Privacy Policy

for the Dingio - Telegram Order Alerts Shopify app
Last updated: 10 November 2026
For stores that installed Dingio before 9 October 2026, the changes made on 9 and 13 October 2026 take effect on 15 November 2026. For other stores, they apply immediately. The change made on 15 October 2026 adds section 6b about App Store listing analytics, which applies to listing visits and installs from 15 October 2026 and does not change how Dingio handles the data of stores that already use it. It also adds these order details to the list under "What we receive" in section 2: each item's vendor, when the order was placed or cancelled, whether it is a test order, the total in the customer's currency and the names of automatic and manual discounts. They appear in a message only if the store adds them to its own custom template. The change made on 21 October 2026 adds optional customer details in alerts (section 2a) and our Data Processing Addendum. Like every optional feature, it applies to a store only if it switches the feature on, and from the moment it does. For other stores nothing changes: the App keeps ignoring the customer data in Shopify's notifications, as section 2 describes. The change made on 22 October 2026 to section 8 sets how long support messages are kept, and what happens to your customers' personal data if you send us any. For stores that installed Dingio before 22 October 2026, it takes effect on 23 November 2026. For other stores, it applies immediately. The change made on 29 October 2026 is a clarification: the essential notices we email include notices when your alerts near or reach your plan's limit, and section 8 says how long Resend keeps the emails it delivers for us. The change made on 10 November 2026 adds More chats on the Pro and Business plans (section 2a). Like every optional feature, it applies to a store only from the moment the store adds a chat. Nothing changes for stores that don't use it. The change also adds a part for people whose private Telegram chat a store added (section 2a, "If a store added your private chat"). The change made on 10 November 2026 to section 8 says that if you reinstall the App within about 48 hours, customer details and the order note come back switched off, and switching them on asks you to accept our Data Processing Addendum again. It applies immediately.

This privacy policy explains how the Shopify app Dingio - Telegram Order Alerts ("the App"), operated by EpicPilot Labs ("we", "us"), handles information when you install and use it on your Shopify store.

1. Who we are

The App is provided by Marius Šiupšinskas, a natural person carrying out individual activity (individuali veikla) registered in Lithuania (European Union), trading as EpicPilot Labs. EpicPilot Labs is a trading name, not a separate company. Marius Šiupšinskas is the data controller for the information described in this policy, with one exception: for the customer details you can choose to include in your alerts (section 2a), and the order note if you add it to a custom template (section 2), you are the controller and we process them on your behalf, under our Data Processing Addendum.

For any question or request relating to this policy or your data, contact dingio@epicpilotlabs.com. We aim to respond within two business days. You can also message us on Telegram; see section 14.

2. Information we receive and what we send

When you install the App, Shopify grants it permission to read certain information about your store. The App subscribes to notifications ("webhooks") for events you choose to be alerted about.

What we receive

When one of your chosen events occurs, Shopify sends the App a notification containing information about that event. From a new or cancelled order, the App uses only:

• the order ID, to prevent duplicate alerts and to link to the order in your Shopify admin;
• the order number;
• the order total, subtotal, tax, shipping price and discount amount, and the currency;
• the discount codes used on the order;
• the items ordered: each item's product and variant name, quantity, price, SKU and vendor, and the number of items in the order;
• the date and time the order was placed and, for a cancelled order, when it was cancelled, shown in your store's time zone;
• whether the order is a test order;
• the order total in the currency your customer paid in, when it differs from your store's currency;
• the names of discounts that aren't discount codes: automatic discounts, and discounts your staff applied by hand;
• the name of the shipping method, the payment method, the payment status and the fulfillment status;
• the order's tags and the sales channel it came from;
• for a cancelled order, the cancellation reason.

If you switch on customer details (section 2a), the App also uses the ones you chose: the customer's name, the shipping and billing addresses, and the phone number on the order.

If you add the order note to your own custom template, when the App offers it, the App also uses the note your customer wrote on the order at checkout.

For stock alerts, the App uses the stock level from Shopify's notification, and reads from your store the product and variant name, the SKU, the product's ID (to link to it in your Shopify admin) and the stock available across your locations.

