Attach privacy policy
Last updated October 16, 2026. Attach is operated by Pepper Labs. Contact raymondxma@gmail.com for privacy or support questions.
What Attach does
Attach lets merchants collect an optional file, such as a photo, PDF, design file, ZIP archive, Office document or video, for configured products and associate it with an exact Shopify order line. Each merchant chooses which file types a product accepts. Files are references, not safety, fitment or malware certifications.
Information processed
We process uploaded originals, sanitized stored previews of photos, original names, file types, byte counts, checksums, file states and expiry dates; store, product, variant, cart/session and order/line identifiers; and merchant authentication/session information necessary to run the app. We do not request Shopify customer name, email or address fields. Uploaded files and their embedded metadata can nevertheless contain personal information, including faces, documents and location information. Merchants should request only what they need and give customers appropriate notice.
Use and access
We use this information to validate, store and link files, deliver authenticated downloads, enforce plans/limits and process deletion/privacy requests. Merchant file access is restricted to the authenticated Shopify account owner. Originals are private and retain their original metadata. Original download links expire within five minutes. Stored previews have metadata removed. When a customer adds a file to the cart, the line shows a “Reference photo” or “Reference file” link. For photos it opens the sanitized preview (at most 640 pixels, never the original); for other files it shows only the file’s name, type and size. Anyone with the link, including people who can see the cart, checkout, order emails or the order, can open that page until the file expires or is deleted. Files are checked for their type, but no antivirus scan is currently performed. We do not sell uploaded files or use them for advertising or model training.
Retention and deletion
Unattached uploads expire after 14 days. New order-linked files expire from the order creation date after 90, 180, 365 days according to the plan policy recorded when the file was created. Existing expiries are preserved on plan changes; cancellation or a lower storage cap does not instantly delete retained files. Merchants can export or deliberately delete files before expiry. At expiry/deletion access is revoked first, then physical deletion is retried until successful. Original names/checksums and identifying cart/order mappings are removed when deletion completes; limited opaque deletion/security audit records may remain. Uninstall or Shopify privacy instructions can require earlier deletion. Storage is not a backup service.
Service providers
Shopify provides installation/authentication, subscription billing and order identity. Cloudflare provides Workers, private R2 file storage, D1/KV operational/session storage and private Images transformations for photo previews. These providers may process data internationally. Operational data and backups are governed by provider retention/security controls; we do not promise immediate erasure from provider disaster-recovery systems or an individual-file restore service.
Your rights
Customers should contact the merchant responsible for their order to request access, correction or deletion. Merchants can use authenticated export/delete controls and contact us for assistance. We also process Shopify's mandatory privacy webhooks. We verify requests before disclosing or deleting information and respond within applicable legal deadlines.