Privacy Policy

PufferCut is operated by Sates Oy.

Mailing address: Kuivastie 21 47, 90500 Oulu, Finland. Contact: help@pufferstack.com.

When a merchant installs or uses the app, we may access Shopify data needed to provide product video creation, preview, rendering, publishing, billing, and support workflows.

This can include shop domain, shop settings, store locale, currency, product titles, product descriptions, product images or media, variants, prices, compare-at prices, collections or tags used for selection, brand kit assets, generated video configuration, render status, generated video files, and subscription status.

Merchants may provide app settings, brand colors, logos, offer copy, template selections, support messages, newsletter email addresses, and billing choices through Shopify billing.

We may keep logs relating to app usage, rendering events, errors, authentication, and support activity so we can operate, secure, and improve the service.

The app is designed for product video creation and does not require direct buyer profiles to create videos. PufferCut does not request customer or order access scopes for its core product-video workflow.

If Shopify sends a customer data request or customer redaction webhook, PufferCut processes the webhook according to Shopify requirements. Because PufferCut does not store direct buyer profiles for its current workflow, those customer-level requests are generally handled as no customer data stored.

We do not use merchant customer data for advertising or resale.

We use information to authenticate Shopify stores, load product content, create and preview product videos, render requested videos, manage subscriptions through Shopify billing, provide merchant support, send newsletter updates when requested, secure the service, and comply with legal obligations.

We do not sell merchant data or generated video assets.

PufferCut uses analytics and cookies or similar technologies on the public website and embedded app to understand product usage, diagnose issues, improve onboarding, and measure site performance. PostHog is used for product analytics.

The embedded Shopify app follows Shopify platform requirements and does not rely on third-party cookies for core authentication. You can control cookies through your browser settings, though some functionality may depend on essential storage or session behavior.

We retain app data for as long as needed to provide the service, support merchant workflows, keep render history available, comply with billing and legal obligations, and resolve disputes.

After app uninstall, Shopify sends a shop redaction webhook. PufferCut uses that webhook to delete app-held shop data such as render records, render objects, brand kit data, billing records stored by the app, and app installation records, unless retention is required for legal, billing, security, fraud prevention, dispute resolution, or backup purposes.

If a merchant sends a deletion request directly to support, we review and process the request within applicable legal timelines.

Merchants can request access, correction, export, or deletion by contacting help@pufferstack.com. The request should include the store domain and the request type.

PufferCut processes Shopify mandatory compliance webhooks for customer data requests, customer redaction requests, and shop redaction requests.

We use service providers to host the app, store files, process rendering jobs, provide logs, deliver support and newsletter notifications, process analytics, and manage infrastructure.

Current service providers include Vercel for application hosting and deployment, Neon for Postgres database hosting, Hetzner for server infrastructure, Cloudflare for DNS, security, caching, and network services, PostHog for analytics, Resend for newsletter and service email delivery, Hostinger for domain or related hosting services, OpenRouter for AI model routing where AI-assisted features are used, and Shopify for app installation, authentication, APIs, and billing.

These providers process data only as needed to provide their services to PufferCut.

Production app data is intended to be processed and stored in the European Union. Some subprocessors may process limited operational, security, support, analytics, or routing data outside the European Union where necessary to provide their services.

Where personal data is transferred outside the European Economic Area, we rely on appropriate safeguards such as standard contractual clauses, data processing agreements, or other lawful transfer mechanisms where required.

We use administrative, technical, and organizational safeguards designed to protect app data. No internet service can guarantee complete security, but access should be limited to people and systems that need it to operate the service.

We may update this policy as the app, legal requirements, or infrastructure changes. The effective date should be updated when material changes are made.