Privacy Policy
Subflow ("we", "the app") is a subscriptions app for Shopify stores. This policy explains what data the app stores, why, and how long for.
What we store
When a merchant installs Subflow, we store:
- Shop and session data — your
myshopify.comdomain, the access token that lets the app call Shopify on your behalf, and the shop owner's name and email address. - Subscription contracts — for each subscription created in your store: the Shopify contract ID, status, billing frequency, next billing date, recurring total, the products on it, and the subscriber's Shopify customer ID, name and email address.
- Subscriber imports — if you migrate subscribers from another subscriptions app, we store the file you upload and one row per subscriber: the raw line from your export, their email address and delivery address, the product and price, and a description of the card already saved in your store, such as "Visa •••• 4242". This is how the import shows you exactly who will move before anything is created.
- Billing attempts — the outcome of each charge (success, decline reason, retry schedule) and the resulting order ID.
- Subscription history — a log of changes such as skips, pauses, frequency changes and cancellations, and whether the customer or the merchant made them.
- Emails we send — a record of subscription confirmations, payment-failure notices and merchant alerts, including the recipient address and the message content.
What we do not store
We never receive or store payment card numbers or bank details. All charges are executed by Shopify against the payment method the customer already gave your store; Subflow only asks Shopify to create the charge and records the result.
Why we store it
Solely to operate the service: to charge subscriptions on schedule, to show you your subscribers, to let your customers manage their own subscriptions, and to notify you and them when a payment fails. We do not sell this data, do not share it with advertisers, and do not use it to train models.
Who we share it with
- Shopify — the source of, and system of record for, all subscription and customer data.
- Resend (email delivery) — recipient address and message content, only for messages the app sends on your behalf.
- Fly.io (hosting) — data is stored in a Postgres database in the United States (
iad).
How long we keep it
- Email bodies are cleared after 30 days; the send record after 90 days.
- Subscription history is kept for 12 months.
- A finished subscriber import is deleted after 12 months, along with every row in it. An import you have not finished is kept until you do, however old it is — deleting it would leave the subscribers in it stranded halfway.
- Subscription contracts and billing records are kept for as long as the app is installed, as they are the financial record of what was charged.
- When you uninstall, Shopify sends a shop-redaction request 48 hours later and we delete all of your shop's data.
Your customers' rights
We implement Shopify's mandatory privacy webhooks. When a customer asks your store for their data, we compile everything Subflow holds about them and send it to you. When a customer asks to be erased, we delete their personal data from our records. You do not need to contact us for either — Shopify triggers both automatically.
Security
All traffic is served over HTTPS. Data is isolated per shop: every query is scoped to the shop it belongs to, and the customer portal additionally verifies that a subscription belongs to the logged-in customer before showing or changing anything. Application secrets are stored in the hosting platform's encrypted secret store. Shopify access and refresh tokens are stored in the application database with access restricted to the running service and database operators; database connections and all network traffic are encrypted in transit.
Contact
Questions, data requests or complaints: privacy@subflow.store. We respond within 30 days.