Last updated 16 October 2026
Privacy policy
This explains what Duly does with personal data, in plain English.
Who we are
Duly is run by Tejveer Singh, trading as Duly, a sole trader in the United Kingdom. Postal address: Suite RA01, 195-197 Wood Street, London, E17 3NU, United Kingdom. Email: support@dulystamped.com.
Our two roles
For your Duly account and billing, we decide how your data is used. That makes us the controller. For the product data, settings, proof files and supplier contacts you manage in Duly, we act on your instructions. In that case you are the controller and we are your processor, under the data processing terms in our Terms of Service.
What we collect and why
| What | Why | Legal basis |
|---|---|---|
| Store details: shop address, store name, contact email, plan, and the access token Shopify gives the app | To run Duly for your store, bill you through Shopify and contact you about the service | Contract |
| Product data read from Shopify: titles, descriptions, vendors, types, SKUs, barcodes, image references and Duly's own product metafield | To check listings and publish the safety information you approve | Contract |
| Details you enter in Settings: manufacturer and EU responsible person names, addresses, emails and websites | To show them on your product pages, as the GPSR requires | Contract (we act for you) |
| Proof files you or your suppliers upload, e.g. label photos, declarations, test reports. These can include names or signatures | To keep your product safety records | Contract (we act for you) |
| Supplier contacts you enter (name, email) and their uploads | To email your supplier an upload link on your behalf, and to tell you when files arrive | Contract (we act for you) |
| An activity log: approvals, undo, uploads, deletions, exports and when they happened | So you have an audit trail, and to keep the service secure | Legitimate interests |
| Basic request data kept briefly by our hosting provider (IP address, browser, time) | Security and troubleshooting | Legitimate interests |
Duly doesn't ask Shopify for access to your customers or orders, and we never sell personal data or use it for advertising. Our websites use no analytics or advertising cookies.
If a shop sent you an upload request
If you're a supplier who got an email from Duly, a shop that sells your products asked us to request documents from you. That shop is responsible for your details and decides what happens to your uploads. Please contact the shop first; you can also write to us and we'll pass your request on.
Who we share it with
We use these providers to run Duly. Each one only gets what it needs to do its job:
| Provider | What for | Where data is held |
|---|---|---|
| Shopify | The platform Duly runs in; app billing | Shopify's own regions |
| Render | Hosts the Duly server | Frankfurt, Germany |
| Neon | Database (Postgres) | AWS Frankfurt, Germany |
| Cloudflare | Proof file storage (R2) and DNS | EU jurisdiction for files |
| Resend | Sends supplier requests and notices | Ireland (EU region) |
Some of these companies are based outside the UK and EU. Where data is transferred outside the UK or EEA, we rely on the safeguards those providers offer, such as standard contractual clauses (with the UK addendum) or the EU–US Data Privacy Framework.
How long we keep it
- Proof files are kept for 10 years from upload by default, because EU rules expect product records to be kept that long. You can delete them sooner.
- Supplier upload links expire after 30 days.
- When you uninstall Duly, Shopify sends us a deletion request 48 hours later. We then delete everything we hold for your store, including proof files. Please use Export my proof before uninstalling.
- Deleted data can stay in our database provider's short-term backups for up to 7 days before it's gone for good.
Keeping it safe
All traffic is encrypted (HTTPS), and our providers encrypt stored data. Proof files are never public: they open through signed links that expire after 15 minutes. Only the operator of Duly can access the systems, and only to run and support the service.
Your rights
You can ask to see, correct, delete or export your personal data, or object to how we use it. Email support@dulystamped.com and we'll reply within one month. If you're unhappy with our answer, you can complain to the UK Information Commissioner's Office (ico.org.uk) or your local data protection authority.
Changes
If we change this policy, we'll update the date at the top and tell installed shops about important changes.