Security
How we handle your customers' data
Every statement on this page describes something the app does today, and each one is backed by evidence we can show a reviewer on request.
Payment data: we don't have it
Payment methods are vaulted by Shopify. When a renewal is due, the app asks Shopify to bill the contract; it never receives a card number. That means no PCI scope for you from us, and no second place your customers' payment details could leak from.
Where data is stored
The application and database run in the European Union (AWS, Stockholm). The storage volume holding the database is encrypted at rest, and every connection is encrypted in transit with TLS. Shopify access tokens are encrypted again at the application layer with a separate key.
Backups
Encrypted before they're written, with a key whose private half isn't kept on the server that makes them — so a copy of our server does not yield a readable backup. Backups are stored off the server, expire after 30 days, and restores are tested, not assumed.
What we collect, and for how long
Names, email addresses and delivery addresses — what's needed to run a subscription and nothing more. Phone numbers are not requested. Retention is enforced by a job that runs every day:
| Data | Kept for | Then |
|---|---|---|
| Raw event payloads from Shopify | 30 days | Deleted |
| A subscriber's details after their last subscription is cancelled | 90 days | Erased |
| Access and audit logs | 90 days | Deleted |
| Backups | 30 days | Expire |
| Everything for an uninstalled store | 48 hours | Deleted |
Deletion means deletion — rows are removed or fields emptied, never hidden behind a flag.
Who looked at what
Every time a subscriber's details are read, exported or changed — through the dashboard or the API — it's recorded: who, when, which record, which store and from which address. That log is append-only, enforced by the database itself: the application cannot edit or delete it.
Keeping data out of logs
Names, emails, addresses and customer identifiers are stripped before anything is written to a log file or an error report — replaced with a marker, not a scrambled value, because a consistent scramble of an email address still identifies the person.
Your customers' rights
Shopify's data-request, customer-redaction and shop-redaction webhooks are implemented and acted on automatically.
Documents
Found a security issue? Tell us — we treat those ahead of everything else.