Privacy & data handling

Principles

1. Rule-based templates by default. Disclosure copy and reminder emails are filled from merchant-edited tokens. The MVP does not call an LLM.
2. If AI is added later, any provider must be configured for: no training on merchant or customer data; no retention beyond the request (or the shortest retention the provider allows); and a Data Processing Agreement / UK GDPR-appropriate terms for UK customer data.
3. Minimal scopes. We intentionally avoid read_own_subscription_contracts as a dependency for competitor billing apps' data (that scope only returns contracts owned by this app). Reminder scheduling uses merchant-configured webhooks, Flow, or ESP — not scraping another app's contracts.
4. Cancel tokens (production) should be signed, time-limited, and not expose raw customer PII in URLs beyond what Shopify already uses in account links.
5. Demo mode stores state in memory only; nothing is sent off-box.

What we store

Data	Purpose	Retention
Shop domain, settings toggles	App config	Until uninstall
Checklist tick state	Admin UX	Until uninstall
Reminder send logs (if Resend enabled)	Deliverability debug	30–90 days
Cancel click events	Audit trail for merchant	12 months or merchant delete

We do not need full order line items or payment instruments for the MVP.

Merchant-facing copy

Always disclose: implementation toolkit, not legal advice. Do not claim certification of DMCC compliance.

Contact

For privacy requests or data deletion after uninstall, contact the Partner support email listed on the SubGuard App Store listing. GDPR erasure for shop data is also handled via Shopify’s mandatory shop/redact and customers/redact webhooks.