Privacy policy
Last updated 29 October 2026
Bidsify is a Shopify app that adds timed and sealed-bid auctions to a store. This policy explains what personal information Bidsify handles, why, who it's shared with, how long it's kept and what rights people have. It covers two groups: the merchants who install Bidsify, and their customers who bid in auctions.
Who we are
Bidsify is operated by Akioora LLC, a Delaware limited liability company ("Bidsify", "we"). Contact us about privacy at support@bidsify.com. We have not appointed a data protection officer.
Our role
- For bidders' information, the store is in charge. The merchant decides to run auctions and what to require from bidders, so the merchant is the controller and Bidsify is its processor. We only use bidder information to run that store's auctions, under the data processing terms in our terms of service. Bidders should also read the store's own privacy policy.
- For the merchant's own account with us, we are in charge (the controller): the store's details, plan and billing, and how staff use the app.
Information about stores
| Information | Why | Legal basis |
|---|---|---|
| Store name, contact email, domain, currency and time zone, read from Shopify at install | To set up the app, show prices and times correctly, and contact the store about its account | Contract |
| Shopify access token and session details, which can include the name and email of the staff member who installed the app | To sign staff in to the app inside Shopify admin and act in the store on its behalf | Contract |
| Settings, auctions, plan, Shopify subscription and any license key redeemed | To provide the service and apply the right plan | Contract |
| Error reports and server logs | To find and fix problems and keep the service secure | Legitimate interests in a working, secure service |
Information about bidders
Bidders are the store's customers. They sign in with their Shopify customer account; Bidsify never sees or stores their password.
| Information | Where it comes from | Why |
|---|---|---|
| Shopify customer ID, first and last name, and email | Shopify, from the signed-in customer account, kept up to date when the customer changes it | To know who placed each bid, send auction emails and bill the winner |
| Public alias | The bidder | Other bidders see only aliases in the bid history |
| Phone number and shipping address | The bidder, before their first bid, when the store requires them | So the store can contact the winner and ship the item, and to prefill the winner's invoice |
| Bids, auto-bid maximums, watched auctions, wins and payments | The bidder's activity | To run the auction and decide the winner. Auto-bid maximums are never shown to anyone, including the store |
| Email choices and the auction terms they accepted | The bidder | To respect their choices and record that they agreed to the store's auction rules |
| Approval decisions, unpaid-win count and staff notes | The store's staff, and Bidsify when a win goes unpaid | When the store reviews bidders or limits bidders who don't pay |
If a store requires a phone number and address, a bidder can't bid without giving them. Everything else is needed to take part in an auction at all.
Automated decisions. A store can turn on a rule that stops a bidder from bidding at that store after a set number of unpaid wins. Staff see the reason and can lift the block at any time, and bidders can ask the store to review it.
We don't use any of this for advertising, we don't sell or rent it, and we don't combine it across stores. The storefront bid box sets no tracking cookies and runs no analytics.
Who we share it with
We share information only with the store it belongs to and with these service providers, which process it for us under contracts that require them to protect it:
| Recipient | What for | Where |
|---|---|---|
| The store | Staff see bidders' real names, emails, phone numbers and addresses in the Bidsify admin. Other bidders see only aliases | Wherever the store operates |
| Shopify | Stores the winner's draft order and sends invoice emails | Shopify's data centres |
| Our hosting provider | Runs the server that holds the database | Germany (EU) |
| Our backup storage provider | Keeps daily database backups | EU or United States |
| Resend | Sends outbid, ending-soon, won and reminder emails | United States |
| Sentry | Receives error reports, which leave out IP addresses, cookies and request bodies | United States |
We may also disclose information if the law requires it, to protect people's safety, or as part of a sale or merger of our business, in which case this policy continues to apply to it.
International transfers
The database is in Germany. Some providers above are in the United States. Where information leaves the European Economic Area, the UK or Switzerland, we rely on the provider's certification under the EU-US Data Privacy Framework or on the European Commission's standard contractual clauses. Ask us for a copy of the safeguards at support@bidsify.com.
How long we keep it
- While the app is installed, auction records are kept so the store has a history of its auctions and payments.
- When a customer asks the store to delete their data, Shopify tells Bidsify and we remove their name, email, phone, address, alias and notes. Their bids stay without anything that identifies them, so past results still add up.
- When a store uninstalls Bidsify, running auctions are cancelled and no more emails go to its bidders. 48 hours later Shopify asks us to delete the store's data, and we delete its auctions, bidders, bids and settings. We keep only the store's domain, plan and any license key it redeemed, so a key can be restored if the store reinstalls.
- Backups are kept for 30 days, then deleted. Error reports are kept for up to 90 days. Copies of emails waiting to be sent are removed 7 days after sending, or 30 days after a failed send.
Security
Information travels over HTTPS. The database runs on a private network that can't be reached from the internet, and its backups are encrypted. Only the Bidsify team can reach these systems. Our team console never shows bidders' personal details, requires two-factor sign-in, and records staff actions in an audit log. If a security incident affects personal data, we tell the affected stores without undue delay, so they can meet their own obligations.
Your rights
Depending on where you live, you can ask to:
- see the personal information held about you and get a copy in a portable format;
- correct it, or have it deleted;
- restrict or object to how it's used;
- withdraw consent where we rely on it, without affecting what happened before.
Bidders can change their alias, phone, address and email choices on their bidder profile in the store. For anything else, ask the store, since it controls your auction information. You can also write to us at support@bidsify.com: we'll pass the request to the store and help it answer within 30 days.
Merchants can write to us at support@bidsify.com about their account information.
You can also complain to a data protection authority, such as the one where you live or work. We'd appreciate the chance to help first.
California residents: we act as a service provider to the store. We don't sell or share personal information for cross-context behavioral advertising, and we don't use sensitive personal information to infer characteristics. You won't be treated differently for using your privacy rights.
Children
Bidsify isn't meant for anyone under 16, and we don't knowingly collect their information.
Cookies
The storefront bid box sets no cookies of its own. Inside Shopify admin, Bidsify uses Shopify's session to sign staff in. Our team console uses a session cookie for our own staff only.
Changes
If this policy changes, we update the date at the top. For significant changes, we email installed stores before they take effect.