Data Protection Agreement

For Stackhall Basic · Last updated October 16, 2026

The short version.

Your store's data stays yours. We only handle it to run the app for you.
We hold no names, emails, phone numbers or addresses belonging to your customers.
We'll tell you within 72 hours if anything goes wrong with your data.
You can tell us to delete it at any time, and we will, within 30 days.
We won't add a new company to the list below without giving you 30 days' notice first.

What this document is

This is our written commitment about how we handle the data Stackhall Basic reads from your Shopify store. Privacy laws like the GDPR expect a merchant to have an agreement like this with every app they install — so rather than make you request one, here it is, on a page you can link to or print.

It takes effect when you install the app and stays in effect until the app is uninstalled and your data is deleted. It sits alongside the Privacy Policy, which says the same things less formally. If the two ever seem to disagree, we'll honour whichever is better for you.

Who is responsible for what

In privacy law there are two roles, and the words for them are unhelpful, so here they are in plain terms:

You decide. It's your store, your customer relationships, and your call what data exists and what the app is allowed to read. The law calls you the controller.
We follow. We handle that data only to provide the app to you, only in the ways described here, and for no purpose of our own. The law calls us the processor.

Practically, this means you're the one who answers to your customers about their data, and we're the one who answers to you about ours. Where we need to give you something to meet an obligation of yours — an answer, a copy, a deletion — we will.

What we handle on your behalf

Kind of data	Whose	What it's used for
Store profile	Yours	Store name, domains, account email, country, currency, timezone, plan, and which Stackhall apps you installed with which permissions. Used to identify your store and keep the app working.
Catalogue	Yours	Products, variants, SKUs, barcodes, prices, costs, inventory counts, descriptions, tags, SEO fields, images and collections. Used by Product Viewer, Catalog Check and Inventory Health.
Orders	Yours, created by your customers	Order number, dates, status, totals, refunds, currency, sales channel, item count, tags, and the shipping country, state or province and city. Used by Analytics and Sales Map.
Order lines	Yours	Product, variant, SKU, vendor, quantity and amounts per line. Used by the product-level reports.
Customer totals	Your customers	Shopify's internal customer ID, order count, lifetime spend, currency, account state and creation date. No name, email, phone or address. Used for lifetime value, repeat purchase and cohort reports.
Access token	Ours, issued by Shopify	Lets background syncs run when nobody is looking at the app. Never displayed, never logged.

The people whose data is involved are your customers (as order and totals records) and you and your staff (as the store account). Nobody else.

The app never asks Shopify for customer names, emails, phone numbers, street addresses, postal codes, coordinates or payment details, and never asks for a shipping address more precise than the city. Because it isn't requested, it cannot arrive — this is a property of the app, not just a promise about what we do with it afterwards.

What we promise

We use your data only to run the app for you, and only in the ways listed above.
We don't sell it, rent it or share it for advertising. Not to advertisers, not to ad networks, not to data brokers.
We don't use it to train AI models — ours or anyone else's.
We don't pool it. Your store's data is never combined with another store's to build a benchmark, an index or a report we publish or sell.
We collect as little as the feature needs, and we don't keep data for a feature you aren't using.
Only the people who maintain the app can reach it, only to operate or fix it, and they're bound to keep it confidential.
We'll stop when you say stop. Delete it, narrow it, or switch off sales syncing — your instruction, our job.
We'll tell you if we're ever legally compelled to hand something over, unless the law forbids telling you.

What we ask of you

Two things, both reasonable:

Make sure you're allowed to let an app read the data you're granting access to — that your own store privacy policy covers using service providers like us, which almost every store policy already does.
Don't deliberately route data to us that the app doesn't ask for, for example by stuffing customer names or email addresses into product fields or order tags. We have no way to detect that, and those fields aren't protected as personal data because they aren't supposed to contain any.

How we protect it

Encrypted in transit. HTTPS everywhere, including between the app and its database.
Encrypted at rest. The database and its backups are encrypted on disk.
Not reachable from the internet. The database sits on a private network and its firewall admits our application server and nothing else.
Proven identity on every request. Pages that show your data only render inside Shopify admin, with a signed token from Shopify verified on our side. There's no separate login to lose and no URL a stranger can guess.
Secrets stay out of sight. Access tokens are never rendered on a page or written to a log, and are stripped from error reports automatically.
Disposable servers. The application server holds no data of its own and is rebuilt from scratch on every release, so it accumulates nothing.
Least access. Production access is limited to the people who maintain the app, and used only to operate and fix it.

The companies that help us run it

Privacy law calls these sub-processors. They're the services the app runs on. None of them may use your data for their own purposes.

They fall into two groups, and the distinction matters to a compliance review. Shopify, DigitalOcean and Cloudflare are in the path of your store data. The rest — error monitoring, usage statistics and the two content networks — are not: they see a browser making requests and, in Sentry's case, a report that something broke. None of them is sent your catalogue, your orders or your customer records. They are listed anyway, because a sub-processor list that quietly leaves out the companies your browser talks to isn't one you can act on.

Company	Why they're involved	Where
Shopify	Where your data comes from. We read your store data from Shopify's Admin API using the permissions you granted at install.	Global
DigitalOcean	Servers and database. Runs the app and the Postgres database your store data is stored in. Encrypted in transit; the database accepts connections from our own server only.	United States / Canada
Cloudflare	Network and HTTPS. Sits in front of the app to terminate HTTPS and filter abusive traffic. Sees request metadata, not stored data.	Global edge network
Sentry	Error monitoring. Receives a report when something in the app breaks: the error, the code path it happened in and the page it happened on. Configured not to attach request headers or account details, and access tokens are removed before a report leaves our server. It is not sent your catalogue, orders or customer records.	United States
Google Analytics	Usage statistics. Counts page views and which buttons get used, so we know which features are worth improving. It receives the page address with Shopify's parameters removed first, and the browser, device and approximate-location information any website's analytics sees. It is not sent your catalogue, orders or customer records.	United States / Global
Google Fonts	Typefaces. Serves the two fonts every page is set in. Your browser's IP address is visible to it, like any image or script host. It receives nothing else.	Global CDN
jsDelivr	Chart library. Serves the charting script on report pages. Your browser's IP address is visible to it, like any image or script host.	Global CDN
OpenFreeMap	Map tiles. Serves the background map on the Sales Map page only. It receives the map area being viewed, never your order data.	Global CDN

If we want to add one, we'll update this page and announce it inside the app at least 30 days before it starts handling anything. If you're not comfortable with the new one, you can uninstall before it takes effect and ask us to delete your data.

Where your data goes

Your store data is stored in a United States or Canadian data centre. If you or your customers are in the UK, the EU or elsewhere, that means the data crosses a border, and we rely on the standard legal mechanisms for that — the European Commission's Standard Contractual Clauses and the UK Addendum — which we'll sign with you on request if your compliance process needs a countersigned copy.

The amount of data crossing that border is small by design: order totals, places at city level, and per-customer counts with no name attached to them.

Requests from your customers

When a customer asks to see, correct, export or delete their data, the request is yours to answer. What we'll do:

Tell you promptly if such a request reaches us directly instead of you. We won't answer it ourselves, beyond saying we've passed it on.
Search, export or delete on your instruction. Give us Shopify's customer ID or the order number and we'll handle the matching customer record, orders and order lines within 30 days, and confirm when it's done.
Act on Shopify's automated requests. Shopify forwards customer data and redaction requests to apps, and we act on those as well.

In practice there is usually nothing identifying to find: we hold no name, email, phone number or address, so a shopper cannot be identified from our records on their own.

If something goes wrong

If data belonging to your store is exposed, lost or accessed by someone who shouldn't have, we'll email you within 72 hours of finding out. Not a vague notice — we'll tell you what happened, what data was involved, how many records, what we've done about it, and what we recommend you do. We'll keep you updated as we learn more, and help with any notification you have to make to a regulator or to your customers.

Checking up on us

You're entitled to satisfy yourself that all this is true. Email us a security or privacy questionnaire and we'll complete it in writing within 30 days, at no cost. We'll also answer specific questions about where a particular piece of data lives, or confirm in writing that a deletion was carried out.

Deleting and returning your data

On request, any time. Email [email protected] from the address on your Shopify account with your .myshopify.com domain. Deleted within 30 days, confirmed by email.
Partially, if you prefer. You can ask us to delete the sales data and stop syncing it while keeping the catalogue features running.
On uninstall, automatically. Shopify revokes our access immediately and we clear the token at once. Everything else is deleted within 30 days. Reinstall inside that window and your history will still be there; after it, the app starts fresh.
A copy, if you want one. Ask and we'll export what we hold about your store in a machine-readable format, within 30 days.
Backups included. Backups roll off within 30 days, so deleted data leaves them inside the same window.

There's nothing we're required to keep afterwards. The app is free, so there's no billing record or invoice we have to hold on to.

Full retention periods for each kind of data are in the Privacy Policy, under "How long we keep it".

Shopify's rules on top of ours

Order and customer data is what Shopify calls protected customer data, and Shopify holds apps to its own standards for handling it: collect only what the app needs, encrypt it, limit staff access, don't keep it longer than necessary, and keep a written data protection commitment like this one. Everything above is written to meet those standards, and the app's access can be reviewed or withdrawn by Shopify independently of anything you or we do.

Changes to this agreement

If we change it, the date at the top changes. Anything that affects your rights or what we do with your data gets announced inside the app before it takes effect, so you have time to uninstall or request deletion. We will never quietly widen what we collect or how long we keep it.

Contact us

Data protection, deletion requests, questionnaires and signed copies: [email protected]
Anything else about the app: [email protected]

A real person reads these. If something here isn't clear enough to pass your review, tell us and we'll fix the wording rather than send you a longer version of it.