Privacy notice
What personal data Dambl collects, why it is collected, who it is shared with, how long it is kept, and the rights you have over it.
Who is responsible
Edi Abramov (trading as Dambl) of Akko, Israel is the controller of the personal data described here. The data protection contact is support@dambl.app.
Where we process images and product records on your instruction as part of running the service, we act as your processor. Write to support@dambl.app and we will provide a data processing addendum for signature.
What we collect
We collect only what the service needs to run and to be billed correctly.
Why we use it, and on what basis
To run shoots, show your library and push photographs to your store: performance of the contract.
To bill correctly and keep accounting records: performance of the contract and compliance with a legal obligation.
To keep the service secure, diagnose faults and prevent abuse: our legitimate interest in operating a reliable service, balanced against your interests.
To send service messages about outages, security and material changes: legitimate interest. Marketing email is sent only with consent and can be stopped at any time.
What we do not do
We do not sell personal data.
We do not use your product photographs, source images or the instructions you write to train general purpose image models, and our contract with the generation provider prohibits them from doing so.
We do not publish your images as examples without asking you first and receiving a written yes.
Who we share it with
Every party that can receive data from Dambl is listed below, with what it receives. There are seven. Each row says whether anything reaches it today. Support is handled over ordinary email rather than a ticketing tool, and the service carries no analytics or advertising product, so neither adds a recipient.
International transfers
Generation runs on Google Cloud's global Vertex AI endpoint. The location Dambl sets is “global”, so Google routes each request to a facility it chooses from its worldwide capacity; which country a given photograph is generated in is not something we select, and not something we are told. Google Cloud's own data-transfer safeguards are the ones that apply to that processing. We do not restate them here, because they are Google's to change and ours to pass on.
The list above is the complete and current subprocessor list; it is maintained on this page rather than a separate register. We give 30 days notice, by email to the account address, before adding a new subprocessor.
How long we keep it
Retention periods are set out in full in the Images and data policy. In summary: generated photographs are kept for as long as the account is open, because their point is that you can come back to them; everything tied to the account is deleted within 48 hours of uninstall; billing records are kept for seven years; operational logs rotate automatically.
Your rights
Subject to the law that applies to you, you may ask for a copy of your data, ask for it to be corrected or deleted, object to processing based on legitimate interests, ask us to restrict processing, and ask for a portable export.
Write to support@dambl.app. We respond within 30 days and will not charge for a first request.
If you are not satisfied with our answer you may complain to the data protection authority for the country you live or work in. You do not need to come to us first.
Cookies
The embedded application uses only cookies that are strictly necessary for session authentication inside the Shopify admin.
The public website sets no cookies at all. It runs no analytics, no advertising tags and no cross-site tracking, so there is no cookie table to publish and no consent banner to click.
One page is the exception: where you connect an AI assistant to Dambl and name your store, a cookie called dambl_shop remembers that store's address for a year, so the next connection does not ask again. It holds the address and nothing else, and only that page reads it.
The same page sets a cookie called dambl_oauth_req for 15 minutes. It holds the reference of the connection you started there, so the connection can only be finished in the browser that started it, and it is cleared when the connection finishes.
It does load a typeface from Google's font servers, and so do the app's pages, which tells Google the visitor's IP address and which browser asked for the font — the reason Google Fonts is a row in 2.5. It sets no cookie and carries no tracking; a font file is the whole of what comes back.
Questions about this document go to support@dambl.app. Where a term here conflicts with the Shopify Partner Program Agreement or the Shopify Terms of Service, those terms prevail for matters they govern.
