Last updated: 11 August 2026
Canfy (“we”, “us”) is a Shopify app that converts a published Canva website into a page on a merchant’s Shopify store. This policy explains what we collect, why, and how long we keep it.
It applies to the Canfy Shopify app only — the app you install on your
store from the Shopify App Store. It does not cover the canfy.app marketing
website, which is a separate service with its own
Privacy Policy.
If you are a shopper who landed on a page a merchant built with Canfy, see Shoppers — the short version is that we hold nothing about you.
Who we are
Canfy is operated by Sakinur Rahman, an individual (sole proprietor), based in Jashore, Bangladesh.
For anything in this policy, including a request to see or delete your data, email sakinur@devluxx.com. We aim to reply within five working days.
What we collect
We only collect what the app needs to work. There is no advertising, no tracking across sites, and nothing is sold.
From your Shopify store
When you install Canfy, Shopify gives us the store details below. We read them once at install and refresh them when your store changes.
| Data | Why we need it |
|---|---|
Store domain (your-store.myshopify.com) | Identifies your account and the store we publish pages to |
| Store name | Shown in the app and in emails to you |
| Store contact email | Sending you app emails: welcome, a one-off setup reminder (which has an unsubscribe link), conversion failures, trial reminders |
| Shopify plan name | Telling development stores apart, since those are never charged |
| Store time zone | Showing dates in your own time zone rather than ours |
| Install and uninstall dates | Working out your trial and subscription period |
We also store the offline access token Shopify issues at install. It is what lets Canfy publish and update your pages, and it is only ever used for that.
About the pages you build
| Data | Why we need it |
|---|---|
| Page title, URL slug, publish state | The page we create in your Shopify admin |
| The Canva URL you paste | Re-importing the design when you press Update |
| The converted page HTML | Re-rendering the page when you change a setting, without re-scraping Canva |
| Any custom CSS you write | Re-applying it every time the page is imported |
| Conversion history and error messages | Showing you why a conversion failed, and support |
Images, fonts and stylesheets from your Canva design are copied to our storage
on Cloudflare R2 and served from cdn.canfy.app, so your page loads from a CDN
rather than from Canva.
When you contact us
Messages sent through the in-app contact form arrive in our support inbox with the subject, message, and reply-to address you typed, plus your store’s domain, plan, and page count so we can help without asking for them. We keep support correspondence as long as needed to resolve the issue and improve the app.
How you use the app
We use Mixpanel to understand how the app is actually used, so we know which features are worth building on and where people get stuck. It records events like installing, converting a page, publishing, and hitting an error, each tagged with your store’s domain, your plan, and basic technical details your browser sends (device type, browser, approximate location from your IP).
It does not record what your pages say, your Canva designs, or anything about your shoppers. You can opt out — email us and we will exclude your store.
What we do not collect
- No shopper or customer data — no names, emails, addresses, orders, or carts
- No payment card details. Shopify handles all billing; we never see a card
- No advertising trackers, ad networks, or cross-site tracking of any kind. We use one product-analytics tool, Mixpanel, described above
- No access to your products, orders, or customers beyond the read-only product lookup used by the cart link generator, which reads a product’s title, price and variant IDs at the moment you pick one and stores none of it
Access permissions
Canfy asks for three Shopify permissions, and nothing else:
- Manage online store pages — create, update, publish and delete the pages it builds for you, and add a redirect when you rename a page’s URL
- Manage online store navigation — only for the “Add to store navigation” button, when you press it
- Read products — so the cart link generator can show your product list when you pick a product for a Buy now or Add to cart link
How your data is used
We use it to run the app: convert your Canva design, publish and update the page on your store, apply your settings, bill your subscription through Shopify, and email you about your account.
We do not use your data to train machine learning models, and we do not share it with anyone for marketing.
Our legal basis
Data protection law asks us to say why we are allowed to process each thing. Here it is, in plain terms:
- Running the app — converting your design, publishing and updating pages, applying your settings: performing our contract with you.
- Billing your subscription through Shopify: performing our contract with you.
- Emailing you about your account — welcome, conversion failures, trial reminders: performing our contract with you. The one-off setup reminder goes out on our legitimate interest in helping new merchants finish setup, and it has an unsubscribe link.
- Understanding how the app is used — the Mixpanel events described above: our legitimate interest in improving Canfy. You can object to this at any time and we will exclude your store.
- Keeping the app secure and preventing abuse — the short-lived server logs described below: our legitimate interest in protecting the service.
- Remembering that a free trial was used after you uninstall: our legitimate interest in stopping the same store restarting the trial by reinstalling.
- Anything the law requires us to keep: compliance with a legal obligation.
Giving us your store details is not a legal requirement, but the app cannot publish pages without them — Shopify passes them to us when you install.
We do not make automated decisions about you that have legal or similarly significant effects, and we do not profile you.
