Workflow Transactional EmailWorkflow Transactional Email

Data, privacy and security

What this app stores, where it lives, and how it is protected. If you need this for a compliance review, this page plus our Privacy Policy should cover it.

The app requests no Shopify scopes

This is the most important thing to understand. The app asks for no access scopes at all. It cannot read your products, orders, customers or any other store data.

Customer data reaches an email only because you pass it in from Shopify Flow, through the action's Variables (JSON) field. Flow reads your store data; you decide what to hand over. If you send only an order number, an order number is all we ever see.

What is stored

Data Why How long
Email layouts, HTTP requests, presets Your configuration Until you delete them or uninstall
Sender configuration SMTP host / port / credentials, or OAuth tokens Until you remove the sender or uninstall
Secrets Values you store deliberately Until you delete them or uninstall
Action history Status, timing, resolved request and response for each run Until you uninstall
Uploaded files Images and attachments used in layouts Until deleted or uninstall
Shop record Your myshopify domain, shop email, plan Until you uninstall

Action history is the one to think about. It records what was actually sent, which for an email includes recipient addresses and the resolved variables. That is what makes troubleshooting possible - it is also personal data, so treat History as customer data in your own compliance work.

Secret values are redacted from history before it is written, so a stored token never lands in your logs.

Where it lives

Everything runs in the European Union. Databases, caches and file storage are region-local, with encryption at rest.

How credentials are protected

Anything that could be used to send as you gets a second layer of encryption on top of disk-level:

  • SMTP usernames and passwords
  • Microsoft 365 and Google OAuth access and refresh tokens
  • Your stored secrets
  • Shopify session tokens

These are individually encrypted with a dedicated key management service and decrypted only in memory, for the moment an action runs. Plaintext is never written to disk.

Every decryption of a protected value is recorded in an internal access trail.

What recipients receive

Emails go out through your mailbox, not ours - your Microsoft 365 tenant, Google Workspace account or SMTP provider. We hand the message to your provider and it is delivered under your domain. See Email deliverability.

Rendered email HTML is sanitised before sending: scripts, event handlers, javascript: URLs, iframes and form elements are stripped, so a value passed in from Flow cannot turn into active content in someone's inbox.

Outbound requests

HTTP requests you configure are checked before connecting. Requests to internal or private network addresses - loopback, link-local, cloud metadata endpoints, private ranges - are refused, including via a redirect. Redirects are capped and responses size-limited.

Deletion

Uninstalling deletes everything. Layouts, senders, secrets, history and uploaded files are removed. It is immediate and not recoverable, so export anything you want to keep first.

GDPR requests from Shopify are handled automatically. Shopify sends mandatory data-request, customer-redact and shop-redact webhooks; the app processes them and removes the corresponding data.

Deleting individual records takes effect immediately and is not recoverable.

Sub-processors

  • Google Cloud (europe-west1) - hosting, databases, storage, key management
  • Your email provider - Microsoft, Google, or whichever SMTP provider you configure
  • Shopify - the platform itself
  • A transactional email provider for the app's own notification emails to you (quota warnings and failure alerts). Merchant email always goes through your own sender.

Questions

For a DPA, a security questionnaire or a specific compliance question, contact us through the Help Center or at support@codecreationlabs.com.