Data and privacy

#Each store's data is walled off

Every store's data is separated in the database itself, not just in our code: queries made for one store can't see another store's rows, even by mistake. Keys belong to one store and only ever see that store.

#Customers see only their own

When a subscriber acts, from their Shopify account page or the store's portal, they can only see and change their own subscriptions, whatever they ask for. Shopify signs who they are; we don't take their word for it.

#What we keep

We keep as little about customers as we can:

• Subscriptions mirror Shopify's: products, prices, schedule, status, and the customer's Shopify id. Names, emails and addresses stay in Shopify.
• Customer emails are read from Shopify when an email is sent, and never stored. The email log keeps a masked address, like m…@gmail.com.
• Imports from another app keep customers' details for 30 days, then delete them.
• Tokens for other services (Recharge, Klaviyo) are encrypted, never shown again, and hidden in the activity log.
• Klaviyo, if the store connects it, receives subscription events with the customer's email, so the store can send its own emails from there.

When Shopify asks us to delete a customer's data, or a store uninstalls, we do it automatically.

#For agents

Agents see what their key's permissions allow, and nothing about a customer beyond what's needed to manage their subscription. Responses don't include card details, ever: cards stay with Shopify.