Privacy Policy

1. Who is responsible

Controller for this website, merchant accounts on APKIOS, and our own business records: DIM WEBSITES LTD.

• Legal name: DIM WEBSITES LTD
• Public product: APKIOS
• Website: https://apkios.app
• Support: info@thedimwebsites.com
• VAT number: GB485610280

For shopper data inside a merchant’s app (name, email, orders, addresses, wishlist, and similar), the merchant is the controller. We act as a processor on their behalf, using Shopify’s APIs. Shoppers should contact the store they bought from first.

2. What this policy covers

APKIOS lets a Shopify merchant install an app, configure branding and home, and offer buyers a native iOS and Android app with catalogue, cart, Shopify Checkout, customer login, orders, wishlist, newsletter, and optional push.

• This marketing and legal website (no accounts, no checkout).
• The APKIOS Shopify admin used by merchants.
• The white-label buyer apps we compile.
• Two publishing models: (a) DIM WEBSITES LTD publishes the app under our Apple / Google accounts; (b) the merchant publishes with their own accounts. Product payments always go through Shopify Checkout — never through Apple or Google in-app purchase. Buyer apps are distributed internally for the merchant’s brand; this site does not link to public App Store or Play listings.

3. Data we process

Merchant (from Shopify OAuth and the APKIOS admin)

• Shop domain and Shopify shop identifiers
• Staff contact email associated with the install, when Shopify provides it
• Theme and home configuration, branding assets the merchant uploads
• Integration settings the merchant turns on (Klaviyo, Meta, Google Analytics, Firebase, OneSignal, and similar)
• Publishing metadata (bundle IDs, store listing copy, whether DIM or the merchant is the App Store / Play publisher)

Buyer / shopper (via Shopify Admin API, Customer Account API, and Storefront, on behalf of the merchant)

• Name, email, phone
• Shipping and billing addresses (address book)
• Orders, fulfilments, and related checkout status as Shopify exposes them
• Wishlist / favourites stored for that shop
• Newsletter fields the merchant collects with consent (email and, if they ask, name and phone)

Device

• Session tokens stored encrypted on the phone; they expire
• Locale / language preference
• Push tokens, only if the merchant enables notifications and the shopper grants OS permission

Website visitors

• This site does not set marketing or analytics cookies in v1.
• Our host (see processors) may keep standard server logs (IP, user agent, URL, timestamp) for security and reliability. We do not use them to build advertising profiles.

4. Why we process it

App functionality (merchant contract; shopper: performance of the store’s contract / legitimate interest of the merchant)

• Login, profile, address book, shipping estimates, cart, coupons, and Shopify Checkout
• Order history and wishlist
• Remote theme so the merchant can update the app

Marketing

• Newsletter and Klaviyo (or Shopify marketing) only with the merchant’s configuration and the shopper’s opt-in
• Push campaigns the merchant sends, if they enabled push and the shopper allowed notifications

Analytics

• Events to Meta, Google Analytics, Klaviyo, or Firebase only if the merchant activates those integrations
• If a shopper is already known (for example signed in), an event may include their email so the merchant can attribute the session — still under that merchant’s settings, not for APKIOS ads

We do not sell personal data. We do not use shopper PII to advertise APKIOS as a product. We do not run third-party advertising networks on this website in v1.

5. Legal bases (GDPR)

• Contract: providing the APKIOS SaaS to the merchant who installed the Shopify app.
• Legitimate interests: securing the service, debugging, preventing abuse, limited server logs.
• Consent: newsletter, push, and optional analytics/marketing pixels the merchant enables — shoppers can refuse OS permission and unsubscribe with the merchant.
• Legal obligation: tax, accounting, and responding to valid data-protection requests.

6. How long we keep it

• Device session tokens: on the phone, encrypted, until they expire or the shopper signs out / uninstalls.
• On our servers: shop configuration, wishlist data we store for that shop, and integration settings. We do not operate a CRM of every Shopify customer in the world — only what is needed for shops that installed APKIOS.
• Merchant billing and contract records: kept as required by law after the account ends.
• Host logs: short-lived, rotated by the provider.

