Effective Date: October 9, 2025
This Privacy Policy explains how Infinea Consulting Ltd ("we", "us", "our") collects, processes, and protects personal data when you access or use Cloudhooks (“Service”), in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”). By accessing or using the Service, you acknowledge that you have read and understood this Privacy Policy.
Data Controller: Infinea Consulting Ltd
Address: Andor utca 21/c fszt. 1., 1119 Budapest, Hungary
Contact Email: support@cloudhooks.dev
We collect and process the following categories of Personal Data:
We process your personal data only when we have a valid legal basis under GDPR. The specific legal basis depends on the type of data and the purpose for which we process it:
We process personal data when necessary to provide the Service to you and fulfill our contractual obligations. This includes:
We process personal data based on our legitimate interests to operate, improve, and secure the Service, while ensuring these interests do not override your fundamental rights. This includes:
We process personal data based on your explicit consent for:
We process personal data when necessary to comply with applicable laws and regulations, including:
We collect personal data from various sources to provide and improve our Service. Understanding where your data comes from helps ensure transparency in our data processing activities:
We collect information that you voluntarily provide when using our Service:
When you use our Service, we automatically collect certain information:
We receive limited data from integrated third-party services:
We process your personal data for specific, legitimate purposes necessary to provide our Service and meet our legal obligations. Each processing activity is linked to one or more of the legal bases outlined in Section 4:
We process your personal data to create, maintain, and secure your user account. This includes verifying your identity, managing access credentials, maintaining your account settings, and ensuring the security of your account through features OAuth user management for secure login.
Our primary purpose for processing data is to deliver the core webhooks automation functionality you expect from our Service. This encompasses processing the webhook and external API requests through our webhook and external trigger API, running your hook code, communicating with external systems, and tracking usage to ensure you stay within your plan limits.
We process personal data to provide effective customer support and technical assistance. This includes responding to your inquiries and support tickets, troubleshooting technical issues you may encounter, providing guidance on using our Service effectively, and maintaining records of our communications to ensure consistent support.
For users on paid plans, we process data necessary for financial transactions and account management. This includes processing monthly charges through Shopify, managing plan upgrades and downgrades, and tracking usage for usage-based billing calculations.
We analyze aggregated and anonymized usage data to enhance our Service performance and develop new features. This helps us understand how users interact with different features, identify areas for improvement and optimization, develop new functionalities based on user needs, and ensure the reliability and speed of our automations.
We process contact information to send you important communications about our Service. This includes transactional emails about your account status and usage, notifications about changes to our Service or policies, responses to your support requests, and, where you have provided consent, marketing communications about new features or offerings.
We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, comply with our legal obligations, resolve disputes, and enforce our agreements. Our retention periods are designed to balance service functionality with data minimization principles:
Itemized webhook run logs containing detailed information about individual webhook requests, timestamps, payloads, metadata is retained up to 14 days, depending on the chosen plan. After this period, the logs are deleted. This allows you to review recent activity while ensuring we don't retain detailed operational data longer than necessary.
Aggregated usage data showing summary statistics, total usage counts, and general patterns is retained until account cancellation. This aggregated data helps us provide usage reports, billing summaries, and service analytics without maintaining individual transaction details.
Core account data including store URL, store email address, notification email address, preferences, and settings is retained until account deletion. When you request account deletion, we initiate a process to remove your personal data from our active systems within 30 days, subject to any legal retention requirements.
Information about monthly charges are retained until account deletion. No billing records are generated or retained as they are handled by Shopify.
Data shared with our third-party processors (listed in Section 8) is retained according to their respective Data Processing Agreements (DPAs). We ensure all processors comply with GDPR requirements and do not retain your data longer than necessary for providing their services to us.
For security and disaster recovery purposes, some data may exist in backup systems for up to 90 days after deletion from primary systems. These backups are encrypted and access is strictly limited to recovery scenarios.
We engage carefully selected third-party service providers (processors and sub-processors) to assist us in providing the Service. These processors act on our behalf and under our instructions, processing personal data only as necessary to perform their specific functions. All processors are bound by Data Processing Agreements (DPAs) that ensure they comply with GDPR requirements and maintain appropriate security measures.
We do not sell, rent, or share your personal data with third parties for their own marketing purposes. The following categories of processors have access to your personal data solely to provide services to us:
Your personal data may be transferred to and processed in countries outside the European Economic Area (EEA), particularly the United States. We ensure all international transfers comply with GDPR requirements through appropriate safeguards.
Many of our processors listed in Section 8 operate from or store data in locations outside the EEA:
United States:
Mixed EU/International Infrastructure:
We protect your data during international transfers through:
You have the right to:
For more information about international transfers, please contact us at support@cloudhooks.dev .
Under GDPR, you have specific rights regarding your personal data. We are committed to facilitating the exercise of these rights in a transparent and timely manner.
Right to Access (Article 15 GDPR)
You have the right to request confirmation of whether we process your personal data and, if so, to receive a copy of that data along with information about how it's processed. This includes the purposes of processing, categories of data, and recipients.
Right to Rectification (Article 16 GDPR)
If your personal data is inaccurate or incomplete, you have the right to request that we correct or complete it. We will update your information promptly and notify any third parties who have received the incorrect data.
Right to Erasure - "Right to be Forgotten" (Article 17 GDPR)
You may request deletion of your personal data when:
Note: We may retain certain data when required by law or for legitimate business purposes such as financial records.
