ShopForge privacy information

September 21, 2026.

Who operates the service

Smoking Mirror S.r.l.s., Via Gravina 16, 80055 Portici (NA), Italy. Italian tax/VAT number 11068141214 · REA NA-1152412. Privacy and data requests: hello@smokingmirror.eu. This notice covers the ShopForge studio. Each merchant’s published app needs its own shopper privacy notice.

Data and purposes

• Store domain and connection, configuration, images and brand assets: creating, saving and updating your app.
• Support requests, replies, work status and plan: providing and managing the service.
• Shopify sessions and necessary technical logs: authentication, abuse prevention and troubleshooting. Do not put passwords or shopper data in free-text fields.
• For Premium, only after authorization: encrypted renewable Shopify tokens, the published theme ID, file names and fingerprints to detect changes. Theme write access is not requested.

Processing to provide the requested service and respond to pre-contractual enquiries is based on the requested relationship; processing needed for security is based on the legitimate interest in protecting the service. Legal obligations apply where relevant. Technical authorization for monitoring is optional and revocable.

Shoppers and public content

ShopForge does not import an archive of orders or customer records. Shopify handles catalog and cart operations; checkout and accounts use Shopify services or linked portals. Devices may store carts, favorites, interface language preferences and public app configuration. Content published through live updates is public: do not include secrets or confidential information. Notifications need service configuration and device permission.

Providers and processing locations

The service uses Shopify and Fly.io. The application instance and volume are configured in Paris; provider network infrastructure and support may involve other countries. See the Shopify and Fly.io privacy notices. Smoking Mirror has signed Fly.io’s Data Processing Agreement; processing and any transfers follow the terms and safeguards in the applicable provider agreements. Firebase, Apple and Google are used in merchant apps only for configured services. No advertising tools or marketing pixels are installed in the ShopForge studio.

Retention and deletion

Drafts and requests remain available while the app is installed. Uninstalling revokes the operational connection; Shopify’s shop/redact request initiates store data deletion. Revoking monitoring, a verified downgrade and uninstalling remove theme tokens and baselines. Fly volume snapshots are configured for 7-day retention and are not used to restore access to deleted data. External backup copies are encrypted and retained for up to 7 days under the operational procedure. Working copies on team computers are deleted within 7 days of a verified deletion request; signing keys needed for updates to published apps are first securely returned or transferred to their owner where requested. Deletions are recorded and applied before any restore. Tax and contractual records subject to legal retention duties are kept separately for the applicable periods. Local language preferences can be removed by clearing the site or app’s local data.

Your rights and contact

Where applicable, you may request access, correction, deletion, restriction, portability or object to processing by contacting hello@smokingmirror.eu. Revoke monitoring in the panel and collaborator access in Shopify user settings. You can complain to the Italian data protection authority. No automated decisions with legal effects are made about merchants.