Privacy policy

Alify · Shopify app and Chrome extension · Last updated: 28/08/2026

Leer esta política en español

Who processes your data

What Alify is

Alify is a tool for merchants who sell through Shopify and buy from AliExpress suppliers. It brings together in one place the store's orders, shipment status, issues, returns, inventory and accounts.

It has two parts: a web application, where the merchant works, and a Chrome extension that reads the merchant's own AliExpress purchases to bring in tracking numbers and amounts.

What data is processed

About the merchant using Alify: their email address and login password, their store name, and the credentials they authorise to connect Shopify and email sending. Passwords and keys are never shown once saved.

About that store's end customers, obtained from Shopify with the merchant's permission: name, shipping address and email address, together with the content and amount of their orders. Phone numbers and payment details are not processed; Alify never receives them.

About purchases from suppliers, read by the extension from the merchant's own AliExpress account: order number, tracking number, shipment status, amount and import duties.

What it is used for

• Showing the merchant their orders and which shipment belongs to whom.
• Notifying the customer by email about the status of their shipment, return or exchange.
• Checking, in the public returns form, that the person requesting a return is the owner of the order. To do so, they are asked for the email address they used to buy.
• Calculating the costs of each sale and preparing the merchant's accounting reports.

The data is not used for advertising, for profiling, or for automated decisions about people. It is not sold or shared with third parties for commercial purposes.

The Chrome extension

The extension only acts on AliExpress order pages, and only when the merchant starts a sync. It reads the information about their own purchases and sends it to their Alify account.

It does not read other pages, does not record what is typed, does not monitor browsing and does not send anything anywhere other than the user's own Alify account.

Who it is shared with

Alify relies on providers that process data on behalf of the controller, each for a specific function:

• Supabase — database where the information is stored.
• Vercel — servers where the application runs.
• Shopify — source of the orders, with the merchant's authorisation.
• Resend — sending emails to customers.

None of them uses the data for their own purposes. Where any of them processes information outside the European Economic Area, the transfer is covered by the European Commission's standard contractual clauses that the provider has signed.

Separation between stores

Each store sees only its own data. This separation does not rely on the software alone: it is enforced by the database itself, so a query cannot return another store's information even if asked to.

Data processing agreement

This section serves as the data protection agreement between Alify and each merchant who uses it. Accepting the use of Alify means accepting it.

Roles

For end customers' data, the merchant is the controller: they decide what it is used for. Alify is the processor and processes it only following their instructions, which are the functions the application itself offers. For the merchant's account data —their email, password and billing— Alify is the controller.

What is processed and for how long

• Subject matter: managing orders, shipments, issues, returns, inventory and accounting for the merchant's store.
• Duration: for as long as the merchant keeps their Alify account or the app installed in their store.
• Data subjects: that store's end customers.
• Categories of data: name, shipping address, email address and the content and amount of orders. No special categories of data, phone numbers or payment details are processed.

Alify's commitments

• To process the data only for the purposes described in this policy, and never for its own purposes.
• To maintain the security measures described below, and to keep the data confidential indefinitely.
• Not to use any sub-processors other than those listed in “Who it is shared with”. If any changes, merchants are notified by email sufficiently in advance so they can object.
• To help the merchant handle their customers' requests —access, rectification, erasure— and respond to the supervisory authority if required.
• To report any security breach affecting their data without undue delay and within 72 hours at most of Alify becoming aware of it, describing what happened, which data is affected and what is being done.
• To delete the data when the relationship ends, within the periods in the next section, without keeping a copy.
• To make available to the merchant the information needed to demonstrate compliance with all of the above.

Security measures

• All traffic is encrypted with HTTPS, and the database and its backups are encrypted at rest.
• The separation between stores is enforced by the database, not just by the software.
• Access keys are stored only on the server and never reach the browser. Shopify permissions expire every hour and renew automatically.
• Access to the database is restricted to Alify's operator, with two-step verification, and is logged.
• Real data is not copied to test environments: tests are done on development stores with fictitious orders.

How long it is kept

The data is kept for as long as the merchant keeps their account active, because they need it for their day-to-day management and to meet their accounting obligations. From then on, these periods apply:

• When the account is deleted from Settings → Store: their data, their customers' data and their own access are deleted immediately, without keeping a copy.
• When Alify is uninstalled from the Shopify store: the data is likewise deleted, following the notice Shopify sends for this purpose, within 30 days at most.
• If an end customer requests erasure through Shopify: their personal data is removed from the issue or return, which is kept without name, email or address, because deleting it entirely would throw off the merchant's accounts. Once done, that record cannot identify anyone.
• Technical access logs (date, IP address, page visited), generated by the hosting providers: kept for a maximum of 30 days.
• Backups: the data disappears from them in the normal rotation cycle, which does not exceed 30 days.

Your rights

You can request access, rectification, erasure, restriction, objection and portability by writing to alify.service@gmail.com. You can also lodge a complaint with the data protection authority in your country.

If you are a customer of a store that uses Alify, please contact that store first: it decides what is done with your data. Alify processes it on its behalf.

Changes

If this policy changes, this page and its date will be updated. Important changes will be announced to merchants by email.