Who else processes it
These are the only third parties involved, and each handles a specific part:
| Provider | What they do | Where |
|---|---|---|
| Shopify | Your store, your pages, and all billing | Global |
| Hetzner Online GmbH | Hosts the Canfy application and database | Germany |
| Cloudflare, Inc. | Network and CDN in front of the app, stores and serves your converted page assets (R2), sends our emails, DNS | Global |
| Hosts our support inbox — the contact form and anything you email us lands there | Global | |
| Mixpanel, Inc. | Product analytics — which features are used and where errors happen | Global |
Canva is deliberately not on this list, because we never send them anything. When you convert a page, we fetch the Canva website you published from Canva’s public servers, the same way any visitor’s browser would. Your relationship with Canva — your account, your designs — is governed by Canva’s own terms and privacy policy.
We have never sold or rented your data and we have no plans to. If Canfy were ever acquired, your data could pass to the buyer as part of the business — we would email you before that happened, and the buyer would be bound by this policy.
International transfers
Our application, database, and the conversion service that imports your Canva design all run on Hetzner servers in Germany. Cloudflare and Shopify operate globally, so data may be processed outside your country. Where that involves transfers out of the EEA or UK, our providers rely on Standard Contractual Clauses.
How long we keep it
| What | Kept for |
|---|---|
| A page you delete | Removed immediately, along with that page’s assets |
| A page’s old assets after an update | Removed when the new version goes live |
| Pages unpublished by a plan downgrade | 2 days, then the assets and our records are deleted |
| Everything after you uninstall | Your store’s assets are deleted after 14 days |
| Your store’s contact details after you uninstall | Deleted when we receive Shopify’s shop/redact request, which Shopify normally sends about 48 hours after uninstall, and in any case within 30 days of receiving it |
| Mixpanel usage events | 12 months, then deleted automatically |
| Your store’s domain and trial dates | Kept after uninstall, so a used free trial cannot be restarted by reinstalling. Nothing else identifying is kept with them |
Your Shopify pages are yours and survive uninstalling. We delete the images and styles we host for them, so they will look broken afterwards, but the pages themselves stay in your Shopify admin for you to keep, edit or remove.
Shopify data requests
Shopify sends every app on the App Store three mandatory requests, and we handle all of them:
customers/data_request— a shopper has asked to see the data an app holds about them. We answer “no data held”, because we hold none.customers/redact— a shopper has asked for their data to be deleted. There is nothing for us to delete, and we confirm that.shop/redact— sent after you uninstall, normally about 48 hours later. On receipt we delete your store’s contact details and anything of yours we still hold.
We action all three within 30 days of receiving them, as Shopify requires, and in practice usually the same day.
Cookies and browser storage
Canfy runs inside the Shopify admin and authenticates with Shopify session tokens, so it sets no tracking cookies and works with third-party cookies blocked.
The app stores two small items in your browser’s sessionStorage: the shop
and host values Shopify passes on load, so the app can reconnect if a
request loses them, and a one-shot flag used during that reconnect. Both are
cleared when you close the tab.
Mixpanel stores its own identifier in your browser so repeat visits to the app are recognised as the same session. It is not an advertising cookie and it is not shared with ad networks.
The app sets no advertising cookies of any kind. Cookies on the canfy.app
marketing website are a separate matter and are covered by that site’s own
Privacy Policy.
Your rights
Depending on where you live, you can ask us to give you a copy of your data, correct it, delete it, or restrict what we do with it. Email sakinur@devluxx.com and we will respond within one month. If your request is a complicated one we may need up to two months more, and we will tell you within that first month if so.
You can also action most of it yourself: delete a page in the app to erase it and its assets, or uninstall Canfy to start the deletion of everything.
If you are in the EEA or UK and think we have handled your data badly, you may complain to your local data protection authority.
Shoppers
If you are a customer of a store that uses Canfy, we hold no personal data about you. Canfy converts a merchant’s design into a page; it does not run on your browser, does not track you, and never receives your order, cart or account details. Requests Shopify sends us on your behalf are answered with “no data held”, because that is accurate.
Security
Traffic to the app is encrypted with TLS. Every request from the Shopify admin is verified with a Shopify session token, and every webhook is verified by its HMAC signature before we act on it. Access tokens and application secrets are held as environment variables and are never written to logs.
Like every web server, ours keeps short-lived operational logs — request paths and IP addresses — used only for debugging and abuse prevention, never for analytics, and rotated automatically.
No system is perfectly secure. If we discover a breach that puts your data at risk, we will report it to the relevant authority within 72 hours of becoming aware of it, and we will tell you without undue delay where the breach is likely to put you at high risk.
Children
Canfy is a business tool sold to merchants. It is not directed at children and we do not knowingly collect data from anyone under 16.
Changes
If we change this policy we will update the date at the top, and for anything significant we will email the address on your store’s Shopify account before it takes effect.
Contact
Email: sakinur@devluxx.com
Web: canfy.app