For every alert, the App also uses your store's name and myshopify.com domain. Which of these details appear in a message depends on the message style you choose, as described below.

What we do not use or store

Shopify's order notifications may technically contain personal data about your customers. Apart from the customer details you switch on (section 2a), and the order note if you add it to a custom template, the App deliberately ignores this. We do not store any of it, and we do not use or transmit:

• customer names, phone numbers, and shipping and billing addresses, unless you switch them on as customer details (section 2a);
• customer email addresses;
• the buyer's IP address, the addresses' geolocation and other technical fields;
• order notes, unless you add the order note to your own custom template, when the App offers it;
• payment details;
• any other customer-identifying information.

Apart from the customer details you switch on and an order note you add to a custom template, none of this information appears in your Telegram alerts, and none of it is written to our database. Apart from the order ID and the low-stock alert state described in section 3, event data is processed in memory only, for the moment it takes to compose and send your alert, and is then discarded.

What Dingio sends to your Telegram chats

When an order is placed or cancelled, or stock runs low, Dingio sends a message to your main chat, the Telegram chat or group you connected. On the Pro and Business plans, it also sends it to each other chat you added that gets that kind of alert (section 2a). What it contains depends on the message style you choose in the App:

• New orders. Standard (every plan): the order number, your store name, the order total and currency, the number of items, and a link to the order in your Shopify admin. Items list (every plan): the same, plus each item's quantity, product and variant name and price (up to five items, then how many more). Compact (Pro and Business): the order number, total, number of items and the link, on one line. Detailed (Pro and Business): the Items list, plus the shipping method and shipping price, any discount codes and the discount amount, the payment method and payment status, the order's tags and the sales channel, and the customer details you switched on (section 2a): the name and phone number, the shipping address, and the billing address when it differs from the shipping address or the order has none.
• Cancelled orders (the same styles on the same plans). Standard: the order number, your store name, the total and a link to the order. Items list: the same, plus the number of items and each item as above. Compact: the order number, total and link, on one line. Detailed: the Items list, plus the cancellation reason, the payment method and the payment status, and the customer details you switched on, as for new orders.
• Low stock. Standard (every plan): the product and variant name, whether it is low, still low or sold out, how many are left, your store name and a link to the product in your Shopify admin. When several products run low at about the same time, one message lists up to ten of them. Detailed (Pro and Business) adds your low-stock threshold and the SKU; SKU first (Pro and Business) puts the SKU before the product name.
• Custom templates (Pro and Business): your own text, with placeholders from a fixed list. The placeholders cover only the details listed under "What we receive" above: everything the styles above use, plus, for orders, the subtotal, the tax, each item's SKU and vendor, the fulfillment status, when the order was placed or cancelled, whether it is a test order, the total in your customer's currency and the names of automatic and manual discounts. These extra order details appear only in your own templates, never in the styles above. Placeholders for customer details work only for the details you switched on (section 2a), and stay empty otherwise. When the App offers it, you can also add the order note: the text your customer wrote on the order at checkout, which may contain any personal data they chose to write there. It appears only in the templates you add it to, and is never stored. For the order note, as for customer details, you are the controller and we process it on your behalf under our Data Processing Addendum.
• Customer details (section 2a) appear only in the Detailed style and in custom templates, never in Standard, Compact or Items list, and never in the standard message Dingio sends when your own message can't be built.

Dingio also sends the test messages you ask for, which use sample data, and notices about your plan's alert limits. Messages never contain your customer's email address, IP address, or anything the customer entered for an item at checkout. They contain your customer's name, addresses or phone number only if you switched that detail on (section 2a), and the order note only if you add it to your own custom template, when the App offers it. If you or another app put customer details into order tags, discount codes or names, or product names, those details appear in alerts that include those fields.

If Dingio can no longer send alerts to a chat you added, for example because your bot was removed from the group or the person blocked your bot, it sends one message about it to your main chat. The message names a group by its title, if it has one. It never names a private chat. Test messages to a private chat you added end with a short note to the person. The note says what Dingio stores about them and how to object, with a link to this policy (section 2a, "If a store added your private chat"). The chat's alerts also end with this note until a message with it has reached the chat.

