Data, privacy and security
What this app stores, where it lives, and how it is protected. If you need this for a compliance review, this page plus our Privacy Policy and DPA should cover it.
Which Shopify data the app can read
The app is installed with no access scopes at all. It cannot read your products, orders, customers or any other store data. Customer data reaches an email only because you pass it in from Shopify Flow, through the step's fields and the Variables (JSON) field. Flow reads your store data; you decide what to hand over. If you send only an order number, an order number is all we ever see.
From version 1.17 there are three optional permissions, all for one feature: attaching the file an order or customer metafield points to (an invoice PDF another app saved on the order, for example). None is granted at install. The picker asks for the permission the first time you choose such a metafield, Shopify shows its own consent dialog, and the app's Permissions page lists every granted permission with a Revoke button.
| Permission | Used for |
|---|---|
| Read orders | The one metafield named in the layout, on the one order the Flow step is about |
| Read customers | The same for a customer metafield |
| Read files | Turning the file reference in a metafield into the file itself |
With a permission granted the app still reads nothing on its own: only when an email with such an attachment is sent, only that metafield on that resource, and only the file it points to. It does not read names, addresses, emails or line items, and the file is downloaded for that send, attached and discarded. Details and the exact scopes are on Permissions: what the app can read from your store.
What is stored
| Data | Why | How long |
|---|---|---|
| Email layouts, HTTP requests, presets | Your configuration | Until you delete them or uninstall |
| Sender configuration | SMTP host / port / credentials, or OAuth tokens | Until you remove the sender or uninstall |
| Secrets | Values you store deliberately | Until you delete them or uninstall |
| Action history | Status, timing, resolved request and response for each run | Cleared automatically after 30 days |
| Unsubscribe list | Recipients who opted out of your marketing emails: a hash of the address for matching, plus the address itself encrypted | Until you resubscribe them, Shopify sends an erasure request for that customer, or you uninstall |
| Uploaded files | Images and attachments used in layouts | Until deleted or uninstall |
| Shop record | Your myshopify domain, shop email, plan | Until you uninstall |
Action history is the one to think about. It records what was actually sent, which for an email includes recipient addresses and the resolved variables - and, for the HTTP Request action, the request and response. That is what makes troubleshooting possible - it is also personal data, so treat History as customer data in your own compliance work. History is cleared automatically after 30 days.
Secret values are redacted from history before it is written, so a stored token never lands in your logs.
Where it lives
Everything runs in the European Union on Google Cloud, region europe-west1 (Belgium). Databases, caches, file storage and application logs are stored in that region, with encryption at rest. We do not use request tracing.
How credentials are protected
Anything that could be used to send as you gets a second layer of encryption on top of disk-level:
- SMTP usernames and passwords
- Microsoft 365 and Google OAuth access and refresh tokens
- Your stored secrets
- Shopify session tokens
These are individually encrypted with a dedicated key management service and decrypted only in memory, for the moment an action runs. Plaintext is never written to disk.
Every decryption of a protected value is recorded in an internal access trail.
What recipients receive
Emails go out through your mailbox, not ours - your Microsoft 365 tenant, Google Workspace account or SMTP provider. We hand the message to your provider and it is delivered under your domain. New email steps always send through a mailbox or SMTP server you connect. Steps saved before the shared default sender was retired keep using it until you pick your own sender. See Email deliverability.
Rendered email HTML is sanitised before sending: scripts, event handlers, javascript: URLs, iframes and form elements are stripped, so a value passed in from Flow cannot turn into active content in someone's inbox.
Marketing emails and the unsubscribe list
A marketing layout sends one email per recipient, each with its own unsubscribe link. The link carries an encrypted token that names your store, the recipient, the layout and the email's language; the address is not readable in the link, so it cannot be picked out of mail logs, proxies or a forwarded email, and a changed link is rejected. Opening the link shows a confirmation page with the address in masked form; only the button on that page, or the one-click unsubscribe button of the recipient's mail client, records the unsubscribe.
The unsubscribe list stores each address twice: as a hash, so a send can check its recipients without decrypting anything, and encrypted with the same key management service as your credentials, so the Unsubscribes page and the CSV export can show it to you. The address is decrypted only on our servers, for that page and that export. Addresses are never written to application logs. See Marketing emails and unsubscribes.
Outbound requests
HTTP requests you configure are checked before connecting. Requests to internal or private network addresses - loopback, link-local, cloud metadata endpoints, private ranges - are refused, including via a redirect. Redirects are capped and responses size-limited. Any personal data returned in a response is handed back to Shopify Flow and may be recorded in the run history (which is cleared after 30 days). The same checks apply to a file the app fetches for an attachment, whether from a URL your workflow passes in or from a metafield.
Deletion
History is cleared after 30 days. Send and run history older than 30 days is deleted automatically, independent of uninstall.
Uninstalling deletes everything. Layouts, senders, secrets, history, the unsubscribe list and uploaded files are removed. It is immediate and not recoverable, so export anything you want to keep first.
GDPR requests from Shopify are handled automatically. Shopify sends mandatory data-request, customer-redact and shop-redact webhooks; the app processes them and removes the corresponding data, including the customer's entry on the unsubscribe list.
Deleting individual records takes effect immediately and is not recoverable.
Sub-processors
- Google Cloud (europe-west1, Belgium) - hosting, databases, storage, key management
- Your connected email provider - your Microsoft 365, Google Workspace, or own SMTP server, used only when you connect one to send email
- Shopify - the platform the app exchanges data with, and, with the optional permissions granted, reads the chosen metafield from
- Amazon Web Services (Frankfurt, Germany) - delivery of the app's own alert emails to you, and of email steps saved without a sender of your own
For the full, authoritative list see Annex 3 of our DPA.
Questions
For a DPA, a security questionnaire or a specific compliance question, contact us through the Help Center or at support@codecreationlabs.com.
Related
- Permissions: what the app can read from your store - the optional permissions, what they read and how to withdraw them.
- Secrets - how stored credentials work.
- History and troubleshooting - what History records.
- Marketing emails and unsubscribes - the unsubscribe link, the footer and the Unsubscribes page.
- Sidekick and AI assistants - what an AI assistant can and cannot read.