BulkBase privacy policy

Last updated: October 1, 2026

BulkBase is a Shopify app for importing and exporting store data with spreadsheets. It is provided by Twinfire Group SIA, Spartaka iela 26-21, Tukums, LV-3101, Latvia (registration number 40203766304, VAT LV40203766304). Contact: janis@twinfireup.com.

For the store data the app handles, the merchant who installs BulkBase is the controller and Twinfire Group SIA acts as a processor on the merchant's instructions.

What the app accesses

With the permissions the merchant approves when installing, BulkBase reads and changes the store's products, collections, inventory, files, pages, redirects, customers and orders through Shopify's Admin API. It only does so when the merchant runs, schedules or reviews an import or export. Customer and order data (names, email addresses, phone numbers and addresses) is accessed only to import or export it at the merchant's request.

What the app stores, and for how long

Files the merchant uploads, links or has exported, and the results files of imports. They are deleted automatically after 30 days, or sooner if the merchant chooses a shorter period or deletes them in the app's Settings.
Import and export history, including the values an import changed, so the merchant can review it and undo it. It is deleted automatically 90 days after the job finished, or earlier when the merchant deletes the job history in Settings. Daily backups are kept for 14 days.
Store connection details: the store's address, the access token Shopify issues at install, the plan, and the merchant's settings, automations and saved FTP/SFTP servers. Server passwords are stored encrypted. When our support gives a store a plan or extra imports and exports, that is stored with it, together with support's notes about the store.

When the app is uninstalled, Shopify asks the app to delete the store's data, and BulkBase deletes all of the above. What remains are anonymous counts, for example that a store installed the app on a given day and which plan it chose, which can't be traced back to the store. When a store customer asks to be forgotten, their rows are removed from the import history.

What the app does not do

It does not sell, rent or share store or customer data, and does not use it for advertising or profiling.
It does not contact a store's customers. Imports never send notifications to customers.
It does not use tracking cookies or third-party analytics.

Where data is processed

The app and its data are hosted by Vultr in Frankfurt, Germany (European Union). All traffic is encrypted with HTTPS. Subscriptions are billed by Shopify. Files are sent elsewhere only where the merchant configures it, for example to their own FTP/SFTP server or to a link they share.

Security

Data is encrypted in transit and at rest, backups are encrypted, and server access is limited to the provider's administrators with key-based login. See security for details and how incidents are handled.

Your rights

Merchants can request a copy of the data the app holds for their store, its correction or its deletion by emailing janis@twinfireup.com; requests are answered within 30 days. People whose data is in a store should contact that store, which can make the request on their behalf. You may also lodge a complaint with your data protection authority; in Latvia this is the Data State Inspectorate (Datu valsts inspekcija).

Changes

If this policy changes, the new version is published here with a new date.