Telegram is a third-party service. Messages in your chats are stored by Telegram under its own terms and are not deleted by Dingio when you uninstall the App.

2a. Optional features

Some features of the App are optional and off until you switch them on. What this policy says about an optional feature applies to your store only if you switch it on, and from the moment you do. While a feature is off, the App handles your store's data as the rest of this policy describes. When you switch it off, it stops from the next alert.

Customer details in alerts (Pro and Business)

On the plans that include it (Pro and Business), you can have these details of the order added to your new order and cancelled order alerts. Each one is switched on separately, and all are off until you switch them on:

• Name: the customer's name from the order: the name on the shipping address or, if the order has no shipping address (for example a pickup order), the name on the billing address, or else the customer's name. So that you and your staff can pack, label and deliver the order, and know who it is for.
• Addresses: the shipping address and the billing address of the order: address lines, city, region, postal code and country. The shipping address so that you and your staff can pack, label and deliver the order; the billing address so that you can check payment and invoicing details, for example when the billing address differs from the shipping address.
• Phone: the phone number on the shipping address or, if it has none, the order's phone number, or else the phone number on the billing address. So that you and your staff can contact the customer about delivery.

They appear in the Detailed style and in custom templates that include them (section 2). The App never uses the customer's email address or the addresses' geolocation for this, and we have not asked Shopify for access to customers' email addresses.

How they are handled. When Shopify notifies the App of an order, the App copies only the details you switched on, puts them into your message in memory and sends it to your main chat. They are never written to our database, our logs or our backups, and never included in error reports, the operator notifications described in section 3, Recent alerts, emails from us or anything else the App does. They are held in memory only for as long as it takes to send the alert: usually a second or two, and up to a few minutes if Telegram asks the App to slow down. Test messages use a made-up sample customer, never a real one. If you switch a detail off, or your plan no longer includes customer details, it is left out of the very next message the App sends.

What we store. Only which details you switched on, and when you accepted which version of our Data Processing Addendum. This is information about your store's settings, not about your customers, and it is deleted with your other settings (section 8).

Your role and ours. For these details you are the controller and we are your processor: we process them only to deliver your alerts, on your instructions, under our Data Processing Addendum. You accept it in the App when you switch on your first customer detail. Your responsibilities when you use them are in section 2 of our terms of service.

Telegram. Your alerts go to the Telegram bot you created and your main chat, which you use under your own agreement with Telegram. Telegram is the channel you chose to receive your alerts, not a provider we engage to process your customers' details, and we send the details there on your instruction. Once delivered, the messages are held by Telegram under its terms: Telegram may store them outside the European Union, chats with bots are not end-to-end encrypted, everyone in the chat can see them, and they stay until someone deletes them. Dingio does not keep the IDs of the messages it sends, so it cannot delete them for you.

More chats (Pro and Business)

On the Pro and Business plans, you can add more Telegram chats besides your main chat, up to the number of chats your plan includes. Your main chat counts as one of them. You choose which alerts each chat gets. A chat you added gets only those alerts. To add a group, you add your bot to it. To add a private chat, the person presses Start in your bot. The App receives the chat's ID and name from Telegram, sends the chat a test message, and stores the chat ID and name once the chat is added. While you add a private chat, the App shows the Telegram first names of the people who recently wrote to your bot, so you can check it is the right person. The App does not store these names. Customer details and the order note go only to your main chat, never to a chat you added. Notices about your plan's alert limits go only to your main chat.

If a chat you added stops getting alerts, the App tells your main chat once (section 2). When you add a person's private chat, the App tells them what it stores about them and how to object, with a link to "If a store added your private chat" below. Add only the private chats of people who expect your alerts, and tell them before you add them (section 11).

The chat ID, name and settings of each chat you added are kept until you remove the chat, or about 48 hours after you uninstall, when Shopify asks us to erase your store's data (section 8). When you remove a chat, alerts already on their way to it can still arrive for up to 30 minutes. If you move to a plan with fewer chats, the App pauses the chats your plan no longer includes and keeps their settings, so they can start again if you upgrade.

