Privacy policy

Last updated 22 September 2026

Bee File Uploader Kit ("the app") is a Shopify app made by Bee Creative ("we", "us"). It lets a Shopify merchant's customers upload files on the merchant's product pages, and delivers those files with the order. This policy explains what information the app collects, why, where it is kept, for how long, and the choices merchants and their customers have. Questions: beecreative.pk@gmail.com.

Who is responsible for what

For files and details a customer gives on a store, the merchant who runs that store decides how they are used, and Bee Creative processes them on the merchant's behalf, only to provide the app. For the details of merchants who install the app, Bee Creative is responsible. Customers with questions about their files should contact the store they ordered from first; we help merchants answer them.

Information we collect

From merchants who install the app

• The store's Shopify address and the access Shopify grants the app when it is installed.
• The app's settings: upload fields, which products they show on, styles, the plan, and store settings.
• If the merchant connects their own Cloudflare R2 bucket: its account ID, bucket name, public address and access keys. The secret key is encrypted before it is saved and is never shown again.
• If the merchant connects Google Drive: the Google account's email address and an access token, encrypted before it is saved.

From customers of those stores

• The files they upload, with each file's name, size and type, and any note they add to a file.
• A link, if they upload from one: the app fetches the file at that address and keeps the file, not the link.
• Once an order is placed, which order and which Shopify customer the files belong to, so the merchant can find them. We do not collect customers' names, email addresses, phone numbers or addresses.
• A short-lived code while a customer uploads from their phone, which expires after 10 minutes.

We do not collect payment details, and we do not use cookies or trackers on store pages. Our servers keep ordinary technical logs (such as the address a request came from and the time) to keep the service running and secure.

How we use it

Only to provide the app: to store and deliver files, attach them to orders, show them to the merchant, apply the merchant's settings, check which plan they are on, and keep the service secure. We do not sell any information, use it for advertising, or share it with anyone except as described below.

Where it is kept, and who else is involved

• Shopify, where the app runs and which passes it store and order information.
• Cloudflare R2, where uploaded files are stored, unless the merchant uses their own bucket, in which case the files are kept in the merchant's own Cloudflare account.
• Our servers, operated by us with our hosting provider, which run the app and hold its database.
• Google, only if the merchant connects Google Drive: copies of each order's files are saved into the merchant's own Drive.

All traffic to and from the app is encrypted (HTTPS).

How long we keep it

• Uploads that never become part of an order are deleted after 72 hours.
• Files a customer removes before ordering are deleted within 15 minutes.
• Files on an order are kept for 60, 90 or 180 days after the order, depending on the merchant's plan. The merchant is warned 30 days before, and nothing is deleted until at least 14 days after that warning.
• Files in a merchant's own Cloudflare bucket, and copies in their Google Drive, belong to the merchant and are kept for as long as the merchant keeps them.
• When a merchant uninstalls the app, Shopify asks us to erase that store's data, and we delete the store's files and records from our storage and database.

Deletion and access requests

When a customer asks a store to delete their data, Shopify tells us, and we delete that customer's files, including copies we made in the merchant's Google Drive. When a store asks what we hold about a customer, we answer through Shopify. Merchants can also contact us at beecreative.pk@gmail.com.

Google user data

If a merchant connects Google Drive, the app asks only for permission to create files in their Drive and to see the account's email address. It uses that access only to save copies of order files into a folder it creates, and to delete those copies when a customer asks for their data to be deleted. It cannot see any other files in the Drive. Bee File Uploader Kit's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Merchants can remove the app's access at any time, from the app or from their Google account.

Security

Each uploaded file is stored at its own long, random address that cannot be guessed, which is the link that goes on the order. Downloads in the app use signed links that expire. Each store's data is kept separate from every other store's, and keys and tokens that merchants give us are encrypted before they are saved.

Changes to this policy

If this policy changes, the new version is posted here with a new date.

Contact

Bee Creative, beecreative.pk@gmail.com.