GDPR and data processing: what Restoc reads, stores and deletes
A GDPR review of a Shopify app comes down to four things: what it reads, who else processes it, where it is kept, and how it goes away. Here is Restoc's answer on all four, and where the data processing agreement stands today.
What Restoc reads, and the fields it keeps
Restoc connects to your Shopify store through the install flow and a Shopify Admin API access token. From then on it reads products, inventory levels and orders, by webhook and by a scheduled sync job. It keeps only the fields the reorder calculation runs on. Nothing else from your catalogue or your orders. Here is the whole list.
- Your account: name, email address and a hash of your password.
- Your store's .myshopify.com domain, its Shopify Admin API access token and that app's API secret key. Both are stored server-side and never shown in the app.
- Sync bookkeeping: when the store last synced, whether stock came from Shopify or sample data, how much of the catalogue was read, and any sync error.
- Tracked SKUs: title, your own SKU code, the Shopify variant id, current stock, lead time and the computed reorder point.
- Sales quantities and dates per SKU, with the Shopify order reference. That is what the sales velocity window, 7, 14 or 30 days, is calculated from.
- Alert settings: the email address reorder alerts go to, and a Slack webhook URL if you set one.
- Which setup steps your account has reached, account created, store connected, first sync, first lead time saved, and when it reached each.
- Your plan tier, trial end date and the state of your Shopify subscription charge.
The setup-step record is new. It exists for one reason. A store whose sync stalls, or whose lead times never get entered, should be findable and fixable. It holds the step name and a timestamp, not what you clicked.
No customer names. No addresses. No payment details. Payment details for your own subscription stay with Shopify, because the charge sits on your Shopify invoice.
Who processes your store's data
| Service | What it handles | When it is involved |
|---|---|---|
| Shopify | The source of your products, inventory and orders; also bills your subscription on your Shopify invoice | Always: it is where the data comes from |
| Amazon Web Services | Hosts the app and its Postgres database, and sends reorder alert and account email through Amazon SES | Always, in a single region alongside the app |
| Slack | Receives reorder alerts at an incoming webhook you configure | Only if you switch Slack alerts on |
Where it sits, how long it stays, how it goes
Where it sits
Everything runs on Amazon Web Services, in a single region alongside the app. Pages are served through CloudFront. The Postgres database stays in its region. There is no choice of data region today, so if your policy names a region, ask which one is in use before you install.
How long it stays
Sales history is kept while your account is open. It feeds the velocity calculation for as long as you use the product, so it is not aged out on a schedule.
How it goes
Two routes. Settings then Account in the app removes your account and everything stored about your store at once: the Shopify connection and its access token, every SKU, sales record, alert and report. Any active Shopify charge is cancelled first.
Uninstalling from your Shopify admin ends billing. Shopify's data-erasure request, about 48 hours later, deletes the store's data here automatically. There is no separate archive held back.
The data processing agreement, and what is not in place yet
There is no standing DPA to download today. If your store, a client's store or your counsel needs one signed, ask and we will work through it with you. We would rather say that than publish a template nobody has reviewed.
Four other things a formal review asks for are also missing. There is no independent security audit or certification such as SOC 2 or ISO 27001. There is no single sign-on. There is no two-factor authentication: sign-in is email and password. And there is no choice of data region.
Those are real gaps for a buyer with a security questionnaire. We name them rather than imply a standard we do not meet.
This page describes how the product handles data. It is not legal advice, and it does not decide what your own obligations are.
Questions
Which third parties does my store's data pass through?
Three, and only three. Shopify, because it is the source of your products, inventory and orders and the biller of your subscription. Amazon Web Services, which hosts the app and its Postgres database and sends reorder alert and account email through Amazon SES. Slack, which receives reorder alerts at an incoming webhook, and only if you enable Slack alerts yourself.
Where is my store's data kept?
On Amazon Web Services, in a single region alongside the app. Pages are served through CloudFront, and the Postgres database stays in its region. There is no choice of data region today, so if your policy requires a specific one, ask which region is in use before you install.
Do you store any of my customers' personal data?
No customer names, addresses or payment details are stored. From your orders, Restoc keeps sales quantities and dates per SKU with the Shopify order reference, because that is what the sales velocity window is calculated from. Payment details for your own subscription stay with Shopify, since the charge sits on your Shopify invoice. The only personal data held about a person is your own account record: name, email address and a hash of your password.
Does Restoc record what I do in the app?
One narrow thing. It records which setup steps your account has reached, account created, store connected, first sync, first lead time saved, and when it reached each. That is how a setup that stalls halfway gets found and fixed instead of sitting broken. There is no record of pages viewed or buttons pressed beyond those steps, and the list in the first section is everything stored.
How long is sales history kept?
While your account is open. Sales history feeds the velocity calculation for as long as you use the product, so it is not aged out on a schedule. Deleting your account removes all of it at once. If your retention policy needs a fixed deletion schedule instead, raise it when you ask about the agreement.
What happens to my data when I uninstall or close the account?
Settings then Account in the app deletes your account and everything stored about your store at once: the Shopify connection and its access token, every SKU, sales record, alert and report, including the setup-step record. Any active Shopify charge is cancelled first. Uninstalling from your Shopify admin also ends billing, and Shopify's data-erasure request about 48 hours later deletes the store's data here automatically. Nothing is archived after that.
Under GDPR, who is the controller and who is the processor?
That determination is for your own counsel, not for us to assign on your behalf. What we can give you is the factual basis for it. Restoc reads your store's products, inventory levels and orders because you connected the store and granted the access token, and it reads nothing else. Access ends when you delete your account in the app, or when you uninstall from your Shopify admin, where Shopify's data-erasure request about 48 hours later deletes the store's data here. The data read, the purpose of each field and the three services involved are all set out on this page.
Do you have a data processing agreement I can sign?
Not as a standing document today. Ask, and we will work through one with you. Until it is signed, treat this page as a description of the arrangement rather than the agreement itself. If your review also asks about SOC 2, SSO or two-factor authentication, the answer is no to all three today, and the page on what Restoc stores and how it is deleted says so with the detail a security reviewer wants.