# Data and privacy

## Each store's data is walled off

Every store's data is separated in the database itself, not just in our code: queries made for one store can't see another store's rows, even by mistake. Keys belong to one store and only ever see that store.

## Customers see only their own

When a subscriber acts, from their Shopify account page or the store's portal, they can only see and change their own subscriptions, whatever they ask for. Shopify signs who they are; we don't take their word for it.

## What we keep

We keep as little about customers as we can:

- **Subscriptions** mirror Shopify's: products, prices, schedule, status, and the customer's Shopify id. Names, emails and addresses stay in Shopify.
- **Customer emails** are read from Shopify when an email is sent, and never stored. The email log keeps a masked address, like `m…@gmail.com`.
- **Imports** from another app keep customers' details for 30 days, then delete them.
- **Tokens for other services** (Recharge, Klaviyo) are encrypted, never shown again, and hidden in the activity log.
- **Klaviyo**, if the store connects it, receives subscription events with the customer's email, so the store can send its own emails from there.

When Shopify asks us to delete a customer's data, or a store uninstalls, we do it automatically.

## For agents

Agents see what their key's permissions allow, and nothing about a customer beyond what's needed to manage their subscription. Responses don't include card details, ever: cards stay with Shopify.