Privacy Policy for CRP Digital

Last updated: 12/11/2026

Introduction

At CRP Digital we take your privacy seriously. This privacy policy describes how we collect, use and protect your personal data when you visit our website, use our services, or install one of the Shopify apps we develop and publish on the Shopify App Store.

What information do we collect?

Contact information

When you contact us through our contact form or by email, we collect:

Name
Email address
Phone number (if provided)
Company information (if relevant)
Message / request

Automatically collected data

When you visit our website, we automatically collect:

IP address
Browser type and version
Pages visited and timestamps
Referring website

Shopify Apps we develop

CRP Digital develops and operates Shopify apps that merchants can install in their Shopify store. When you install one of our apps, we act as a data processor on behalf of the merchant (the data controller). This section explains what data our apps access, why, and how we protect it.

Shopify data we may access

Our apps only request the Shopify API scopes strictly required for the app to function. Depending on the specific app, this can include:

Shop information (shop name, domain, plan, currency, country)
Products, collections and inventory
Orders and line items (to provide reporting, automation or fulfillment features)
Customer data (only when explicitly required by the app feature)
Theme files and storefront content (for apps that modify the storefront)
Shop staff email address of the installing user

How we use this data

Data accessed via the Shopify API is used exclusively to deliver the functionality the merchant installed the app for - for example syncing data, generating reports, displaying widgets in the storefront, or automating workflows. We never sell merchant or customer data, and we never use it for advertising.

Storage, retention and deletion

Data is stored on secure infrastructure within the EU/EEA.
We retain shop data only as long as the app is installed and for up to 48 hours after uninstall, after which all shop and customer records are permanently deleted.
We honor Shopify's mandatory GDPR webhooks: customers/data_request, customers/redact and shop/redact. Personal data is exported or erased within 30 days of a verified request.

Sub-processors

Our apps rely on a limited set of vetted sub-processors, including Supabase (database and authentication), Shopify (platform APIs) and Resend (transactional email). A current list is available on request.

Data Processing Agreement (DPA)

A standard DPA is available to all merchants installing our apps. Contact crp@crp.dk to receive a signed copy.

How do we use your information?

We use your personal data for the following purposes:

To respond to your inquiries and requests
To deliver the services you have requested
To improve our website, services and Shopify apps
To send you relevant updates (only with your consent)
To comply with legal obligations

How do we protect your information?

We implement a number of security measures to protect your personal data:

SSL encryption of all data in transit
Secure storage with trusted providers
Strict access control to personal data
Regular security updates and dependency scans
Data minimization - we only collect what is necessary

Cookies and tracking technologies

With your choice in our cookie settings, we use Google Analytics and Google Ads to:

Measure visits and submitted forms
Measure phone, email and booking actions
Optimize advertising based on conversions

When you submit a form after accepting marketing cookies, your email address and optional phone number may be shared with Google Ads for enhanced conversion measurement. Google is the recipient. You can withdraw your consent at any time through Cookie Settings. A withdrawal applies immediately to new tracking.

Your rights

Under GDPR you have the following rights:

Right of access: You can request a copy of your personal data
Right to rectification: You can ask us to correct inaccurate data
Right to erasure: You can request deletion of your data
Right to restriction: You can restrict our processing of your data
Right to portability: You can receive your data in a structured format
Right to object: You can object to our processing

Third parties

We do not share your personal data with third parties, except:

When necessary to deliver our services
When legally required
With your explicit consent

We use trusted third-party providers for hosting, app infrastructure and analytics, all of which comply with GDPR.

Data retention

We retain your personal data only as long as necessary to fulfill the purposes it was collected for, or as required by law.

Contact data is typically deleted after 3 years, unless you have an ongoing agreement with us or have consented to receive marketing.

Changes to this policy

We may update this privacy policy from time to time. Material changes will be announced on our website or by email to registered users.

Contact us

If you have questions about this privacy policy or wish to exercise your rights, please contact us:

CRP Digital ApS

CVR: DK45849546

Email: crp@crp.dk

Phone: +45 35 95 71 71

Address: Erhvervsparken 3A, 8400 Ebeltoft, Denmark