The short version
- Every connection is read-only. We can't send emails, change orders or subscriptions, or edit your ads.
- Your access keys are encrypted before they're stored and are never sent back to a browser.
- Your data is used only to produce your audit, dashboard and reports, and to run the services you hire us for.
- We don't sell it, show it to other brands, use it to advertise, or use it to train AI.
- Disconnect and we delete it: within 30 days for clients, and within 60 days of an audit if you don't become a client.
What we read from your tools
| Tool | Access | What we read |
|---|---|---|
| Shopify | Read-only app | Orders, line items, refunds, customers (name, email, phone, country and region), products, discount codes and the source of each customer's first visit. |
| Klaviyo | Read-only private API key | Profiles and their email and SMS consent, lists, segments, flows, campaigns, and email and SMS activity such as clicks, opens, unsubscribes and attributed orders. |
| Recharge | Read-only API token | Subscriptions, charges, skips, swaps, cancellations and cancellation reasons. |
| Meta | Facebook Login with ads_read | Ad spend and results by campaign, ad set and ad. These are totals; Meta doesn't give us details of the people who saw your ads. |
We don't receive payment card details, and we don't store full street addresses or the content of your customers' messages to you.
How we protect it
- Encryption in transit: the website, dashboard and every connection to your tools use HTTPS.
- Encryption at rest: access keys are encrypted with AES-256-GCM using a key kept outside the database. The database is also encrypted at rest by our hosting provider.
- Least privilege: we ask for read-only access, and only to the data we use.
- Separation: each brand's data is kept apart, and only that brand's team and ours can see it.
- Shopify privacy requests: we respond to Shopify's customer data request, customer deletion and shop deletion notices.
- Sign-in: passwordless email links that expire, with rate limits.
No system is perfectly secure, and we don't currently hold a third-party security certification. If you need specific commitments in writing, contact us before connecting.
Subprocessors
These providers process personal data for us so we can run Retention Systems. Our database is stored in the European Union.
| Provider | What for | Data |
|---|---|---|
| Render | Hosts the website, app, background worker and PostgreSQL database | All stored data, including connected-store data, encrypted access keys and server logs |
| Cloudflare | Domain name and network protection | Visitor IP addresses and request details, in transit |
| Resend | Sends sign-in links, notifications and weekly reports | Recipient email addresses and the content of those emails |
| Calendly | Booking audits and calls on our website | Name, email address, chosen time and anything written when booking |
We'll update this list before adding a new subprocessor, and tell clients so they can object.
Data Processing Agreement
This agreement applies when Retention Systems processes personal data for a brand (“you”) through the audit, the dashboard or our agency services. It forms part of our agreement with you. If we've signed a separate DPA with you, that one applies instead.
- Roles. You are the controller of your customers' personal data. We are your processor.
- Instructions. We process personal data only to provide the services you've asked for, and on your documented instructions, unless the law requires otherwise. We'll tell you if we think an instruction breaks data protection law.
- What's processed. Shopper names, email addresses, phone numbers, country and region, order and subscription history, email and SMS consent and activity. For as long as the services run, plus the deletion periods above.
- Confidentiality. Everyone who can access the data is bound by confidentiality.
- Security. We apply the measures described on this page and keep them up to date.
- Subprocessors. You authorise the subprocessors listed above. We give them data protection terms at least as strict as these, give notice before adding one, and remain responsible for them.
- Helping you. We help you answer requests from your customers to access, correct or delete their data, and with data protection impact assessments where needed.
- Breaches. We tell you without undue delay, and within 72 hours, after becoming aware of a personal data breach affecting your data, with the information you need to meet your own duties.
- End of service. When the services end, we delete your data within the periods above, unless the law requires us to keep it.
- Audits. On reasonable notice, we give you the information you need to show compliance with this agreement.
- Transfers. Where data leaves the UK or EU, we use a lawful transfer mechanism such as the UK International Data Transfer Agreement or the EU Standard Contractual Clauses.
To receive a signed copy, email privacy@retentionsystems.net.