Privacy policy
Last updated 13 August 2026
Formhold is a Shopify app that stores form submissions from a merchant’s storefront. This policy explains what it holds, why, and how it is erased.
What Formhold stores
Whatever a shopper types into a form the merchant has connected. That is decided entirely by the merchant’s markup, and commonly includes names, email addresses, phone numbers, free text and uploaded files.
Alongside each submission Formhold records:
- the page it was submitted from, the IP address and the browser user agent
- the Shopify customer id, if the shopper was signed in at the time
- a spam score and any field values that did not match their declared type
Formhold requests no Shopify access scopes. It cannot read orders, products or customer records, and does not.
Who it is for
The merchant. Formhold is a processor acting on their instructions; the merchant is the controller of the data their shoppers submit. Submissions are visible only inside that store’s Shopify admin, or through a read-only API token the merchant creates.
Data is never sold, never used for advertising, and never used to train machine-learning models.
Where it is stored
In a Postgres database and private object storage hosted by Supabase in eu-central-1 (Frankfurt), and served by an application hosted on Fly.io in the same region. Traffic is encrypted in transit. Uploaded files are held in a private bucket and reachable only through short-lived signed links issued to a signed-in merchant.
Sharing
Formhold sends data onward only where the merchant has configured it to:
- a Slack channel, if the merchant connects an incoming webhook
- an endpoint of the merchant’s choosing, if they add a webhook
Sub-processors: Supabase (database and file storage), Fly.io (hosting) and Shopify (authentication and billing).
Erasure and retention
Formhold implements Shopify’s mandatory privacy webhooks:
- customers/redact — deletes that customer’s submissions and their uploaded files. Matching is done on the Shopify customer id and on any email address or phone number appearing in the stored submission, because a storefront form does not require signing in.
- customers/data_request — locates the submissions held for that customer so the merchant can respond.
- shop/redact — 48 hours after the app is uninstalled, erases every form, submission, uploaded file, token and session for that store.
A merchant can also delete any submission, or an entire form and everything in it, from the app at any time. Deletion removes the stored files too.
Contact
haydaaymen@gmail.com. Shoppers should contact the store they submitted the form to; that merchant controls the data and can erase it directly.