Privacy Policy — Am2pm Backup
Last updated: 14 October 2026 Provider: AM2PM (am2pm GmbH), Washingtonstrasse 20, 9400 Rorschach, Switzerland · info@am2pm.ch
This policy explains what the Shopify app Am2pm Backup ("the App", "we", "us") processes, where it is stored, and for how long. It is published at https://backup.am2pm-app.ch/privacy and applies together with our Terms of Service. It is written with the EU/EEA General Data Protection Regulation (GDPR) and the Swiss Federal Act on Data Protection (nFADP / revDSG) in mind.
1. The short version
- Your backup is stored in your own Google Drive, not on our servers. The App writes your store's data (products, customers, orders, themes and so on) into a folder in the Google Drive account you connect. You own those files. You can open, download or delete them at any time, and they stay yours if you uninstall the App.
- Our servers keep an index, not the backup. We store metadata so the App can list, compare and restore your backups: item titles, Shopify IDs, timestamps, fingerprints (hashes) and pointers to files in your Drive. We also hold your Google connection token, encrypted.
- Change data passes through us briefly. When your store changes, the change is held on our servers for a few minutes and then written to your Drive as one file. Normally that takes 5–15 minutes, after which we delete our copy.
- The App can see only the files it created in your Drive. We use Google's
drive.filepermission. We cannot see, read or list anything else in your Google Drive. - We do not sell data, show ads, profile anyone, or use your data to train AI models.
2. Roles: who is responsible for what
Your store's data, including your customers' personal data, belongs to you, the merchant. For that data you are the controller and we act as your processor. We process it only to provide the App's backup, restore and export features on your instructions (the settings you choose and the actions you take in the App), and for no other purpose. Section 11 describes how we handle requests from your customers.
Your Google Drive is a service you hold under your own agreement with Google. The App writes into it on your behalf. Google stores those files as your provider, not ours.
Data about you as our user (your store domain, contact email, the Google account email you connect, and how you use the App) is processed by us as controller, to run the service, contact you about your backups, and meet legal obligations.
3. What is stored where
3.1 In your Google Drive (your storage, your control)
The App creates a folder named "Am2pm Backup – your-store.myshopify.com" containing:
| Folder | Content |
|---|---|
packs/ |
Full copies of each backed-up item version: products, collections, customers (names, emails, phone numbers, addresses, notes, tags), orders (including customer and address details on the order), pages, blogs, articles, menus, redirects, discounts, metafield and metaobject definitions, metaobjects, themes and theme files, files, shop policies, locations |
manifests/ |
Lists of which version of every item made up your store at each nightly snapshot |
media/ |
Copies of product images and files from your store |
exports/ |
CSV/JSONL exports you requested |
These files are gzip-compressed JSON that you can open without the App. Retention follows the setting you choose in the App (7 days to 10 years, default 365 days). The App deletes versions older than that from your Drive, except the most recent version of each item. You may delete any of these files yourself at any time; doing so removes that history from your backup.
3.2 On our servers
| Data | Purpose | Retention |
|---|---|---|
| Store domain, name, timezone, currency, App settings | Run the App, schedule nightly backups in your timezone | Until shop deletion (see §8) |
| Notification email (defaults to your store's contact email) | Failure alerts and optional weekly summary | Until you change it or shop deletion |
| Shopify access token | Read and restore your store data on your behalf | Deleted on uninstall |
| Name, email and locale of the staff member using the App (Shopify session data) | Shopify authentication; recording who started a restore in the activity log | Session data deleted on uninstall; activity log until shop deletion |
| Google refresh token, encrypted with AES-256-GCM | Keep writing backups to your Drive without asking you to sign in every hour | Until you disconnect Drive, uninstall, or Google revokes it |
| Google access token (expires within one hour) | Current Drive API calls | Overwritten on refresh; deleted with the connection |
| Google account email address | Show you which Google account is connected | Until shop deletion; retained on disconnect to identify the account holding existing backups |
| Drive folder and file IDs, Drive storage usage | Locate your backup files; warn you before your Drive is full | Until shop deletion |
| Backup index: for each backed-up item, its type, Shopify ID, handle, display title and subtitle, timestamps, content hash, names of changed fields, and the Drive file ID plus byte position of each version | List, search, compare and restore backups without downloading them | As long as the version is retained under your retention setting, at most until shop deletion |
| Restore, export and snapshot job records (items, actions, errors, counts) and the activity log | Show progress and history; support | Until shop deletion |
| Hashes and source URLs of media copied to your Drive | Avoid storing the same image twice | Until shop deletion |
Personal data in the index. For customers, the display title and subtitle normally contain the customer's name and email address. For orders, they contain the order number and the customer's name. This lets you find "the customer who was deleted last Tuesday" without opening your Drive. We store no other customer fields on our servers beyond the transient buffers below.