If a store added your private chat

This part is for you if a store added your private Telegram chat in Dingio, so that you get the store's alerts there. We are the controller of the data about you that this part describes (section 1). The store decides who to add. We ask stores to add only people who expect their alerts, and to tell them first (section 11).

What we receive. You pressed Start in the store's Telegram bot. Dingio receives details about you from Telegram, through the store's bot. This happens when the store looks for a chat in Dingio, checks your chat or sends your chat a test message. It also happens each time Dingio sends an alert to your chat. The details are your chat ID (your Telegram user ID), your @username, if you have one, and your first and last name.

When the store looks for a chat, Dingio also receives the recent messages you sent to the bot (for example "/start"), the language your Telegram app is set to, and whether you have Telegram Premium. When the store checks a chat ID it entered, Telegram's answer can also include other parts of your Telegram profile, as far as your Telegram privacy settings allow. For example, this can be your bio, birthday, profile photo, personal channel or business details. While the store adds your chat, Dingio shows the store your first name, so it can check that it is adding the right person. Dingio uses these details in memory, only for that moment. It ignores the ones it doesn't need. It never stores them, apart from your chat ID and @username (see below).

What we store, and why. Once the store has added your chat, Dingio stores:

• your chat ID, to send you the alerts the store chose;
• your @username, if you have one, so the store can see in Dingio whose chat it is. If you change it, Dingio can get the new one from Telegram when the store tests your chat or looks for a chat in Dingio;
• the store's settings for your chat: which alerts it gets, when a test message last reached it, when the store's main chat was last told that your chat stopped getting alerts, and when your chat was added and last changed;
• for each of the last 50 alerts sent to your chat: the type of alert, when it was sent, whether it reached you and, if not, why (for example, that the bot was blocked). We keep this so the store can find and fix delivery problems, and so we can keep the service reliable. Notifications to the App's operator about failed alerts name your chat only as "extra private chat". They never include your chat ID, @username or name;
• if Telegram asks Dingio to slow down sending to your chat, your chat ID and the time when sending may start again. These are deleted about a day after that time (24 to 27 hours after it).

Dingio does not store the text of the alerts or the IDs of the messages it sends. This means it cannot delete messages from your chat. You can delete them yourself in Telegram. Dingio does not use your data for anything else.

If your chat stops getting alerts. If alerts can't reach your chat, for example because you blocked the bot, Dingio sends one message about it to the store's main chat. The main chat can be a group of the store's staff. The message doesn't give your name or @username, but the store can see in Dingio which chat it is. It doesn't say whether you blocked the bot.

Who receives your data.

• The store, and the people in its main chat, as described above.
• Telegram, which delivers the messages. Telegram may process data outside the European Union, under its own terms (section 6).
• Our hosting providers, Fly.io and Neon, in the European Union (section 7).
• If you write to us: Cloudflare, which forwards email sent to dingio@epicpilotlabs.com to our support inbox; Google (Gmail), our support inbox, where we read your email; Resend, which delivers our reply; and Anthropic, whose AI assistant (Claude) we may use to help answer you. Google, Resend and Anthropic may process data outside the European Union (sections 6 and 7).

Legal basis. Legitimate interests (Art. 6(1)(f) GDPR): the store's interest, and ours, in:

• getting the store's alerts to the people on its team who should get them;
• telling the store when the alerts no longer arrive;
• keeping the service reliable.

When you write to us, we use your message to answer you. If you are using your rights, the legal basis is our legal obligation (Art. 6(1)(c) GDPR). Otherwise, it is our legitimate interest in answering you (Art. 6(1)(f) GDPR).

How long we keep it. We keep your data until the store removes your chat in Dingio. When it does, Dingio deletes these at once: your chat ID, your @username, the store's settings for your chat and the delivery status of the alerts sent to your chat. A note that Telegram asked Dingio to slow down is deleted about a day after sending may start again, as described above, even if your chat was removed before then. If the store uninstalls the App, this data is deleted about 48 hours later, when Shopify asks us to erase the store's data (section 8). If the store installs the App again before then, the data is kept. If you write to us, we keep your emails as section 8 says for support emails: until 2 years after your last email to us.

How to stop.

