Talk to usComing soon
ProductHow it worksSupportTalk to usComing soon
Privacy

Privacy Policy

Last updated: 26 October 2026

This policy explains how DIM WEBSITES LTD (“we”, “us”) processes personal data when you use APKIOS, this website (apkios.app), and the native iOS/Android apps we help merchants launch. It covers the software product APKIOS — a white-label Shopify mobile app builder — not a merchant’s own shop.

1. Who is responsible

Controller for this website, merchant accounts on APKIOS, and our own business records: DIM WEBSITES LTD.

  • Legal name: DIM WEBSITES LTD
  • Public product: APKIOS
  • Website: https://apkios.app
  • Support: [email protected]
  • VAT number: GB485610280

For shopper data inside a merchant’s app (name, email, orders, addresses, wishlist, and similar), the merchant is the controller. We act as a processor on their behalf, using Shopify’s APIs. Shoppers should contact the store they bought from first.

2. What this policy covers

APKIOS is a Shopify sales-channel app. A merchant installs it, configures branding, home, product, menu, onboarding, and profile in the Shopify admin (live preview is in admin), and offers buyers a native iOS and Android app with catalogue, cart, Shopify Checkout, customer login, orders, wishlist, newsletter, and optional push.

  • This marketing and legal website (no accounts, no checkout).
  • The APKIOS Shopify admin used by merchants.
  • The white-label buyer apps we compile.
  • Each merchant app may be listed on the App Store and Google Play. This website does not publish those store URLs. Product payments always go through Shopify Checkout — never through Apple or Google in-app purchase. Two models: (a) DIM WEBSITES LTD publishes the app under our Apple / Google accounts (the seller/developer line may be DIM WEBSITES LTD); (b) the merchant publishes with their own accounts. App name and icon are the merchant’s.

3. Data we process

Merchant admin (from Shopify OAuth and the APKIOS admin)

  • Shop domain and Shopify shop identifiers
  • Staff name and email associated with the install, when Shopify provides them
  • Theme, branding assets, home/product/menu/onboarding/profile configuration
  • Integration keys the merchant turns on (Klaviyo, Meta, Google Analytics, OneSignal, and similar)
  • Apple / Google publishing secrets and metadata (bundle IDs, listing copy, whether DIM or the merchant is the publisher)
  • Billing plan handle (free / beginner / advance / complimentary)

Buyer / shopper (via Shopify Admin API, Customer Account API, and Storefront, on behalf of the merchant)

  • Name, email, phone
  • Shipping and billing addresses (address book)
  • Orders, fulfilments, and related checkout status as Shopify exposes them
  • Wishlist / favourites stored for that shop
  • Newsletter fields the merchant collects with consent (email and, if they ask, name and phone)

First-party analytics we store on our servers (not used to advertise APKIOS)

  • Device, OS, and app version
  • Locale and country
  • Product identifiers and order id when relevant
  • Anonymous client / session ids (clientId)

Push

  • Device push tokens (opaque)
  • Campaign content and segments the merchant sends
  • Delivery and open receipts stored against a token hash only
  • Firebase may be DIM-managed for messaging — we often inject it ourselves, not only if the merchant pastes keys

Device (on the phone)

  • Session tokens stored encrypted on the phone; they expire
  • Locale / language preference

Website visitors

  • This site does not set marketing or analytics cookies in v1.
  • Our host (see processors) may keep standard server logs (IP, user agent, URL, timestamp) for security and reliability. We do not use them to build advertising profiles.

4. Why we process it

App functionality (merchant contract; shopper: performance of the store’s contract / legitimate interest of the merchant)

  • Login, profile, address book, shipping estimates, cart, coupons, and Shopify Checkout
  • Order history and wishlist
  • Remote theme so the merchant can update the app
  • First-party product analytics for the merchant who installed APKIOS
  • Push campaigns the merchant sends

Marketing (merchant-configured, shopper opt-in)

  • Newsletter and Klaviyo (or Shopify marketing) only with the merchant’s configuration and the shopper’s opt-in
  • Push only if notifications are on and the shopper granted OS permission

Optional third-party analytics / ads tools

  • Events to Meta, Google Analytics, Klaviyo, or OneSignal only if the merchant activates those integrations
  • If a shopper is already known (for example signed in), an event may include their email so the merchant can attribute the session — still under that merchant’s settings, not for APKIOS ads

We do not sell personal data. We do not use shopper PII to advertise APKIOS as a product. We do not run third-party advertising networks on this website in v1.

