Last updated: 3 October 2026

This policy explains how personal information is handled when you visit appfabrication.com, send an enquiry, commission development services or use an appFabrication product.

Who is responsible for your information?

appFabrication is a trading name of Dust Shack Ltd, registered in England and Wales, company number 12425976. Our registered office is Unit 13-15 Tir Llwyd Industrial Estate, St Asaph Avenue, Rhyl, Wales, LL18 5JA. In this policy, “we”, “us” and “our” mean Dust Shack Ltd. Scott is your development and support contact.

For privacy questions or requests, email support@appfabrication.com or write to our registered office.

We are the controller of information used to manage our website, enquiries, client relationships, our own accounts, billing and business administration. When an app or commissioned service processes a merchant’s or client’s customer, staff or operational data on their instructions, that merchant or client normally remains the controller and we act as a processor. Those activities are also subject to the applicable product or project data-processing agreement. This website notice does not replace that agreement.

Website visits, enquiries and projects

You may provide your name, email address, business or website details, project goals, selected answers, timing and other information in a brief, support message or project discussion. For an agreed project, we may also need contact, contract, invoice and payment records and the materials or access needed to carry out the work. Please do not put passwords, payment-card details or sensitive personal information in the enquiry form.

The website form requires a name and email address to send an enquiry and reply. Additional context fields are optional. There is no obligation to submit a brief, but we cannot respond by email without a usable reply address.

Hostinger hosts the website and receiving mailbox. Web hosting can produce technical access and error logs, such as IP address, requested page, browser information and time of request, for operation and security. The enquiry endpoint also uses your IP address to derive a short-lived rate-limit identifier and stores request identifiers, receipt numbers, delivery status and email-provider identifiers to prevent duplicate sends and abuse. These local delivery records do not store your full brief or email address.

When you submit a brief, Resend processes your name, reply address and brief to deliver the enquiry to appFabrication. It also sends an acknowledgement and receipt to your email address. The brief is held in the receiving mailbox and may be used in subsequent correspondence. Acknowledgements are service messages; submitting the form does not subscribe you to marketing.

The suggested approach in the brief is generated by rules running in your browser. Scott reviews submitted enquiries. The form does not make an automated decision with legal or similarly significant effects on you.

Browser storage, cookies and downloads

This website uses the following storage for the project form:

  • Brief draft: your answers and any entered contact details are saved in your browser tab’s session storage so you can move between questions and recover the draft. The website checks the draft’s age when restoring it and does not restore drafts older than 24 hours since their last save.
  • Pending enquiry: session storage keeps a copy of the submission details and a request identifier to make retries recoverable and avoid duplicate enquiries. The website stops reusing this record after 24 hours.
  • Form security cookie: the first-party appfabrication_contact session cookie protects the enquiry endpoint. It is limited to the enquiry API and is not used for advertising or tracking across websites.

Session storage normally lasts for the browser tab’s session, although browser session restoration can preserve it. The 24-hour checks prevent reuse; they are not a guarantee that your browser physically deletes the stored data at that time. You can remove it through your browser’s site-data controls. “Start over” clears the brief draft, but does not clear a pending-send record. Blocking this storage or the security cookie may prevent draft recovery or sending.

PDF and text downloads are created in your browser. Downloading a brief does not send it to us. A downloaded file remains on your device until you remove it.

The appFabrication website does not include advertising or website analytics scripts. App-specific analytics are described below. Email providers may process delivery events and, where enabled in their settings, open or click events; these are separate from website analytics.

Apps and merchant data

Information used by an app depends on the product, enabled features and platform permissions. Shopify provides store and app data through the permissions authorised for the installation. A merchant or authorised user may also supply settings, support information and connected-service data. References to an app describe its relevant processing if you use that app; they do not mean every product is publicly available.

QVBundle

QVBundle may process store, product, collection, theme, cart, discount, configuration, billing, and app-usage data required to provide quick view, bundle, guided bundle, discount, display, analytics, and related merchant settings.

QVBundle does not need customer address, email, or phone data for its core storefront bundle functionality.

Multi Terms & Conditions

Multi Terms & Conditions may process store, product, collection, cart, rule, localisation, customer-state, market, country, locale, analytics, and configuration data required to display and enforce merchant-authored terms acceptance rules.

Where rule targeting or analytics are enabled, the app may process the minimum data required to determine whether a rule applies and to record app events for merchant reporting.

Visual Orders

Visual Orders is a read-only Shopify admin app that helps merchants see what customers ordered without opening each order.

Visual Orders may process recent order and line-item data required to display a visual order queue, including:

  • order number;

  • customer display name;

  • product image;

  • product title;

  • variant title;

  • quantity;

  • SKU;

  • fulfilment status;

  • payment status;

  • delivery method selected for the order;

  • order tags;

  • whether an order note exists;

  • native Shopify order link identifiers required to open the order in Shopify.

Visual Orders does not display or intentionally process customer email, phone number, full address, postcode, city, country, destination, billing address, or shipping address for the visual queue.

Visual Orders does not edit orders, create fulfilments, buy shipping labels, add tracking numbers, refund orders, or modify customer data. Fulfilment, shipping, refunds, and edits remain inside Shopify.

Visual Orders reads order data on demand to display the queue and print an internal pick list. The visual queue is not intended to be an invoice, packing slip, shipping label, or legal/tax document.