• Ask the store to remove your chat in Dingio. The alerts stop, and your data is deleted as described above. Alerts already on their way when your chat was removed can still arrive for up to 30 minutes.
• Write to dingio@epicpilotlabs.com. We remove your chat. This stops the alerts and deletes your data, as in the first point. We tell the store that we removed it at your request. We don't share what you wrote to us with the store.
• Block the store's bot in Telegram. The alerts stop, but your data stays until the store removes your chat or you ask us to remove it. Dingio also tells the store's main chat, as described above. While the bot stays blocked, the store can't add your chat again.

Your rights. You can ask us for a copy of the data we hold about you. You can also ask us to correct it, delete it or restrict its use. You can object to our use of it at any time (Art. 21 GDPR). If you do, we remove your chat. To use any of these rights, write to dingio@epicpilotlabs.com. We answer within one month. You can also complain to a data protection authority, for example in the country where you live or work. Our data protection authority is the State Data Protection Inspectorate of Lithuania (Valstybinė duomenų apsaugos inspekcija).

People the store did not add. When a store looks for a chat, Dingio also receives the recent messages that other people sent to the store's bot, with their chat IDs, names, @usernames, language settings and whether they have Telegram Premium. Dingio uses them in memory only, to offer the store the chats it can add. It shows the store those people's first names, so the store can pick the right one. It stores nothing about the people the store does not add.

3. What Dingio stores

Dingio stores: your settings (bot token, your main chat and which alerts it gets, the other chats you added and which alerts each one gets, your bot's username and each chat's name, your low-stock threshold, any message templates you write, which customer details you switched on and when you accepted which version of our Data Processing Addendum), your plan and usage, the access token Shopify gives the App, the store owner's email address and your store's public contact email (both from Shopify, used only for emails about the App, as described below), low-stock alert state per product variant, the delivery status of your recent alerts, daily alert counts, your store's time zone and Shopify's ID for your store, and when you last opened the App. Order IDs are kept for 7 days only, to prevent duplicate alerts. Shopify's order data includes technical fields such as the buyer's IP address; Dingio ignores them and never stores them. Dingio does not store order contents or your customers' information. The access token is deleted as soon as you uninstall the App; everything else about 48 hours later, when Shopify sends us the request to erase your store's data (apart from an Early Supporter store's myshopify.com address, as described in section 8).

In more detail, this is what we keep in our database and why. Some of it you enter yourself; the access token, both email addresses, the time zone and the store ID are provided by Shopify.

Notifications to the App's operator

So that problems can be spotted and fixed quickly, the App also sends short notifications to the operator's own Telegram chat. Each one names your store by its myshopify.com address, and they cover: when the App is installed or uninstalled; the reason and details you gave Shopify when uninstalling, if any; server errors (the time, the part of the App affected and the error message, with tokens and email addresses removed); alerts that could not be delivered (the alert type, Telegram's error, and whether the chat was your main chat, another group or another private chat); and a daily summary of each store's setup, alert counts and delivery status, plan and usage, and, for a store that has had no alerts for a week, how many orders it has had (a number only). They never contain order details or your customers' information.

All of this relates to you, your store and the people whose private chats you add - not to your customers.

4. Do we ask for information about your customers?

Only for optional features, and never to keep it. The App never stores personal data about your customers or your store's visitors, and uses your customers' personal data only for an optional feature you switch on (section 2a). We ask Shopify for access only to the protected customer data fields that an optional feature needs: today name, address and phone, for customer details in alerts. We have not asked for access to customers' email addresses.

Shopify gives an app access to these fields for every store it is installed on, so its order notifications to the App can contain them even if your store has not switched customer details on. In that case the App discards them as soon as the notification arrives, without using, storing or sending them.

5. How your information is used

We use the information described above solely to:

• deliver the alerts you have enabled to your main chat and the other chats you added, including, in your main chat, the customer details you switched on (section 2a), which are used for nothing else;
• tell your main chat when a chat you added stops getting alerts;
• remember your settings between visits;
• apply your plan's limits and show your plan and usage in the App;
• respond to your support requests;
• email you about the App: essential notices (changes to the App's plans, their limits or our terms of service, a fault affecting your alerts, discontinuation of the App, and anything else about your store's plan or account, for example when your alerts near or reach your plan's limit) and non-essential emails (help finishing setup and occasional updates about new features), which you can stop by replying "unsubscribe" to any email from us;
• understand which channels bring merchants to Dingio, and which of them bring stores that stay active and pay for a plan, using the App Store listing analytics described in section 6b;
• diagnose technical errors and keep the App running reliably.