6. How long we keep it

  • Device session tokens: on the phone, encrypted, until they expire or the shopper signs out / uninstalls.
  • On our servers: shop configuration, wishlist, first-party analytics, push data, integration settings, publishing credentials, and billing plan handle — only for shops that installed APKIOS.
  • Merchant billing and contract records: kept as required by law after the account ends.
  • Host logs: short-lived, rotated by the provider.

When a merchant uninstalls the Shopify app, or when Shopify sends the mandatory compliance webhooks, we delete or anonymise personal data for that shop or customer as described below.

7. Shopify compliance webhooks

APKIOS implements Shopify’s customer privacy webhooks.

  • customers/data_request — we export what we still have for that customer/shop (including analytics and push rows we hold) and provide it to the merchant so it can be passed to the shopper.
  • customers/redact — we delete personal data we hold for that customer in that shop (wishlist, cached profile fields, analytics, push tokens), except what we must keep for legal claims or security logs already stripped of extra identifiers.
  • shop/redact — after uninstall, we delete that shop’s configuration, wishlist, analytics, push data, credentials, and billing row.

Shopify may also retain data on its side under the merchant’s Shopify contract. We cannot delete data that lives only in Shopify.

8. Security

  • HTTPS in transit for the website, admin, and APIs.
  • Encryption in transit and at rest on hosting and databases we control.
  • Separate test and production environments. Production shopper data is not used as a playground.
  • Staff access is limited to people who need it. Staff accounts use 2FA.
  • Infrastructure logs for security. We instruct staff not to paste personal data into public chats, tickets that are overly broad, or third-party AI tools.
  • Session tokens on device are stored encrypted.

No security practice is perfect. We do not claim SOC 2 or similar certifications on this site.

9. Processors (not buyers of your data)

We use companies that process data on our instructions. They are not sold the data.

Processors we use ourselves

  • Shopify — commerce platform, checkout, customer accounts, APIs.
  • Cloudflare Pages — this marketing and legal website.
  • Heroku — APKIOS admin and API.
  • Amazon RDS / AWS — Postgres database and related infrastructure.
  • Resend — transactional email (from [email protected]; replies may go to [email protected], which reaches the same team as [email protected]).
  • Expo Application Services (EAS) — we compile and submit iOS and Android binaries.
  • Apple and Google — app-store infrastructure when we or the merchant submit binaries (they process developer-account and review data under their own terms).

Optional, only if the merchant turns them on (Firebase may also be DIM-managed for messaging)

  • Klaviyo — email / SMS marketing
  • Meta — advertising events / SDK if enabled
  • Google Analytics — product analytics if enabled
  • Firebase — messaging (often DIM-managed) or analytics if enabled
  • OneSignal — push if enabled

Each of those optional providers is a processor (or independent controller for their own dashboards) under the merchant’s contract with them. Turning an integration off stops new sends from APKIOS; it does not automatically wipe historical data inside that provider.

10. Sale, ads, and CCPA / GDPR “sale”

We do not sell personal information. We do not share shopper PII for cross-context behavioural advertising of APKIOS. If a merchant enables Meta, Google, or similar, that merchant is responsible for their own notices and opt-outs. We honour a documented opt-out request sent to our support email where it applies to data we control.

11. Your rights

Depending on where you live (including GDPR and CCPA), you may request access, correction, deletion, restriction, objection, portability, and withdrawal of consent. You may also complain to your local supervisory authority.

  • Shoppers: write to the Shopify store first (the merchant). They can also ask us via the merchant, or email us if the merchant is unresponsive. We can only act on data APKIOS still holds.
  • Merchants and website visitors: email [email protected].
  • We may need to verify the request (shop domain, customer id, or similar) so we do not disclose data to the wrong person.

12. International transfers

Shopify, Apple, Google, Cloudflare, Heroku, AWS, Resend, Expo, and the optional marketing/analytics tools may process data in the United States and other countries. Where GDPR applies, we rely on the provider’s appropriate safeguards (such as Standard Contractual Clauses) stated in their data-processing terms.

13. Children

APKIOS is a B2B product for Shopify merchants. We do not knowingly collect data from children to market APKIOS. A merchant’s own app may sell products to a mixed audience; that merchant is responsible for age-gating and their store policies.

14. Changes

We will update this page when our practices change. The date at the top is the last revision. Material changes will be reflected here at https://apkios.app/privacy — the stable URL intended for Shopify Partner Dashboard, App Store, and Play Console.

15. Contact