When a merchant uninstalls the Shopify app, or when Shopify sends the mandatory compliance webhooks, we delete or anonymise personal data for that shop or customer as described below.

7. Shopify compliance webhooks

APKIOS implements Shopify’s customer privacy webhooks.

• customers/redact — we delete personal data we hold for that customer in that shop (for example wishlist rows, cached profile fields), except what we must keep for legal claims or security logs already stripped of extra identifiers.
• shop/redact — after uninstall, we delete the shop’s configuration, integration secrets, and remaining customer-derived data we stored for that shop.
• customers/data_request — we export what we still have for that customer/shop and provide it to the merchant (and to you, if you are the merchant) so it can be passed to the shopper.

Shopify may also retain data on its side under the merchant’s Shopify contract. We cannot delete data that lives only in Shopify.

8. Security

• HTTPS in transit for the website, admin, and APIs.
• Encryption in transit and at rest on hosting and databases we control.
• Separate test and production environments. Production shopper data is not used as a playground.
• Staff access is limited to people who need it. Staff accounts use 2FA.
• Infrastructure logs for security. We instruct staff not to paste personal data into public chats, tickets that are overly broad, or third-party AI tools.
• Session tokens on device are stored encrypted.

No security practice is perfect. We do not claim SOC 2 or similar certifications on this site.

9. Processors (not buyers of your data)

We use companies that process data on our instructions. They are not sold the data.

• Shopify — commerce platform, checkout, customer accounts, APIs.
• Cloudflare Pages (and related Cloudflare infrastructure). Production assets may also be served from Amazon S3 / CloudFront.
• Expo Application Services (EAS) when we compile and submit iOS and Android binaries.
• Apple and Google — only as app-store infrastructure when we or the merchant submit binaries (they process developer-account and review data under their own terms).

Only if the merchant configures them

• Klaviyo — email / SMS marketing
• Meta — advertising events / SDK if enabled
• Google Analytics — product analytics if enabled
• Firebase — messaging or analytics if enabled
• OneSignal — push if enabled

Each of those providers is a processor (or independent controller for their own dashboards) under the merchant’s contract with them. Turning an integration off stops new sends from APKIOS; it does not automatically wipe historical data inside that provider.

10. Sale, ads, and CCPA / GDPR “sale”

We do not sell personal information. We do not share shopper PII for cross-context behavioural advertising of APKIOS. If a merchant enables Meta, Google, or similar, that merchant is responsible for their own notices and opt-outs. We honour a documented opt-out request sent to our support email where it applies to data we control.

11. Your rights

Depending on where you live (including GDPR and CCPA), you may request access, correction, deletion, restriction, objection, portability, and withdrawal of consent. You may also complain to your local supervisory authority.

• Shoppers: write to the Shopify store first (the merchant). They can also ask us via the merchant, or email us if the merchant is unresponsive. We can only act on data APKIOS still holds.
• Merchants and website visitors: email info@thedimwebsites.com.
• We may need to verify the request (shop domain, customer id, or similar) so we do not disclose data to the wrong person.

12. International transfers

Shopify, Apple, Google, Cloudflare, AWS, Expo, and the optional marketing/analytics tools may process data in the United States and other countries. Where GDPR applies, we rely on the provider’s appropriate safeguards (such as Standard Contractual Clauses) stated in their data-processing terms.

13. Children

APKIOS is a B2B product for Shopify merchants. We do not knowingly collect data from children to market APKIOS. A merchant’s own app may sell products to a mixed audience; that merchant is responsible for age-gating and their store policies.

14. Changes

We will update this page when our practices change. The date at the top is the last revision. Material changes will be reflected here at https://apkios.app/privacy — the stable URL intended for Shopify Partner Dashboard, App Store, and Play Console.

15. Contact

• Email: info@thedimwebsites.com
• Controller: DIM WEBSITES LTD