3.3 Transient copies on our servers
To write your data to Drive, it briefly passes through our systems:
| Data | Where | How long |
|---|---|---|
| Change notifications from Shopify — only the identifier of the changed item is queued (Redis), never its contents — and the full current version of the changed item we fetch afterwards (change buffer, PostgreSQL) | Job queue (Redis) and change buffer (PostgreSQL) | Normally 5–15 minutes, until written to your Drive, then deleted. If your Drive is unreachable (access revoked, Drive full, folder deleted), buffered changes are kept for at most 7 days so no change is lost while you reconnect, then deleted |
| Backup files being assembled before upload, theme archives being built for a restore, export files | Temporary files on our server's disk | Minutes. Deleted as soon as the upload or restore step finishes |
| Data read back from your Drive during a restore | Server memory | Only for the duration of the restore |
3.4 Operational logs and our own database backups
Our servers keep technical logs (time, request path, status, IP address of the caller, error messages) for operating and securing the service, in bounded, rotated log files. We avoid logging store content. We take nightly backups of our database (the index described in §3.2) and keep them for up to 15 days, so data deleted from the live database may remain in these backups for up to 15 more days before it expires. Database backups are encrypted with AES-256 and stored on our hosting server in Finland. A separate off-site backup service is not currently configured.
4. What the App does not do
- It does not access any part of your Google Drive other than the files it created
(
drive.filepermission). - It does not sell, rent or share data with third parties for advertising or marketing.
- It does not use store data or Google data to train artificial-intelligence or machine-learning models.
- It does not place tracking or advertising cookies, and it adds nothing to your storefront.
- It does not contact your customers.
- Our staff do not read your store data or Drive content, except (a) with your explicit permission, for example when you ask us to investigate a failed restore; (b) where necessary for security, such as investigating abuse; or (c) to comply with applicable law.
5. Google user data and Limited Use
When you connect Google Drive, the App requests these Google permissions:
| Scope | What it allows | Why we need it |
|---|---|---|
https://www.googleapis.com/auth/drive.file |
Create files in your Drive and read, update or delete only the files the App created | Store your backup in your Drive, read it back to restore, apply your retention setting |
https://www.googleapis.com/auth/userinfo.email |
See your Google account email address | Show which Google account the backup goes to |
From Google we receive and use: your Google account email address; the files and folders the App created in your Drive; and your Drive storage quota and usage (to warn you before Drive fills up). We use this information only to provide and improve the App's user-facing backup, restore and export features.
Am2pm Backup's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Specifically:
- We use Google user data only to provide or improve the user-facing features of the App described above (storing, reading back, restoring, exporting and retaining your backup).
- We do not transfer Google user data to others, except as necessary to provide or improve those features, to comply with applicable law, or as part of a merger, acquisition or sale of assets with notice to you.
- We do not use or transfer Google user data for serving advertisements, including retargeting, personalised or interest-based advertising.
- We do not allow humans to read Google user data unless we have your affirmative agreement for specific messages or files, it is necessary for security purposes (such as investigating abuse), it is necessary to comply with applicable law, or the data is aggregated and anonymised and used for internal operations.
- We do not sell Google user data, and we do not use it to determine creditworthiness or for lending purposes.
- We do not use Google user data to develop, improve or train generalised or non-personalised AI or machine-learning models.
You can revoke the App's access at any time in the App (Settings → Disconnect Google Drive) or at myaccount.google.com/permissions. Backups stop until you reconnect. The files already in your Drive remain yours.
6. Service providers (subprocessors) and recipients
| Provider | Purpose | Location |
|---|---|---|
| Hetzner Online GmbH | Application, database, job queue and encrypted operational database backups | Finland (Helsinki) |
| Google LLC / Google Ireland Ltd. | Google sign-in (OAuth) and the Google Drive API. Your Drive itself is held by Google under your agreement with Google | USA / EU |
| Shopify Inc. / Shopify International Ltd. | The platform the App runs on; source of store data | Canada / Ireland / USA |
We will update this list before adding a provider that processes personal data, and announce material changes in the App (see §13).
