Security and incidents

The Profit Dashboard works on orders. From an order Shopdeck keeps the amounts, the products, the discount, the date, the country of the shipping address and Shopify’s customer id — a number, so a repeat buyer can be recognised as the same buyer. That is the whole list.

• Not stored: names, e-mail addresses, phone numbers, street addresses, payment details. Shopdeck never asks Shopify for them, and when it did receive one by accident it would have nowhere to put it: the tables have no such columns.
• Visitors on your shop are recorded as an anonymous id in the browser, the page they are on, the country and the channel they came from. No name, no e-mail, no IP address is kept. The tracker only starts after the visitor has accepted cookies on your shop.
• Ad accounts: campaigns, spend and results. No audience lists, no customer files.

When Shopify asks why your app needs protected customer data, the honest answer is one word: Analytics. Shopdeck sends nothing to customers and personalises nothing for them.

• One database in the EU. Everything is stored in a Supabase Postgres database in Frankfurt (AWS eu-central-1), on a paid plan with daily backups. Backups are encrypted and kept for seven days.
• Encrypted at rest and in transit. Disks are encrypted (AES-256); every connection — browser to Shopdeck, Shopdeck to the database, Shopdeck to Shopify, Meta or TikTok — is HTTPS/TLS.
• Your keys are encrypted twice. The Shopify token and the ad-account tokens you paste into Setup are encrypted with a key that lives only in the server’s environment, on top of the database’s own encryption. Nobody reading the database sees a usable token.
• Walls between workspaces. Every row belongs to one workspace, and the database itself refuses a query that reaches into another one (row-level security). This is enforced by the database, not by the code that asks — a bug in a screen cannot cross it.
• Who can see what. Only members of your workspace see its data, and only the Owner and Admin roles can see or change the connections and keys. See Account, workspace and team for the four roles.
• Passwords are at least ten characters and are handled by Supabase Auth; Shopdeck never sees or stores a password itself.

• Visitor events (what someone did on your shop) are deleted after 30 hours. The Live page only ever needs today.
• Orders, products and ad results are kept for as long as your workspace exists — they are the history your reports are made of.
• Disconnecting a source removes its keys at once. Deleting the workspace (Settings → Danger zone) removes everything it held, including every order and every visitor. The full text is on the Privacy page.
• Nothing is sold, shared or used to train anything. Shopdeck has no advertising partners and no data buyers.

An incident is anything that could expose data to someone who should not see it: a leaked key, a bug that shows one workspace another’s numbers, a breach at a provider Shopdeck depends on. This is the procedure, in the order it runs.

1. Contain, within hours

   Stop the exposure first: revoke and rotate the affected keys (Shopify, Meta, TikTok, the encryption key, the database credentials), take the affected screen or endpoint offline if that is what it takes. Every deploy is reversible in minutes, so a faulty version is rolled back rather than patched under pressure.

2. Understand, within a day

   Work out what was reachable, by whom, for how long, and which workspaces are affected — from the database’s audit rows, the request logs and the provider’s own notices. Written down as it is found, not reconstructed afterwards.

3. Tell the people affected, within 72 hours

   Every affected workspace owner receives an e-mail naming what happened, what data was involved, what has been done, and what they should do — rotating a Shopify app secret, for instance. Where the law requires it, the relevant supervisory authority is notified in the same window. Nobody hears about it from somewhere else first.

4. Fix the cause and write it down

   The underlying fault is fixed, a test is added that would have caught it, and a short account of the incident — cause, impact, timeline, fix — is kept. If it changes anything on this page, this page changes.

When you register your own Shopify app for Shopdeck, Shopify asks you to confirm how the app protects customer data. The answers below describe Shopdeck as it is run; you can give them as your own.

• Data use and reasons: Analytics only. Under protected fields, select Address only (for the country per order); leave name, e-mail and phone unselected.
• Minimum data, stated purposes, limited use: yes — see the first section of this page.
• Consent: yes. The tracker starts only after the visitor’s consent on your shop, and Shopdeck sends nothing to customers. Data is never sold, so an opt-out from sale does not arise.
• Storage: retention periods, encryption at rest and in transit, encrypted backups, a data-loss strategy — yes, as described above.
• Access: access limited to workspace members by the database itself, passwords of at least ten characters, and this incident procedure.

Only apps distributed through the Shopify App Store are reviewed. For an app installed on your own store, completing the form is all Shopify asks — but it does ask that the app’s distribution method has been chosen first. See Connect Shopify.