StaxStax — Privacy & Data Handling
What customer data we process
Stax operates at Level 1 protected customer data. For each subscriber it processes and stores only the Shopify customer identifier (GID) — e.g. gid://shopify/Customer/123.
It does not collect, store, read, or display any customer name, email address, phone number, or shipping/billing address, and it does not read the Shopify Customer object. Where a merchant needs a subscriber’s real identity, the app deep-links to the merchant’s own Shopify admin customer page; the identity is shown by Shopify under the merchant’s permissions and never passes through Stax.
| Data | Stored? | Purpose |
|---|---|---|
| Customer GID | Yes | Map a Shopify subscription contract to its local mirror record |
| Subscription contract GID, status, next-billing date, cycle quantities, prices | Yes | Orchestrate recurring billing (re-tier pricing, free shipping, dunning) |
| Name / email / phone / address | No | Reached via native-admin deep-link instead |
Why we process it (purpose & legal basis)
The customer GID is processed solely to operate the subscription the customer chose: to identify their contract, compute the correct recurring price, apply free shipping, attempt the recurring charge, manage retries on payment failure (dunning), and show the merchant their subscriber list. Legal basis: performance of the subscription contract the customer entered into. We do not use the data for marketing or profiling, and we do not sell customer data.
Retention
The customer GID and mirror records are retained only for the life of the subscription relationship, and are deleted on a Shopify customers/redact request (per-customer erasure) and on a Shopify shop/redact request / app uninstall (all of that shop’s data). The local mirror is disposable — Shopify is the system of record — so deleting it leaves no residual customer data in the app.
Security
Customer data is encrypted in transit (TLS/HTTPS for all API and webhook traffic) and encrypted at rest (Render managed PostgreSQL, encrypted at rest by default).
Subprocessors
| Subprocessor | Role | Customer data exposed |
|---|---|---|
| Shopify | Platform / system of record | All (the source) |
| Render | App + worker hosting, managed PostgreSQL | Customer GID only |
| Sentry | Error & performance monitoring | GID only — PII is redacted from all telemetry (no name/email/address) |
Merchant data-protection terms
By installing Stax, the merchant agrees to this policy and the app’s data-protection terms: the app processes the limited customer data above only to provide the subscription service to that merchant’s store, acts as the merchant’s processor for that data, honors Shopify’s mandatory privacy webhooks, and applies the deletion and security commitments stated here.
Customer rights
Erasure and data-access requests are fulfilled through Shopify’s mandatory privacy webhooks (customers/data_request, customers/redact, shop/redact), which the app implements. Because the app stores only the GID, a data-access request surfaces a correspondingly minimal record to the merchant for delivery to the data subject.