Privacy Policy

Healthly is operated by datadir s. r. o., Bauerova 1205/7, 040 23 Košice, Slovakia (company ID / IČO 57 582 904). We are the data controller for your account data — your store domain, contact details and plan status — and a data processor for store data we handle on your behalf. For any privacy question, contact us at hello@datadir.co.

Healthly requests only the Shopify scopes it needs:

• Products (write_products) — to read products and images when scanning, and to write the alt text and SEO fields you choose to fix.
• URL redirects (write_online_store_navigation) — to create the redirects you choose to add for broken links and 404s.
• Files (write_files) — to update alt text on images stored in Shopify Files.

• Scan results: the URLs checked, their HTTP status, the page each link was found on, and what we found.
• The redirects you create, and a reversible record of each alt-text and SEO fix.
• Your scan settings, such as scheduled re-scans and whether IndexNow is on.
• Your store's .myshopify.com domain and an offline access token, kept server-side and never exposed to the browser.

We use this data solely to provide the app to you. We do not sell it, use it for advertising, or share it with any third party except the providers below, and we do not use it for any automated decision with a legal or similarly significant effect on anyone.

• Shopify — the platform your store and our app run on, under Shopify's own DPA.
• Hetzner Online GmbH (Germany, EU) — application hosting and database.
• Scaleway SAS (France, EU) — encrypted, off-site database backups.
• Bunny.net (BunnyWay d.o.o., Slovenia, EU) — authoritative DNS for our domain.
• IndexNow (api.indexnow.org) — only if you turn IndexNow on, on the Pro plan. We send the public URLs of your store's pages so participating search engines such as Bing and Yandex can re-crawl them. No personal data is included.

When you uninstall the app, Shopify notifies us and we delete your access token. About 48 hours later, Shopify sends a shop/redact request and we erase all remaining data for your store. Encrypted backups roll off on a 30-day cycle. You can request deletion at any time by emailing hello@datadir.co.

We honour Shopify's customer-privacy webhooks. Because Healthly stores no personal data about your customers, there is nothing to return or erase for an individual shopper.

Data is encrypted in transit (TLS) and backups are encrypted at rest. Each store's data is isolated at the database layer with row-level security. Access to production systems is restricted, on a least-privilege basis, to the operator of the service.

If you are in the EEA/UK, you have the right to access, correct, export, or delete the data we hold, to restrict or object to processing, and to lodge a complaint with your supervisory authority (in Slovakia, the Úrad na ochranu osobných údajov SR). Our lawful basis for processing your account and store data is the performance of our contract with you. To exercise any right, contact hello@datadir.co; we respond within one month.

All personal data is stored in the European Union — application and database on Hetzner (Germany) and encrypted backups on Scaleway (France). We do not transfer personal data to a third country except to Shopify, which processes under its own DPA and adequacy/Standard Contractual Clauses.

We may update this policy as the app evolves. Material changes will be posted here with a new “last updated” date.