We do not sell, rent, or share your information for advertising or marketing. Apart from occasional updates about the App's own features, which you can stop at any time, we send no marketing email and never use your email address for other products. We do not use your information for automated decision-making or profiling.

5a. Legal bases

Where the GDPR applies, we rely on these legal bases:

• Contract (Art. 6(1)(b) GDPR): providing the App and its plans under our terms of service - delivering your alerts, keeping your settings, applying your plan's limits and showing your usage, answering your support requests, sending the essential notices described in section 5, and keeping your customer details choices and the record of your acceptance of our Data Processing Addendum.
• Legitimate interests (Art. 6(1)(f) GDPR): keeping the App secure, for example by verifying that notifications really come from Shopify; diagnosing errors and keeping the service reliable, including the operator notifications described in section 3; delivering a store's alerts to the private chats it adds, keeping those chats' IDs, @usernames, settings and delivery status to do that, and telling the store's main chat when one of those chats stops getting alerts (section 2a, "If a store added your private chat"); using an AI assistant to build the App and to help answer support requests (see section 7); sending help finishing setup and occasional updates about new features, which you can stop at any time; keeping an Early Supporter store's myshopify.com address after its data is erased, so that it keeps that plan if it installs Dingio again; understanding which channels bring merchants to Dingio, and which of them bring stores that stay active and pay for a plan, using the App Store listing analytics described in section 6b; and counting page views on our websites without cookies.
• Legal obligation (Art. 6(1)(c) GDPR): responding to data protection requests and meeting other legal requirements that apply to us.

Where we rely on legitimate interests, you can object at any time (see section 10).

For the customer details you switch on (section 2a), we act as your processor, so the legal basis is yours as the controller, not ours. For details used to fulfil your customers' orders, that is normally the contract with your customer (Art. 6(1)(b) GDPR).

6. Where your information is stored

The App runs on servers located in Frankfurt, Germany (European Union), and its database is hosted in the European Union. Data is encrypted in transit (HTTPS/TLS) and at rest by our hosting providers.

Some of the providers listed in section 7 (Cloudflare, Resend and Google) may process data outside the European Union. Where they do, they rely on the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.

Telegram, which delivers your alerts to your main chat and the other chats you added, our operator notifications (section 3) and our support conversations with you (section 8), may also process data outside the European Union, under its own terms. If you switch on customer details, that includes the details in your alerts (section 2a).

Anthropic (section 7) may process the information we share with it outside the European Union. Its privacy policy says that Anthropic Ireland, Limited is responsible for the personal data of its users in the European Economic Area, which includes us, and that Anthropic may transfer it to the United States and other countries outside the European Economic Area, relying on adequacy decisions of the European Commission, standard contractual clauses or, in some situations, other grounds that data protection law allows.

6a. Our websites

This policy covers the App. Our websites (epicpilotlabs.com) use Cloudflare Web Analytics to count page views. It sets no cookies, does not fingerprint visitors, and does not track anyone across sites. Nothing on our websites asks you for personal data.

6b. Our Shopify App Store listing

When you visit Dingio's listing on the Shopify App Store, Shopify sends us analytics about the visit through Google Analytics 4: the pages viewed, how you reached the listing (for example the App Store search term or category, or the site that referred you), and whether you clicked Install or Open. When a store installs Dingio, Shopify also sends us an install event with the store's Shopify ID, store name and myshopify.com address.

We use this only to understand which channels bring merchants to Dingio. We may link an install event to the store's Dingio account, to see which channels bring stores that stay active and pay for a plan. We do not use it for advertising.

Cookies on the Shopify App Store are set and managed by Shopify under Shopify's privacy policy, and you manage your cookie choices there. Google processes this data on our behalf, and it is kept in Google Analytics for up to 14 months.

