Privacy Policy

Last updated: October 23, 2026

This Privacy Policy explains how Rektification (“we”, “us”, “our”), the operator of the Disturv application (“Disturv”, the “App”), collects, uses, and protects personal information in connection with the App and the website at rektification.com (the “Site”). Disturv is a Shopify application that manages access to Telegram channels for merchants who sell subscriptions or one-time purchases linked to those channels.

1. Who this policy covers

Disturv processes personal information relating to two groups:

• Merchants — the Shopify store owners and staff who install and operate the App.
• Customers — the buyers who purchase a merchant’s products and receive Telegram channel access. When we process a customer’s data, we act as a processor on behalf of the merchant, who is the controller of that data.

2. Information we collect

2.1 From merchants

• Your Shopify store domain and shop identifier.
• Contact email associated with your store.
• Shopify API access credentials (session tokens) issued to the App to operate on your behalf.
• Telegram bot tokens you provide, which are stored encrypted at rest and used only to call the Telegram Bot API on your behalf.
• App configuration you create (linked products, channels, access durations, and settings).
• Billing status (your selected plan and subscription state). Payment card details are handled entirely by Shopify; we never see or store them.

2.2 From your customers (processed on the merchant’s behalf)

• Order data received from Shopify order webhooks: Shopify customer identifier, name, email address, and the products or line items purchased.
• Telegram data when a customer joins a linked channel: Telegram user ID, username, first/last name (as provided to Telegram), and membership events (join requests, approvals, leaves, and access expiry).
• Membership status and access history used to grant, maintain, and revoke channel access.

2.3 Technical data

• Standard server and application logs (timestamps, request metadata, error diagnostics) used to operate, secure, and troubleshoot the App.

3. How we use information

• To provide the App’s core function: generating one-time Telegram invite links, approving join requests, and managing access expiry and renewals.
• To administer merchant accounts, plans, and billing through Shopify.
• To secure the service, prevent abuse, debug errors, and maintain reliability.
• To provide merchant support and respond to enquiries.
• To comply with legal obligations.

4. Legal bases (EEA/UK)

Where the GDPR or UK GDPR applies, we rely on: performance of a contract (to provide the App to merchants); legitimate interests (to secure, maintain, and improve the service); and compliance with legal obligations. For analytics cookies on the Site we rely on your consent, which you can withdraw at any time (see section 10). For customer data, the merchant is the controller and is responsible for establishing the lawful basis for processing.

5. How we share information

We do not sell personal information. We share it only with service providers (“subprocessors”) that help us operate the App, each bound to protect it:

• Shopify — the platform the App runs on; source of order and store data, and the billing processor.
• Telegram — the Bot API used to manage channel membership (Telegram receives only what is necessary to perform channel actions).
• Render — cloud hosting and managed database (United States).
• Sentry — application error monitoring.
• Better Stack — log management.
• cron-job.org — triggers scheduled maintenance tasks (e.g. access-expiry processing).
• Automattic (WordPress.com) — hosts the Site and provides Jetpack Stats, which counts visits to the Site.
• Google — Google Analytics on the Site, only if you accept analytics cookies (see section 10).

We may also disclose information where required by law or to protect our rights, users, or the public.

6. Data retention

We retain personal information for as long as needed to provide the App. When a merchant uninstalls the App, the merchant’s data (including customer records and encrypted bot tokens) is scheduled for deletion and erased within 30 days, which preserves a short reinstall-recovery window while remaining within legal limits. We also honour Shopify’s mandatory data-erasure requests:

• Customer data request — we compile the stored data we hold for a specified customer so the merchant can fulfil the request.
• Customer redaction — we delete the specified customer’s stored data.
• Shop redaction — we erase the shop’s data within the retention window described above.

7. Your rights

Depending on your location, you may have the right to access, correct, delete, or port your personal information, to object to or restrict certain processing, and to withdraw consent. Customers should direct such requests to the merchant they purchased from (the controller); the merchant can action them through Shopify, and we will assist as processor. Merchants and other individuals may contact us directly at support@rektification.com. If you are in the EEA or UK, you also have the right to lodge a complaint with your local data protection authority. California residents have rights under the CCPA/CPRA, including the right to know and delete personal information and the right not to be discriminated against for exercising those rights; we do not sell personal information.

8. Data security

We protect information with encryption in transit (HTTPS), encryption at rest for sensitive credentials such as Telegram bot tokens, cryptographic verification (HMAC) of incoming webhooks, and access controls. No method of transmission or storage is completely secure, but we work to protect your information using industry-standard measures.

9. International transfers

The App is hosted in the United States. If you access it from outside the United States, your information may be transferred to and processed in the United States and other countries where our subprocessors operate. We take steps to ensure appropriate safeguards are in place where required.

10. Cookies and analytics

The embedded App uses strictly necessary cookies and session tokens to authenticate merchants within the Shopify admin and keep the App secure. We do not use advertising cookies.

On the Site, we measure visits in two ways:

• Jetpack Stats, provided by our host Automattic, counts page views and where visitors come from. It does not set cookies in your browser.
• Google Analytics, provided by Google, runs only if you choose Accept in the analytics banner. It then sets the _ga and _ga_* cookies, which last up to two years, to tell us which pages are read, how visitors find the Site, and which links are clicked, such as “Buy Pro”. Google Analytics does not store IP addresses; we have turned off Google signals and ad personalisation. Google may process this data in the United States under the EU-U.S. Data Privacy Framework.

If you choose Decline, nothing from Google Analytics loads. Your choice is kept in your browser’s local storage as rk_consent, so we don’t ask again. You can change it at any time with Cookie settings at the bottom of every page; withdrawing consent deletes the Google Analytics cookies.

11. Children’s privacy

The App is intended for use by businesses and is not directed at children under 16. We do not knowingly collect personal information from children.

12. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the “Last updated” date above and, where appropriate, by additional notice.

13. Contact us

Questions about this policy or our data practices can be sent to support@rektification.com.