Proofed is a Shopify app built and operated by Craig Lubbe t/a Lubbe Labs, based in South Africa.
If you have any questions about this policy or how we handle your data, please contact us:
Email: info@lubbelabs.com
When we say "we", "us", or "our", we mean Lubbe Labs. When we say "merchant", we mean the Shopify store owner who has installed Proofed. When we say "customer", we mean the end customer of that merchant who receives a proof for approval.
When you install Proofed, we receive the following from Shopify:
yourstore.myshopify.com)We also store the settings you enter in Proofed, such as your logo, sender name and any custom sending address.
When one of your orders triggers our system, we collect and store:
We do not collect payment information, passwords, or any sensitive personal data.
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Merchant store domain | To identify your store and route data correctly | Performance of contract |
| Customer name & email | To send proof approval notifications and link customers to their proofs | Performance of contract (on behalf of merchant) |
| Proof files and customer uploads | To store and display the design proofs for customer review, and to pass a customer's updated artwork to the merchant | Performance of contract |
| Approval decisions & comments | To give merchants a record of what was approved or revised | Performance of contract / Legitimate interest |
| Activity log (timestamps, IP address, browser) | To give merchants a dated record of when proofs were sent and approved, in case an approval is later disputed | Legitimate interest |
We process customer data on behalf of merchants. The merchant is the data controller for their customers' personal data. Lubbe Labs acts as a data processor in that relationship.
| Data type | Retention period |
|---|---|
| Merchant store domain | Retained while the app is installed. Deleted within 30 days of uninstall, except that if the store started a free trial, we keep the store domain and the trial start date so the trial cannot be claimed twice. |
| Customer name, email, order details | Retained while the app is installed on the merchant's store. Deleted within 30 days of the merchant uninstalling the app. |
| Proof files and customer uploads (images/PDFs) | Retained while the app is installed. Deleted within 30 days of uninstall. |
| Approval decisions & comments | Retained while the app is installed. Deleted within 30 days of uninstall. |
| Activity log (including IP address and browser) | Retained with the order it belongs to. Deleted with that order, on a customer erasure request, or within 30 days of uninstall. |
If a merchant or customer submits a data erasure request, we will action it within 30 days (see Section 7).
We do not sell personal data. We do not share data with third parties for marketing purposes.
We use the following sub-processors to operate the app:
| Provider | Role | Location |
|---|---|---|
| Fly.io | Application hosting and infrastructure | South Africa (Johannesburg) |
| Tigris | File storage (proof files, customer uploads, cut files and logos) | Global |
| Resend | Transactional email delivery (proof notification emails) | US |
| Shopify | E-commerce platform; order and merchant data originates here | Global |
| Google Fonts | Fonts on the proof review page and in some email designs. Google receives the viewer's IP address when the fonts load. | Global |
Each provider processes only the data necessary for their specific function and is bound by their own data processing terms.
You have the right to:
To exercise any of these rights, contact us at info@lubbelabs.com. We will respond within 30 days.
If you are unsatisfied with our response, you have the right to lodge a complaint with your local supervisory authority.
You have the right to:
To submit a request, contact us at info@lubbelabs.com.
Proofed complies with Shopify's mandatory GDPR webhook requirements:
We use no marketing cookies and do not engage in any cross-site tracking or behavioural advertising.
Proofed sets no cookies of its own. Merchant sessions in the Proofed admin are authenticated with session tokens issued by Shopify, not cookies.
We take reasonable technical and organisational measures to protect personal data against unauthorised access, loss, or misuse. This includes encrypted data transmission (HTTPS), access controls, and use of reputable infrastructure providers (see Section 5).
No method of transmission over the internet is 100% secure. If you have concerns about the security of your data, contact us at info@lubbelabs.com.
We may update this policy from time to time. When we do, we will update the "Last updated" date at the top. If changes are significant, we will make reasonable efforts to notify affected merchants.
To exercise your rights, ask a question, or raise a concern about how we handle personal data:
Craig Lubbe t/a Lubbe Labs
Email: info@lubbelabs.com
This policy applies specifically to the Proofed app. Lubbe Labs operates other apps which have their own separate privacy policies.