ProdBord accounts and support access

If you use ProdBord directly outside Shopify, we process account details, sign-in and security information, workspace and production data, and information associated with billing and connected services. Where Stripe billing is used, Stripe processes payment information under its own terms and privacy notice. Availability of direct accounts, billing and integrations depends on the product version and service offered.

Authorised appFabrication support personnel may access limited account, workspace, billing and connection diagnostics where needed to provide support, secure accounts or administer the service. Access to support records and administrative support actions is logged and retained according to the service’s security and retention practices. Product-specific privacy information and data-processing terms also apply where supplied.

We do not use customer or order data from merchant stores to market to those merchants’ customers.

Why we use information and our lawful bases

  • Enquiries and requested services: to assess requests, discuss options, provide a proposal and perform an agreed contract. We rely on steps you request before entering a contract or performance of a contract where you are the contracting individual. For business contacts acting for a company, we rely on our legitimate interests in communicating with that business and delivering its services.
  • Accounts, apps and support: to provide requested functionality, authenticate users, handle support and send service or billing updates. We rely on contract performance for individual account holders, or legitimate interests in operating and supporting services for business customers. When acting as a processor, we follow the controller’s documented instructions and the applicable data-processing terms.
  • Security and reliability: to prevent abuse and duplicate submissions, investigate faults, protect accounts and maintain reliable services. We rely on legitimate interests in protecting users, our business and our systems.
  • Business and legal records: to manage invoicing, accounting and legally required records, respond to lawful requests and establish or defend legal claims. We rely on legal obligations where applicable and legitimate interests in managing our business and resolving disputes.

If we introduce an activity that requires consent, we will explain it and request consent separately. You can withdraw that consent without affecting processing that was lawful before withdrawal.

Who receives information?

We do not sell personal information. We share it only as needed with:

  • Hostinger: website hosting, associated technical logs and the receiving mailbox.
  • Resend: enquiry and acknowledgement email delivery, delivery records and associated service diagnostics. See Resend’s data-protection information.
  • Shopify and connected product providers: to operate installed apps, platform billing and integrations you enable. Standalone products may use payment providers such as Stripe where offered.
  • Product or project infrastructure providers: hosting, database, authentication, monitoring and app analytics providers needed for the particular service, under its applicable privacy information and data-processing terms.
  • Professional advisers and public authorities: where necessary for accounting, legal advice, disputes or a legal requirement.

Some providers process information outside the UK. Resend stores message content and delivery records in the United States, even if email is sent through a European sending region. Its data-processing addendum incorporates standard contractual clauses and the UK International Data Transfer Addendum for UK transfers. Resend also describes participation in the EU-US Data Privacy Framework, including the UK Extension, as an additional transfer mechanism. For other restricted transfers, we use applicable adequacy arrangements or approved contractual safeguards as required. Contact us for information about safeguards applicable to your data or to obtain a copy.

How long information is kept

Retention depends on the type of record and why it is needed. We use the following periods or criteria:

  • Browser drafts and pending sends: the session-storage and 24-hour reuse rules described above apply. Downloaded copies remain under your control.
  • Local enquiry security and delivery records: request records expire after 24 hours and rate-limit records after two hours. Expired files are cleaned up when a later enquiry is submitted, so physical removal may happen later than expiry.
  • Enquiry and support emails: kept while handling the request and any resulting project or support relationship, and where needed to retain an appropriate history or resolve a complaint or dispute. We assess continued need by whether the matter is closed, support is ongoing or a legal record is required. These emails are not deleted by the website’s 24-hour expiry.
  • Provider records and backups: these are separate from our local request records. Resend states that email and log data is retained for 30 days on its Free, Pro and Scale plans, with different arrangements for Enterprise, and that backups persist for seven days. Hosting logs and mailbox backups follow Hostinger’s applicable arrangements.
  • Project, contract, billing and accounting records: kept for the applicable statutory record-keeping requirements and any period needed to address contractual claims or disputes. Records not needed for those purposes should be removed when the project and any agreed support have ended.
  • App and account data: configuration, installation, authentication and workspace information is retained as needed to provide the service, meet platform requirements and handle support, security, legal records or account closure. Shopify uninstall and data-erasure requests are handled under Shopify requirements and applicable law. Visual Orders reads queue data on demand and is not intended to maintain a separate order-management record.

Your rights and complaints

Depending on the applicable law and circumstances, you can request access to your personal information, correction, erasure, restriction of processing or a portable copy. These rights have exceptions, including where information must be retained by law. Email our privacy contact above; we may need to verify your identity.

You have the right to object to processing based on legitimate interests, on grounds relating to your particular situation. You can also object to use of your information for direct marketing.

If your information belongs to a merchant’s store or a client’s system, normally contact that controller first. We will assist them with requests where we act as their processor.

You can raise a concern with us and complain to the UK Information Commissioner’s Office: ico.org.uk/make-a-complaint, telephone 0303 123 1113, or by post to Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. You may also have the right to contact the supervisory authority where you live or work.

Security and policy changes

We use appropriate access controls, secure transport and infrastructure safeguards. No internet service can be guaranteed completely secure. Clients and merchants must manage authorised access to their own accounts and systems.

Our services are intended for business use and are not directed at children. Contact us if you believe a child has provided personal information.

We will update this policy when our processing changes and show the revised date here. Where required, we will provide additional notice before using information for a new purpose.