Privacy Policy

Last updated: August 2026

1. Who we are

Indexly is operated by Heath Digital Ltd, a company registered in England and Wales, with its registered office at 3 Lambourne Place, London, SE3 7BH (“we”, “our”, or “Heath Digital”).

We act as a data processor when handling personal data belonging to your store's customers and staff on your behalf. For data we collect about you as a merchant (account and billing information), we act as a data controller.

2. What Indexly does

Indexly is a Shopify admin app that indexes your store's data — orders, customers, products, and metaobjects — to power fast, unified search inside the Shopify admin. It is an admin-facing tool only; it does not interact with your storefront or your customers' devices.

3. Information we collect

3.1 End-customer data (processed on your behalf)

When you install Indexly and enable indexing for a resource type, we copy the following data from Shopify into our search index:

• Customers — name, email address, phone number, tags, and any metafield values attached to customer records.
• Orders — order number, status, line items, order notes, note attributes, line item properties, customer email and phone, and any metafield values attached to orders.
• Products — title, variants, status, SKUs, tags, and associated metafield values.
• Metaobjects — record fields as defined by your store, which may include arbitrary merchant-defined content.
• Saved searches — search query strings saved within the app by your staff.

We request only read permissions (read_orders, read_customers, read_products, read_metaobjects, read_metaobject_definitions). We do not write to or modify your Shopify store data.

You can control which resource types are indexed from the Settings screen inside the app.

3.2 Merchant and staff data (we are controller)

• Shop and session data — your shop domain, OAuth access token, and Shopify staff account details (name, email) required to authenticate your session.
• Billing — your subscription plan and Shopify subscription ID. No payment card data is held by us; billing is handled entirely by Shopify.
• App configuration — index settings and saved search names/queries configured within the app.
• Recent searches — the last 10 search queries are stored locally in your browser's localStorage only and are never transmitted to our servers.

3.3 Operational logs

We log technical data (request logs, errors, webhook events) to operate and secure the service. Logs may include shop domain, resource identifiers, and timestamps. Logs are retained for a maximum of 30 days and are then deleted or anonymised.

4. Lawful basis for processing

• End-customer data — processed under your documented instruction as controller, on the basis of contract performance and your legitimate interests in operating a searchable admin interface.
• Merchant account and billing data — necessary for the performance of the contract between you and Heath Digital Ltd for providing the Indexly service.
• Session tokens — processed under legitimate interest to maintain a secure authenticated session.

5. How we use the information

We use the information we collect to:

• Index and surface your store's data in search results within the Indexly app.
• Keep indexed data in sync with your store via real-time webhooks.
• Authenticate and maintain your session.
• Manage your subscription and billing.
• Respond to support requests and comply with applicable law.
• Fulfil data subject requests via Shopify's mandatory compliance webhooks (customers/data_request, customers/redact, shop/redact).

We do not sell your data or your customers' data. We do not use your data for advertising or marketing unrelated to the app.

6. Data retention

• Indexed data — retained while the app is installed and kept in sync via webhooks. On receipt of a shop/redact webhook (issued by Shopify after uninstall), all indexed records for your shop are permanently deleted.
• Session and shop data — retained while the app is installed; deleted on uninstall.
• Saved searches — retained until you delete them or until the shop redact webhook is processed.
• Logs — retained for up to 30 days, then deleted or anonymised.

7. Subprocessors and data location

We use the following subprocessors to deliver the service. All data remains within United Kingdom infrastructure:

• Supabase — database hosting for the search index, shop settings, and saved searches. Hosted in the UK region.
• Application hosting provider — server infrastructure for running the Indexly application. Hosted in the UK.

We do not transfer personal data outside the United Kingdom or the European Economic Area. UK GDPR and the Data Protection Act 2018 apply.

8. Your rights and Shopify compliance

As a merchant, and on behalf of your customers where you instruct us:

• You can request access, correction, or deletion of data held about your store by contacting us at the address below.
• We implement Shopify's mandatory compliance webhooks and respond as required by Shopify's Partner Programme requirements.

Our full data processing obligations for EU and UK merchants are set out in our Data Processing Agreement.

9. Security

We use industry-standard measures including HTTPS, secure session handling, and access-controlled database infrastructure to protect the data we process. You are responsible for keeping your Shopify admin access secure.

10. Changes to this policy

We may update this privacy policy from time to time. The “Last updated” date at the top will change when we do. For material changes, we will notify you via the app or by email to your registered address.

11. Contact

For privacy-related questions or to exercise your rights, contact us at [email protected] or by post at: