RestoreKit privacy policy

What RestoreKit keeps

RestoreKit backs up a store's products, variants, collections, metafield and metaobject definitions, metafields and metaobjects. It keeps each one as it was at every snapshot, and the references between them, so that it can compare them with the store, restore them and re-link what pointed at them.

It keeps a record of each restore, re-link and undo: what Shopify held just before it, what it wrote, and what Shopify held after it. That record is what an undo writes back.

It keeps the store's domain, name, currency and time zone, and the access token Shopify gives it when it is installed.

It keeps the ID of a customer, a company or an order only where the merchant put one in a reference field of one of the objects above. The ID is part of that field's value, so it is kept where the value is: in snapshots and in restore records. RestoreKit keeps the ID and nothing else about that customer, company or order.

What RestoreKit does not do

It asks Shopify for no access to customers or orders, and it reads no customer records.

It does not sell what it keeps, and does not share it with anyone.

It uses what it keeps only to back up and restore the store it came from.

How long it is kept

What the store holds now is kept for as long as RestoreKit is installed. History, meaning the versions the store has since replaced and the objects deleted from it, is kept for at least 7 days on the Free plan and 90 days on the Standard plan, and for no more than 90 days on either. After that, the nightly snapshot removes it. A version that is the only record of what pointed at a deleted object is kept for as long as that object is.

When a store stops paying for Standard, its history is kept as Standard keeps it for 30 days after RestoreKit last saw it paying, and is then shortened to 7 days. When RestoreKit cannot learn from Shopify whether a store is paying, it keeps history as Standard does, because what is removed cannot be brought back.

Restore records are kept for as long as RestoreKit is installed.

When a store uninstalls RestoreKit, the access token is deleted at once and nothing more is read from the store. Its snapshots and restore records are kept until Shopify sends shop/redact, 48 hours after the uninstall, and a store that reinstalls before then finds them where they were. shop/redact deletes everything RestoreKit holds for the store, whether or not it has been reinstalled since, except the record that each request was carried out, which names no customer.

Requests about a customer

When a customer asks a store for their data, Shopify sends customers/data_request, and RestoreKit finds every snapshot and restore record that holds that customer's ID, so that it can be given to the store.

When a customer asks to be erased, Shopify sends customers/redact, and RestoreKit takes that customer's ID out of every snapshot and restore record. A list that named them keeps the rest of its entries, and a single reference is left empty.

RestoreKit keeps a record that each request was carried out. It names the store and the kind of request, never the customer.

Questions

Write to the contact address on RestoreKit's Shopify App Store listing.