7. Service providers

We rely on the following providers to operate the App. Each processes only what is necessary for its function:

• Fly.io - application hosting (Frankfurt, EU). If you switch on customer details, your alerts are put together in memory on its servers (section 2a).
• Neon - database hosting (EU region). It never receives customer details.
• Telegram - delivery of your alert messages, through the bot you created, to your main chat and the other chats you added, under your own agreement with Telegram (for customer details, see section 2a); and delivery of the operator notifications described in section 3 and of our support conversations with you (section 8), for which Telegram is our provider. The content of alerts and operator notifications is limited to what sections 2, 2a and 3 describe.
• Shopify - the platform the App is installed on, which provides the event notifications.
• Cloudflare - website hosting and cookieless page view analytics for our public websites, and forwarding of email sent to our support address (dingio@epicpilotlabs.com) to our support inbox. Not used by the App itself.
• Resend - delivery of the emails we send to merchants about the App, including our replies to your support emails, which can quote your message. It receives the recipient's email address and the content of the email.
• Google (Gmail) - our support inbox, where emails sent to dingio@epicpilotlabs.com are read and answered.
• Google Analytics (Google Ireland Limited) - analytics for Dingio's Shopify App Store listing, as described in section 6b.
• Anthropic (Claude) - an AI assistant we use to build the App and to help answer support requests. When a task needs it, we may share information about your store with it: its myshopify.com domain, the delivery status of your alerts, your usage counts, and your support messages with any customer details removed. Anthropic handles this information under its own terms and privacy policy. We have turned off its use of our chats to train its models; its privacy policy still allows that for a chat flagged for a safety review or one we send it as feedback. We never share your customers' details with it.

8. How long we keep information

• Order and stock event data: order IDs are kept for 7 days, only to prevent duplicate alerts, and then deleted. For stock events, only the low-stock alert state per product variant is kept. Everything else in an event is processed in memory and discarded as soon as your alert is sent.
• Customer details (section 2a): not kept. Held in memory only for as long as it takes to send your alert, then discarded. Copies in your Telegram chat are held by Telegram until someone deletes them. Your customer details choices and your acceptance record are kept with your settings.
• Your settings and store contact details (bot token, chat IDs, preferences, store name, the store owner's email and the store contact email): kept while the App is installed. When you remove a chat you added, its chat ID, name and settings are deleted at once, together with the delivery status of its alerts. Alerts already on their way to it can still arrive for up to 30 minutes. If Telegram had asked the App to slow down for that chat, the App keeps a note of its chat ID and of when sending may start again. This note is deleted about a day after that time (24 to 27 hours after it).
• After uninstall: when you uninstall the App, your Shopify session and access token are deleted immediately, so the App can no longer access your store. Your settings (bot token, chat IDs, alert preferences, store name and both email addresses) are kept for a short grace period of about 48 hours, so that reinstalling within that time restores your setup instead of requiring you to configure Telegram again. Customer details and the order note are an exception: they come back switched off, and switching them on asks you to accept our Data Processing Addendum again. Shopify then sends the request to erase your store's data, at which point everything associated with your store is deleted: settings (including your customer details choices and acceptance record), the other chats you added, tokens, chat IDs, email addresses, plan and usage records, low-stock alert state, alert delivery status, daily alert counts, order IDs and session records. Nothing is retained in Dingio's own systems, except that if your store was on the Early Supporter plan, we keep only its myshopify.com address, so that it keeps that plan if it installs Dingio again. If you install Dingio again before the erase request arrives, your settings and data are kept. Messages already delivered to your Telegram chats are held by Telegram and are not deleted by Dingio.
• Support messages: support emails between you and us are kept until 2 years after your last email to us, and then deleted automatically, unless the law requires us to keep a particular email longer, for example because it is an invoice. Our Telegram conversations with you stay in Telegram until you or we delete them; you can delete a conversation for both sides at any time. You must not send us your customers' personal data, for example in support emails, Telegram messages or screenshots of your alerts. If you do, that is your decision: we use it only to answer your request, and keep and delete it together with the support conversation it is in.
• Emails from us: Resend, which delivers the emails we send you, including our replies to your support emails (section 7), keeps each one, with its recipient and content, for 30 days.
• App Store listing analytics: the analytics described in section 6b, including the install event with your store's Shopify ID, store name and myshopify.com address, are kept in Google Analytics and deleted automatically after 14 months. They are not part of what Shopify's request to erase your store's data removes.

