Data Handling & Retention Policy

To send notifications on your behalf we access and store data from your Shopify store, including your customer's data.

This is a plain English guide to the data that Smart Notifications handles on your behalf, how we store that data and how long we hold onto it for. Below you will find information about how we handle your data broken down by type.

Products

Once you install Smart Order Notifications we synchronise and cache all your product, variant and in some cases product/variant metafields data from Shopify and store this in our database. This data is used in order to display product information in your notifications.

Product data does not typically contain any sensitive or personally identifiable information. Product data is retained until such time that you uninstall the app, it is then expunged from our database within 61 days. We retain the product data for 61 days to avoid the heavy computational cost of resynchronising this data if you were to reinstall the app within this time period.

Orders

During the installation process, Smart Order Notifications subscribes to order webhooks via Shopify's API. This means that Shopify will send us your order data every time a change happens to an order on your store. For example, when an order is created, edited, fulfilled, tagged, marked as paid etc.

We store the most current copy of this order data in our database and we use it to apply notification triggers and line item filters to determine if to send a notification and which line items to include in the notification. We also use this data to allow you to have the freedom to include any order information in your notification Liquid templates that you could in Shopify.

Order data does include sensitive and personally identifiable information including but not limited to customer emails, addresses, and telephone numbers. We retain order data for 61 days after the last time an order was updated in Shopify. This data is then expunged entirely from our database. We retain order data for this time period to allow for resending failed notifications as well as Shopify's order editing which allows edits for up to 60 days.

Notifications

Email notifications are the only type of notification that have personally identifiable information associated with them, namely the email addresses entered in the notification configuration. These email addresses might be that of your staff, your suppliers, your third party logistics partners etc. Customer emails are not stored amongst our notification data.

When notifications are deleted by you in the app, the notification data is immediately deleted from our database. When you uninstall the app, remaining notification data is deleted after 61 days. We retain the notification data for 61 days to give you the opportunity to restore your notifications should you reinstall the app within this time period. We are not able to restore notification settings after 61 days.

Logging

Our notification logs for email notifications contain personally identifiable information in the form of the email addresses the emails were sent to. We use this data to display the 'Sent Notifications' log you find in the app interface. These email addresses are expunged from our database after 61 days.

Backups

We schedule regular backups of our production databases and retain these backups for 60 days or less. These backups are to ensure the integrity of the platform and play a critical role in our disaster recovery planning. We are unable to restore individual notification configurations or whole app installs.

Additional Shopify Data Handling Requirements

In addition to the above, we also comply with Shopify's mandatory GDPR webhooks and their Protected Customer Data requirements.