Data Retention & Deletion Policy
Last updated: September 3, 2026
V1 retention matrix
| Data category | Retention / deletion rule |
|---|---|
| Raw Shopify protected customer/order data | Not persisted in V1. It is processed transiently to calculate merchant-facing metrics and diagnostics. |
| Shopify access / refresh tokens and session data | Retained while the app is installed. Deleted immediately when the app processes app/uninstalled; deletion is repeated idempotently when Shopify later sends shop/redact. |
| Operational logs | Maximum target retention of 30 days. Logs must not contain access tokens or raw protected customer data. |
Shopify mandatory privacy workflows
- customers/data_request: we verify Shopify's HMAC and respond to the request. V1 stores no raw customer/order PCD locally, so there is normally no local customer record to export.
- customers/redact: we verify Shopify's HMAC and delete/redact responsive customer-linked data. V1 intentionally stores no raw customer/order PCD.
- shop/redact: we verify Shopify's HMAC and delete remaining shop-scoped authentication/session data.
Shopify requires compliance webhook actions to be completed within 30 days of receipt unless retention is legally required.
Manual merchant requests
Merchants may request disconnection or deletion by uninstalling the app or emailing aiken@yeedoor.com. Include the .myshopify.com store domain so we can identify the merchant account without requesting customer identity information.
Future storage
Before any future feature begins persisting customer-linked protected data, its retention period and deletion implementation must be added to this policy and to the app's shop/customer deletion handlers before release.