---
title: "Data, privacy and security"
description: "What data Workflow Transactional Email stores, where it lives, how credentials are encrypted, and how GDPR deletion requests are handled."
canonical: "https://crm-tool.k8s-gcp-dev.eu.codecreationlabs.cloud/h/flow-transactional-email/data-privacy-and-security"
---

# Data, privacy and security

What this app stores, where it lives, and how it is protected. If you need this for a compliance review, this page plus our [Privacy Policy](https://workflow-transactional-email.app/privacy.html) should cover it.

## The app requests no Shopify scopes

This is the most important thing to understand. The app asks for **no access scopes at all**. It cannot read your products, orders, customers or any other store data.

Customer data reaches an email only because *you* pass it in from Shopify Flow, through the action's **Variables (JSON)** field. Flow reads your store data; you decide what to hand over. If you send only an order number, an order number is all we ever see.

## What is stored

| Data | Why | How long |
| --- | --- | --- |
| Email layouts, HTTP requests, presets | Your configuration | Until you delete them or uninstall |
| Sender configuration | SMTP host / port / credentials, or OAuth tokens | Until you remove the sender or uninstall |
| Secrets | Values you store deliberately | Until you delete them or uninstall |
| Action history | Status, timing, resolved request and response for each run | Until you uninstall |
| Uploaded files | Images and attachments used in layouts | Until deleted or uninstall |
| Shop record | Your myshopify domain, shop email, plan | Until you uninstall |

**Action history is the one to think about.** It records what was actually sent, which for an email includes recipient addresses and the resolved variables. That is what makes troubleshooting possible - it is also personal data, so treat History as customer data in your own compliance work.

Secret values are **redacted** from history before it is written, so a stored token never lands in your logs.

## Where it lives

Everything runs in the **European Union**. Databases, caches and file storage are region-local, with encryption at rest.

## How credentials are protected

Anything that could be used to send as you gets a second layer of encryption on top of disk-level:

- SMTP usernames and passwords
- Microsoft 365 and Google OAuth access and refresh tokens
- Your stored secrets
- Shopify session tokens

These are individually encrypted with a dedicated key management service and decrypted only in memory, for the moment an action runs. Plaintext is never written to disk.

Every decryption of a protected value is recorded in an internal access trail.

## What recipients receive

Emails go out through **your** mailbox, not ours - your Microsoft 365 tenant, Google Workspace account or SMTP provider. We hand the message to your provider and it is delivered under your domain. See [Email deliverability](https://crm-tool.k8s-gcp-dev.eu.codecreationlabs.cloud/h/flow-transactional-email/email-deliverability.md).

Rendered email HTML is sanitised before sending: scripts, event handlers, `javascript:` URLs, iframes and form elements are stripped, so a value passed in from Flow cannot turn into active content in someone's inbox.

## Outbound requests

HTTP requests you configure are checked before connecting. Requests to internal or private network addresses - loopback, link-local, cloud metadata endpoints, private ranges - are refused, including via a redirect. Redirects are capped and responses size-limited.

## Deletion

**Uninstalling deletes everything.** Layouts, senders, secrets, history and uploaded files are removed. It is immediate and not recoverable, so export anything you want to keep first.

**GDPR requests from Shopify** are handled automatically. Shopify sends mandatory data-request, customer-redact and shop-redact webhooks; the app processes them and removes the corresponding data.

**Deleting individual records** takes effect immediately and is not recoverable.

## Sub-processors

- **Google Cloud (europe-west1)** - hosting, databases, storage, key management
- **Your email provider** - Microsoft, Google, or whichever SMTP provider you configure
- **Shopify** - the platform itself
- A transactional email provider for the app's own notification emails to you (quota warnings and failure alerts). Merchant email always goes through your own sender.

## Questions

For a DPA, a security questionnaire or a specific compliance question, contact us through the Help Center or at support@codecreationlabs.com.

## Related

- [Secrets](https://crm-tool.k8s-gcp-dev.eu.codecreationlabs.cloud/h/flow-transactional-email/secrets.md) - how stored credentials work.
- [History and troubleshooting](https://crm-tool.k8s-gcp-dev.eu.codecreationlabs.cloud/h/flow-transactional-email/history-and-troubleshooting.md) - what History records.
- [Sidekick and AI assistants](https://crm-tool.k8s-gcp-dev.eu.codecreationlabs.cloud/h/flow-transactional-email/sidekick.md) - what an AI assistant can and cannot read.