FlowPrint Privacy Policy

Last updated: 18 August 2026, 5:00pm AEST (Melbourne)

This policy describes how FlowPrint ("FlowPrint", "we", "us") handles personal data, both in the FlowPrint app a merchant installs on their Shopify store and on this website. FlowPrint is operated by Parton, trading as FlowPrint. Contact: help@flowprint.app. For the security architecture behind this policy (encryption, per-shop isolation, the worker's zero inbound exposure), see the Security page.

The short version, in plain words: FlowPrint is built to move a document to its destination, not to keep a copy of it. We store almost nothing, we delete rendered documents within seconds, we run no analytics on merchant or customer data, and we do not sell or share personal data with anyone beyond the infrastructure providers named below. The rest of this page is the detail behind that sentence.

What FlowPrint does

FlowPrint automates document printing (invoices, packing slips, and similar documents) for Shopify merchants. A merchant configures document templates and assigns them to automation steps triggered by store events (for example an order being placed). When a trigger fires, an automation step either renders the configured template into a PDF and delivers it to a small "worker" program the merchant runs on their own computer, which prints it on a printer the merchant has chosen; or sends an email (with an optional PDF attachment) to the recipient the merchant configured. Merchants can also take quote requests from their storefront and offer customers document downloads; both are described below.

What personal data we process, and why

FlowPrint processes personal data in four situations, all of them transient:

1. Store events (webhooks). When a subscribed store event occurs (an order being placed, paid, or fulfilled), Shopify sends us the order data already present in the merchant's store (for example: customer name, email, phone number, and shipping or billing address). We process this data for the specific automation action the merchant configured: rendering it into a document template so it can be printed, and/or emailing it (as the message body and/or a PDF attachment) to the recipient the merchant configured for that step.
2. Quote requests. If the merchant has enabled FlowPrint's storefront quote feature, a visitor submitting a quote request sends us the details they typed (name, email, optional phone and message) and their requested items. We pass these straight through to the merchant's own Shopify store, where they become a draft order; the merchant's store, not FlowPrint, is where that information lives from then on. We use the submitted email once to send an acknowledgment ("your request was received"; the merchant can customize its wording and optionally attach a document rendered from the new draft order), notify the store's own email address that a request arrived, and keep nothing. Until a visitor actually submits, their in-progress quote list is stored only in their own browser (localStorage) and never reaches FlowPrint at all.
3. Customer document downloads. If the merchant enables customer downloads for a template, a customer clicking a download link (in an order notification email, on the order status page, on the thank-you page, or in their customer account) causes us to fetch that order's current data from Shopify, render the document, and return it directly in that same response. Nothing is written to storage at any point. The link's credential is Shopify's own per-order secret token; FlowPrint issues and stores no tokens of its own, and only templates the merchant has explicitly listed as customer-downloadable can be fetched this way.
4. Back-in-stock notifications. If the merchant enables this feature for a product, a visitor submitting their email (and optional first name) to be notified when it's back in stock is written directly to the merchant's own Shopify store as a Metaobject record, not to FlowPrint. FlowPrint creates that record, later reads it to send the one notification email when the item restocks, and then deletes it (or deletes it immediately if the visitor asks). FlowPrint's own database never holds the email or name at any point.

We do not use any of this data for analytics, advertising, marketing, profiling, or any purpose other than the specific action described above. We do not sell personal data, and we do not share it with any third party except the infrastructure and email-delivery providers described below.

For abuse prevention, our public endpoints (quote submission and document downloads) keep short-lived request counters per network address in server memory only. These counters exist for at most a few minutes and are never written to storage or logs.

What we store, and for how long

FlowPrint's design goal is to transport a document to the merchant's own printer, not to hold a copy of it. Concretely:

• We do not store the raw order or customer data Shopify sends us. It is used transiently to render a document or compose an email, then discarded. Email content is never written to storage; it exists only in memory for the single outbound send.
• A rendered PDF exists in our storage (Cloudflare R2) only for the brief moment between rendering it and attempting to deliver it to the merchant's worker. It is deleted immediately once that one delivery attempt is over, whether it succeeded or not, typically within seconds, and always well under our 24-hour defensive backstop (a safety net for the rare case a deletion itself fails, not the normal path).
• We keep a database record of which order and customer a given document was rendered for (a Shopify ID number only, never their name, email, or address), not the document itself. This is what lets a merchant ask FlowPrint to Reprint or Preview a past job, and what lets a data-subject request (see below) find the right record. Reprinting or previewing a past job works by asking Shopify for that order's current data again at the moment the merchant clicks the button; we do not have a stored copy to hand back, so we fetch a fresh one, use it once, and discard it the same way as any other render. A "Preview" specifically never produces a PDF on our servers at all: it opens the rendered document as a normal web page in the merchant's own browser, and any PDF file the merchant wants is created by their browser's own print function, never by us. These job-history records are kept for at most six months and then removed automatically; merchants can purge them earlier at any time from Settings > Job Log.
• A merchant's Shopify access token and a per-store cryptographic signing key are stored encrypted at rest for as long as the app remains installed, and deleted when the merchant uninstalls the app.
• Images a merchant uploads into their own document templates (their logo, product photography) are merchant design assets, not customer data. They are stored for as long as the app remains installed so the merchant's templates keep rendering, and deleted along with everything else when the store's uninstall redaction runs (see "Uninstalling the app" below).
• Quote requests are not stored by FlowPrint at all; they become draft orders in the merchant's own Shopify store (see above). The merchant's FlowPrint admin shows them by reading the merchant's own store live, and that view deliberately excludes customer contact details; the merchant sees those on the draft order itself, inside Shopify, under Shopify's own access controls.
• Back-in-stock requests are not stored by FlowPrint at all, like quote requests; they live entirely in the merchant's own Shopify store (as a Metaobject record), created and later deleted by FlowPrint acting on the merchant's behalf, never held in FlowPrint's own database.
• If a merchant configures an automation step to also save a document to a folder on their own worker computer (an optional feature, off by default), that copy is written directly by the worker software running on their own machine. It never passes through or is stored by FlowPrint's cloud service, and its retention is entirely up to the merchant's own file management on their own device, the same as any other file they save.
• The merchant's own configuration (templates, automations, quote and email settings) is stored for as long as the app is installed; it describes the merchant's setup and contains no customer data.

