AuctionDesk

Introduction

AuctionDesk (“the App”) is a Shopify application developed by Fantasium Media (“we,” “us,” or “our”). It lets a store’s shoppers make offers and bid in auctions, and invoices the winning buyer. This Privacy Policy explains how we collect, use, store, and protect information when a merchant installs and uses the App.

Information We Collect

From Shopify (via authorized API scopes):

• Product and variant details for items the merchant lists, and the App's own auction and offer settings stored on those products (write_products)
• Draft orders the App creates to invoice buyers (write_draft_orders)
• Payment status of those orders (read_orders)
• Customer name and email for buyers who are signed in to the store (read_customers)
• Shop information (store domain, currency)

From shoppers, through the store:

• Name and email entered with an offer or bid
• Offer amounts, notes, bids and maximum bids
• A salted, one-way hash of the shopper’s IP address, used only to limit spam

Generated within the App:

• Listings, offer history, auction results, second-chance offers and invoice status
• Unpaid-invoice strikes per buyer email, used to block buyers who repeatedly don’t pay. The merchant can unblock a buyer at any time, which clears their strikes.
• A log of emails sent to buyers (recipient, type, delivery status)
• Subscription and billing plan selections

How We Use Your Information

We use this information only to run the App for the merchant: showing offers and bids, sending buyer emails and invoices, tracking whether invoices are paid, and enforcing the merchant’s unpaid-buyer rules. Strikes and blocks apply only within the store where they were earned. We do not sell, rent, or share data with third parties for marketing or advertising.

Third-Party Services

• Shopify — platform and billing
• Fly.io — cloud hosting (US/Chicago)
• Resend — email delivery

Each is subject to their own privacy policies.

Data Storage and Security

• All data is stored in a PostgreSQL database on Fly.io in the United States.
• Data is transmitted using HTTPS/TLS encryption.
• Database access requires authentication credentials.

Data Retention

Data is kept while the App is installed. Shopify asks us to erase a store’s data 48 hours after the App is uninstalled (shop/redact); we then delete all of that store’s listings, offers, bids, buyers and email logs. When a shopper asks a merchant to erase their data (customers/redact), we remove their name and email and the notes on their offers.

Our log of emails sent on a store’s behalf keeps each recipient’s email address for 90 days, so a merchant can confirm whether a buyer received an invoice or reminder. After 90 days the address is removed automatically; the log keeps only the email’s type, status and date.

We record when a store’s staff view buyer information in the App (which staff account, which record, when), without copying the buyer information itself, to keep access to personal data accountable.

Your Rights

• Access your data through the App
• Delete your data by uninstalling the App
• Request data export or manual deletion by emailing dloud@fantasiummedia.com

EEA users have additional rights to data portability and lodging complaints with supervisory authorities.

GDPR Compliance

We act as a data processor on behalf of Shopify merchants (data controllers). We process personal data only as necessary to provide the App’s services.

Children’s Privacy

We do not knowingly collect information from children under 16. Shoppers must meet the age requirements of the store they buy from.

Changes to This Policy

We may update this policy and will indicate changes via the “Last Updated” date at the top of this page.

Contact

Fantasium Media
dloud@fantasiummedia.com