Privacy Policy
Last updated October 23, 2026
Customer names and email addresses
Subscription Concierge does not keep a copy of a subscriber's name, email address, phone number, or postal address in its own database. Every customer record we hold is keyed by Shopify's opaque customer identifier, and Shopify remains the source of truth. We access Shopify's Customer and Order objects only through its Protected Customer Data APIs, with the reason "app functionality," and we request two customer fields: name and email address. We read them from Shopify when they're needed — to show your team who a subscription belongs to in the dashboard, and to send the subscription emails you turn on, such as a request to update a failing card or a win-back email — and we don't store them. We don't request phone numbers or addresses. If a future feature needs another field, we'll update this policy before using it.
Subscription imports
When you move subscriptions from another app, the file you upload can include customers' names, email addresses, and shipping addresses. Each row is kept only until it's imported (after that we keep the result and the new subscription's identifiers, not the row's contents), and the whole import, including any rows that weren't imported, is deleted after 30 days. Email addresses are masked in the import's on-screen summary.
Data we collect from merchants (via Shopify OAuth)
| Data | Why |
|---|---|
| Product & variant details | To let you configure subscription tiers, bundles, and checkout upsell rules |
| Subscription contract IDs, billing dates, status | Core subscription management — skip/pause/resume/reschedule, queue management (add/reorder/remove upcoming items), dunning, anchoring |
| Shopify OAuth access token | Authenticates our API calls to your store. Encrypted at rest; never logged or displayed in plain text. |
| Staff account emails & roles | So your team can log into the merchant dashboard with appropriate permissions (Admin/Viewer) |
Data we collect from your customers (storefront self-service portal)
When a shopper uses the customer portal (skip, pause, reschedule, manage their upcoming queue, combine subscriptions, or request cancellation), we store: their Shopify customer identifier, their subscription/queue state, and any cancellation reason they choose to provide. We identify them via Shopify's own signed App Proxy session — we don't ask for or store a separate login/password.
How data is protected
- Encryption in transit and at rest — all traffic uses TLS. The database and the server's disk are encrypted at rest, and Shopify access tokens are additionally encrypted before being written to the database.
- Encrypted backups — the database is backed up daily; backups are encrypted with the same keys as the database and kept for 7 days.
- Restricted access — production systems are accessible only to named administrators, with multi-factor authentication, and all infrastructure activity is logged. The database is not reachable from the internet.
- Staff access logging — every time someone on your team views or changes a customer or subscription record through the dashboard, including bulk actions and imports, it's logged (who, what, when) and visible in the dashboard's Access Log.
- Data retention — canceled-subscription history and staff access-log entries are automatically purged after 365 days. Data tied to an active subscription is kept for as long as the subscription is active.
- Multi-tenant isolation — every record is scoped to a specific shop; one merchant's data is never visible to another.
Infrastructure & subprocessors
Subscription Concierge runs on Amazon Web Services (compute, PostgreSQL, message queuing, object storage, and managed model inference for recommendations), behind Cloudflare for DNS, TLS, and basic traffic analytics (page views/visit counts — not behavioral ad tracking). Application monitoring (metrics, logs, and error traces) goes to Grafana Cloud. Transactional email, where a feature that sends it is enabled, goes through Amazon SES. We don't use third-party advertising trackers. Session authentication in the merchant dashboard uses browser local storage, not cookies. The full processor terms and sub-processor list are in the Data Processing Addendum.
Your rights & deletion
We support Shopify's mandatory privacy webhooks: customers/data_request,
customers/redact, and shop/redact. When a merchant uninstalls the app, or a data
erasure request comes through Shopify, associated subscription, queue, dunning, and access-log records for that
shop (or customer) are deleted. If you're a merchant's customer and want to make a data request directly,
contact your merchant, or reach us at hello@subscriptionconcierge.com.
Security incidents
If we confirm an incident affecting merchant or customer data, we notify the affected store owner directly, without undue delay and no later than 72 hours after confirmation, including what happened, what data was affected, and what we've done about it. To report a security issue, email hello@subscriptionconcierge.com.
Changes to this policy
We'll update this page if what we actually do changes, and update the "last updated" date above. We don't expect to make retroactive changes that materially expand what we collect without letting merchants know first.
Contact
Questions about this policy or how your data is handled: hello@subscriptionconcierge.com.