Right to Restrict Processing (Article 18 GDPR)
You can request that we limit how we use your data while we verify its accuracy, assess your objection to processing, or if you need the data for legal claims even though we no longer require it.
Right to Data Portability (Article 20 GDPR)
For data you've provided to us that we process based on consent or contract, you have the right to receive it in a structured, commonly used, machine-readable format (such as CSV or JSON) and to transmit it to another service provider.
Right to Object (Article 21 GDPR)
You may object to processing based on our legitimate interests or for direct marketing purposes. We will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests.
Right to Withdraw Consent
Where processing is based on your consent, you may withdraw it at any time. This won't affect the lawfulness of processing before withdrawal. You can withdraw consent for marketing communications through the unsubscribe link in emails or by contacting us.
Rights Regarding Automated Decision-Making
We do not currently use automated decision-making that produces legal or similarly significant effects. If this changes, we will update this policy and ensure appropriate safeguards are in place.
To exercise any of these rights:
If you're unsatisfied with how we handle your request, you have the right to lodge a complaint with your supervisory authority (see Section 15 for details).
We use cookies and similar technologies to enhance your experience, maintain security, and understand how our Service is used. This section explains what cookies we use, why we use them, and how you can manage your preferences.
Cookies are small text files placed on your device when you visit our website or use our Service. They help us recognize your browser, remember your preferences, and improve your experience. We also use similar technologies like local storage for comparable purposes.
Analytics Cookies
We use Google Analytics and MixPanel to understand how users interact with our Service. These cookies collect:
This data is aggregated and anonymized.
Legal basis: Consent (you can opt out at any time)
You have several options for managing cookies:
We use the following third-party services that may set cookies:
We do not allow third-party advertising cookies on our Service.
We may update our cookie usage as we develop new features. Any significant changes will be communicated through an update to this Privacy Policy. For questions about our use of cookies, contact us at support@cloudhooks.dev .
We take the security of your personal data seriously and implement comprehensive technical and organizational measures to protect it against unauthorized access, accidental loss, destruction, or alteration.
Encryption
Access Controls
Infrastructure Security
Security Policies and Procedures
Monitoring and Logging
Data Protection Measures
In the event of a personal data breach, we will:
While we implement industry-leading security measures, no system can guarantee absolute protection. We continuously review and improve our security posture to address evolving threats. Users are encouraged to:
For security concerns or to report vulnerabilities, please contact our security team directly at support@cloudhooks.dev .
Cloudhooks is a business service designed exclusively for professional and commercial use. As a Shopify app, we rely on Shopify's age verification and user management systems. We do not offer services to children and have implemented measures to prevent the collection of their personal data.
Our Service is available only to Shopify store owners and their authorized users. Shopify requires all account holders to be:
We do not independently verify age as we rely on Shopify's user verification processes. By installing Cloudhooks through the Shopify App Store, store owners confirm they meet Shopify's age and eligibility requirements.
We do not knowingly collect, process, or store personal data from individuals under the age of 16. Since Cloudhooks can only be accessed through Shopify admin accounts, our Service is not directed at, marketed to, or intended for use by children. The nature of our Service - webhook automation for e-commerce - inherently targets adult business users.
If we discover that we have inadvertently collected personal data from someone under 16, we will:
If you believe your child under 16 has somehow gained access to a Shopify store and used Cloudhooks:
We rely entirely on Shopify's user verification and access control systems. Only users with valid Shopify admin credentials can install or access Cloudhooks. This approach ensures that:
This approach balances privacy protection with the business-to-business nature of our Service, while recognizing that user verification is handled by Shopify's platform.
We reserve the right to update this Privacy Policy to reflect changes in our data processing practices, legal requirements, or business operations. We are committed to keeping you informed about how we protect and process your personal data.
Minor Changes
Minor changes include:
These changes will be made directly to the policy with an updated revision date.
Material Changes
Material changes include:
For Minor Changes:
For Material Changes:
When we make material changes:
By continuing to use Cloudhooks after privacy policy changes take effect, you acknowledge and agree to be bound by the updated policy. If you do not agree to material changes, you should discontinue use of the Service before the effective date.
We maintain a record of material changes to this Privacy Policy. To request information about previous versions or specific changes, contact us at support@cloudhooks.dev .
We encourage you to review this Privacy Policy periodically. The "Effective Date" at the top of this document will always reflect the date of the most recent version.
We are committed to addressing your privacy concerns and facilitating the exercise of your rights under GDPR. This section provides comprehensive information on how to contact us and lodge complaints if necessary.
Primary Contact:
Types of Requests We Handle:
We strive to respond to all privacy-related communications promptly:
We accept and respond to privacy requests in:
If you are dissatisfied with our response or believe we are processing your personal data unlawfully, you have the right to lodge a complaint with a data protection supervisory authority.
Your Options for Filing Complaints:
You may file a complaint with the supervisory authority in:
Hungarian Supervisory Authority:
Finding Your Local Authority: For supervisory authorities in other EU member states, visit the European Data Protection Board website: https://edpb.europa.eu/about-edpb/about-edpb/members_en
If you're not satisfied with our initial response:
As we are established in the EU (Hungary), we are not required to appoint a representative in other member states. However, we accept and process requests from data subjects throughout the EEA with equal diligence.
We maintain records of all privacy-related requests and complaints for a minimum of three years to demonstrate compliance and improve our practices. These records are kept confidential and used only for compliance and service improvement purposes.