7. International transfers
Our servers are located in Finland. Google and Shopify may process data in the United States and other countries. Where personal data is transferred to a country that the European Commission or the Swiss Federal Council does not recognise as providing adequate protection, we rely on an adequacy decision (including the EU–U.S. Data Privacy Framework and its Swiss–U.S. extension, where the recipient is certified), or on the European Commission's Standard Contractual Clauses as recognised by the Swiss FDPIC, together with supplementary measures where needed.
8. Uninstalling, disconnecting and deletion
Disconnect Google Drive (in the App): we revoke the Google token with Google and delete it from our servers. Backups pause. Your Drive files are untouched.
Uninstall the App: Shopify notifies us immediately. We stop all backups, delete your Shopify
access tokens and session data, delete any buffered changes not yet written to Drive, and revoke
and delete your Google token. About 48 hours later Shopify sends a shop/redact request, and we
then delete all remaining data we hold about your store: the backup index, job history,
activity log, settings and Drive connection details. If you reinstall within those 48 hours,
your settings and backup history are still available.
Your Drive files are not deleted when you uninstall. They are yours. We no longer have
access to them, and you can keep or delete the "Am2pm Backup" folder as you wish. After the
shop/redact deletion, reinstalling starts a fresh backup index. Your old files stay readable
with any gzip tool.
To have your data deleted sooner, email info@am2pm.ch. We will complete it within 30 days.
9. Security
- All connections to the App, to Shopify and to Google use TLS.
- Google refresh tokens are encrypted at rest with AES-256-GCM. The key is held separately from the database.
- The database and job queue are not reachable from the internet, only from the App's own containers on a private network.
- Server access is limited to authorised am2pm personnel, uses SSH keys, and sits behind a firewall with intrusion protection (fail2ban).
- Signed, short-lived links (HMAC, 2-hour expiry) are the only way Shopify can fetch a theme archive during a theme restore.
- The App never shows ads or loads third-party scripts in your admin.
If we become aware of a personal data breach affecting your data, we will notify you without undue delay, and in any case within 72 hours of becoming aware of it where the law requires, so you can meet your own obligations as controller.
10. Legal bases (GDPR / nFADP)
- Contract (Art. 6(1)(b) GDPR): providing the App to you, including holding the index and your Google connection.
- Processing on your instructions as processor (Art. 28 GDPR / Art. 9 nFADP): your store's customer data, which you as controller have a legal basis to back up (typically your legitimate interest in business continuity, Art. 6(1)(f) GDPR, and your record-keeping obligations).
- Legitimate interests (Art. 6(1)(f) GDPR): security, abuse prevention, technical logs and our own database backups.
- Legal obligation (Art. 6(1)(c) GDPR): responding to authorities and compliance requests.
11. Your customers' requests
Shopify forwards your customers' privacy requests to us through mandatory webhooks.
- Data request (
customers/data_request): we compile the metadata about that customer held in our index (display name and email, item IDs, version timestamps) and send it to the store's notification email within 30 days, so you can answer your customer. The full backed-up records are in your Drive under your control. - Redaction (
customers/redact): within 30 days we delete that customer's entries (and the listed orders' entries) from our index and from any transient buffer. Where your Drive is connected, the App also removes that customer's records from the backup files in your Drive by rewriting the affected files. If your Drive is disconnected at that time, we tell you, so you can delete them yourself or reconnect and let the App do it. - Restores do not bring back a customer who was redacted.
12. Your rights
Under the GDPR and the nFADP you have the right to access, rectify and erase your personal data, to restrict or object to processing, and to data portability. Your backup is already in a portable, open format in your own Drive. To exercise these rights, email info@am2pm.ch. We respond within 30 days.
You may lodge a complaint with a supervisory authority: in Switzerland, the Federal Data Protection and Information Commissioner (FDPIC, www.edoeb.admin.ch); in the EU/EEA, the authority of your country of residence or work. Contact our privacy team at info@am2pm.ch.
If you are one of a merchant's customers, the merchant is the controller of your data. Please contact the store directly; we will help them answer your request.
The App is a business tool for Shopify merchants and is not directed at children.
13. Changes
We will announce material changes in the App and by email to the notification address at least 14 days before they take effect. The date at the top always shows the current version.
14. Contact
AM2PM (am2pm GmbH) · Washingtonstrasse 20, 9400 Rorschach, Switzerland · info@am2pm.ch