9. Data protection requests

The App supports Shopify's mandatory privacy webhooks:

• customers/data_request - as Dingio does not store customers' personal data, there is nothing to provide.
• customers/redact - as Dingio does not store customers' personal data, there is nothing to delete.
• If you sent us a customer's personal data in a support message (section 8), it is kept and deleted together with that support conversation, and we delete it sooner if asked.
• If you switched on customer details (section 2a), copies of them may be in your Telegram chat. That chat is yours: we cannot see or delete its messages, so a customer's request covering them is for you to handle, and we will help as our Data Processing Addendum describes.
• shop/redact - all data for your store in Dingio's own systems is deleted, apart from an Early Supporter store's myshopify.com address, as described in section 8. The App Store listing analytics in Google Analytics (section 6b) are not part of this request; they are deleted automatically after 14 months.

If you would like a copy of the data we hold about your store, or want it deleted from Dingio's own systems before uninstalling, email dingio@epicpilotlabs.com and we will action it.

10. Your rights

Depending on where you are located (for example, under the GDPR in the EU/EEA or the UK, or the CCPA in California), you may have rights to access, correct, delete, or export the personal data we hold about you, and to object to or restrict its processing. Since the data we hold relates to your store account, you can exercise most of these rights directly in the App: you can change your bot, your main chat or the other chats you added, or turn alerts off. Uninstalling the App deletes your data, as described in section 8. For anything else, contact dingio@epicpilotlabs.com. If a store added your private chat, see "If a store added your private chat" in section 2a. It says how to use your rights.

Replying "unsubscribe" to any email from us stops every non-essential email: help finishing setup and updates about new features of the App. Essential notices still go out while the App is installed: changes to the plans, their limits or our terms of service, a fault affecting your alerts, discontinuation of the App, and anything else about your store's plan or account, for example when your alerts near or reach your plan's limit. Apart from those occasional feature updates, which you can stop at any time, we send no marketing email, never use your email address for other products and never share it for marketing.

If you are in the EU/EEA and believe we have not handled your data properly, you have the right to lodge a complaint with your local data protection authority.

11. Security

Your Telegram bot token is stored in our database and is never displayed back to you or exposed to your browser after saving. All connections between Shopify, the App, and Telegram use encrypted HTTPS/TLS. Incoming notifications from Shopify are cryptographically verified before being processed. Access to our production systems is restricted to the App's operator.

Please note that the alerts themselves are delivered through Telegram. They are subject to Telegram's own privacy practices and to the security of the chats and groups you connect. You control which chats receive them. At any time in the App, you can change or remove chats, or turn alerts off. You can also stop the alerts completely by uninstalling the App. If you switch on customer details, make sure only the people who need them are in your main chat (section 2a). Add only the private chats of people who expect your alerts, and tell them before you add them.

12. Children

The App is a business tool intended for Shopify merchants and is not directed at children.

13. Changes to this policy

We may update this policy as the App evolves or as legal requirements change. This policy forms part of our terms of service, so, as section 12 of the terms says, we will give at least 30 days' notice, through the App and/or by email, before a change that affects your rights takes effect. Other changes, such as corrections and clarifications, apply from the "Last updated" date at the top, which reflects the most recent revision.

Adding an optional feature (section 2a) does not change how the App handles your store's data while the feature is off, so it is not a change that affects your rights. What this policy says about it applies to your store from the moment you switch it on. A later change to an optional feature that affects your rights gets the same 30 days' notice, to the stores that have it switched on.

14. Contact

Questions, requests, or concerns about privacy:

Marius Šiupšinskas, trading as EpicPilot Labs
Individual activity (individuali veikla) registered in Lithuania
Lithuania, European Union
Telegram: @EpicPilotLabs
Email: dingio@epicpilotlabs.com

EpicPilot Labs is the trading name of Marius Šiupšinskas, not a separate company.