This Privacy Policy explains how Clockwork Apps ("we", "us", or "our") collects, uses, and protects information when you use any of our applications.
When you install any of our apps, we collect your store/site identifier and an OAuth access token (or a signed-payload token, depending on the platform) issued by Shopify, BigCommerce, Webflow, or Wix. This token allows our app to read or write data on your behalf with the permissions you explicitly grant during installation. For Webflow apps, the token is workspace-scoped — it covers every site in the workspace you authorize.
Apps that analyze or edit your products (Bulk Product Editor variants, ListingIQ, Bulkflow) read product data including titles, descriptions, images, variants, pricing, tags, and metadata. This data is processed to provide the app's functionality. We do not permanently store raw product data — it is processed in memory and discarded after each operation, with one exception: pre-edit snapshots taken by Bulkflow and the BigCommerce Bulk Product Editor v2 are uploaded to encrypted Amazon S3 storage so the merchant can perform a one-click revert. These snapshots are retained for the lifetime of the corresponding job and removed when the job is deleted.
PathKeeper walks your Webflow site via Webflow's API to enumerate every CMS item slug, every Ecommerce product slug, every page URL, and every outbound link inside CMS rich-text fields. For each link found we store its normalized form, last-known HTTP status, and a SHA-256 hash for indexing. Slug history is retained per-item so we can detect rename events. We never read or store the body of any external page we probe — only the HTTP status code.
The Order Exporter app reads order data (customer names, addresses, line items, totals) solely to generate export files at your request. Exports are stored temporarily in AWS S3 and are accessible only to you via a time-limited download link. We do not analyze, share, or retain order data beyond what is needed to produce your export.
Our backup apps — Vault (Shopify), BCVault (BigCommerce), and Vaultflow (Webflow) — create gzipped JSON snapshots of your store/site catalog and supporting resources, uploaded to Amazon S3 with server-side encryption (AES-256) at rest. Vault (Shopify) and Vaultflow (Webflow) back up catalog and structural data only (products, collections, pages, blog posts, redirects, themes/CMS) and do not capture customer or order data. BCVault (BigCommerce) additionally backs up customer records and customer-group pricing where the merchant enables it; merchants can erase an individual customer from every BCVault backup on request (see "GDPR & Data Subject Rights" below). Backups are retained according to your plan/settings, are accessible only to the authorized merchant, are never read by any human at Clockwork Apps, and are never shared with third parties. A merchant can download any of their own backups as a portable JSON export at any time.
We store aggregated, non-personally-identifiable data such as analysis scores, scan summaries, and historical trends. This data powers features like trend charts within the app and helps us improve our products.
If you submit a support message through an in-app contact form, we receive your name, email address, and message content. This information is used solely to respond to your inquiry.
We do not sell, trade, rent, or share your store data or personal information with any third parties. Data is stored on servers we control (AWS infrastructure in the US-West-2 region). The only third-party services we use are:
We comply with Shopify's, BigCommerce's, Webflow's, and Wix's GDPR/privacy requirements. If you are a merchant, or a customer of a merchant using our apps, you have the right to:
shop/redact signal where one exists). For BigCommerce merchants whose customers exercise erasure, BCVault provides a per-customer redaction tool that scrubs that customer's personal data from every stored backup.To exercise any of these rights, contact us at clockwork.ecom@gmail.com. We will respond within 30 days.
International data transfers. Our infrastructure is hosted on Amazon Web Services in the United States (US-West-2 region). If you are located in the European Economic Area, the United Kingdom, or Switzerland, your data is transferred to the US under Standard Contractual Clauses (SCCs); contact us to request a copy of the SCCs or a Data Processing Agreement (DPA).
We implement industry-standard security measures including:
Our apps are designed for use by businesses and are not directed at children under the age of 13. We do not knowingly collect personal information from children.
We may update this Privacy Policy from time to time. We will notify merchants of material changes by updating the "Last updated" date at the top of this page. Continued use of our apps after changes constitutes acceptance of the updated policy.
If you have any questions, concerns, or data requests regarding this Privacy Policy, please contact:
Clockwork Apps
clockwork.ecom@gmail.com