlighted where reasonable.
13. Contact
Privacy questions: contact your Digielicit / Digi Mobile Studio representative or the contact listed on your order form.
Child safety / CSAE: child-safety@app-studio.in — see Child Safety Standards.