How data is protected in transit and at rest

• All network traffic to and from FlowPrint's cloud service is encrypted (HTTPS/WSS).
• Every document sent to a merchant's worker is individually encrypted (AES-256 content encryption, wrapped with that specific worker's own RSA-2048 public key) and signed with a signing key unique to that merchant's store, before it ever leaves our servers. Only that specific, merchant-owned worker device can decrypt it; not even FlowPrint's own infrastructure can read a job payload once it has been encrypted for delivery.
• Each merchant's store has its own isolated cryptographic keys. A key belonging to one merchant cannot be used to access another merchant's data.
• Shopify access tokens and per-store signing keys are encrypted at rest. The worker program's own private key never leaves the merchant's device. On Windows it is encrypted at rest using the operating system's own credential protection (DPAPI); on Linux it is stored readable only by the operating-system user who runs the worker, the same trust model as an SSH private key.

The worker program

The small program merchants run on their own computer ("the worker", available for Windows and Linux) has no inbound network exposure of any kind; it only ever makes outbound connections to FlowPrint's cloud service, the same way a normal desktop app checks for updates. It contains no business logic and holds no order or customer data beyond the single encrypted document it is currently printing; it decrypts that document only in memory in order to print it, and does not retain it afterward. Removing it is designed to leave no trace: the worker's "Logout and scrub" and uninstall actions delete every piece of local state the worker ever wrote (its keys are overwritten before deletion) and ask our servers to delete that worker's registration at the same time.

Infrastructure / sub-processors

FlowPrint runs entirely on Cloudflare (Workers, D1, R2 object storage, Queues, and Browser Rendering), which acts as our infrastructure provider and processes data on our behalf, encrypted at rest under Cloudflare's own platform-level protections.

Email automation steps are delivered through one of two providers, depending on plan: on the Free plan, email is sent from our own try@flowprint.app address via Cloudflare's Email Service (still Cloudflare, no additional processor). On paid plans where a merchant has configured their own sending domain, email is sent via Amazon Simple Email Service (Amazon Web Services, Inc.), which processes the message (recipient address, subject, body, and any PDF attachment) solely to deliver it and is not authorized to use it for any other purpose. We do not use any other third-party processor that receives personal data.

Your rights / data subject requests

Merchants, and their customers, can request that we delete or provide information about data FlowPrint holds. FlowPrint implements Shopify's mandatory data-subject webhooks:

• Right to access: a customer can ask a merchant for a copy of their data; we log which of our records reference that customer so a request can be fulfilled. Since we don't retain rendered documents (see above), there is typically no document left for us to hold by the time such a request arrives; the merchant's own Shopify order history remains the actual record of what was ordered.
• Right to erasure: on a valid deletion request (customer or shop-level), we delete any rendered document that happens to still exist (rare, given the near-immediate deletion described above) along with the database record referencing that customer or store, and purge any matching back-in-stock Metaobject records from the merchant's store by email.

Requests should be routed through the merchant (the store the customer placed an order with), or directly to us at help@flowprint.app.

Uninstalling the app

Uninstalling FlowPrint revokes our access token for that store immediately. Shopify notifies us automatically 48 hours after uninstall (the shop/redact webhook), at which point we delete every remaining record tied to that store, including any rendered document that still happened to exist and every template image the merchant uploaded.

The flowprint.app website

This website (flowprint.app) is a static site hosted on Cloudflare. It uses Google Analytics to count visits and understand which pages are read; Google Analytics sets cookies and receives standard visit data (pages viewed, approximate location derived from IP address, browser and device type), which Google processes as described in Google's own privacy policy. We use this only in aggregate, to understand interest in FlowPrint; it is entirely separate from the app itself, which uses no analytics of any kind on merchant or customer data. If you block analytics cookies, every part of this website still works.

The website has no accounts and no forms, and collects nothing you type, because there is nothing to type.

Children's privacy

FlowPrint is a business tool for merchants and is not directed at children. We do not knowingly process data about children.

Changes to this policy

We may update this policy as FlowPrint changes. Material changes will be reflected by updating the "Last updated" date above.

Contact

Questions about this policy, or data-subject requests, can be sent to help@flowprint.app. For plain-language answers to common security and data questions, see the FAQ.