GDPR and your data
Last updated: September 23, 2026
How NexRetain handles personal data under the EU and UK GDPR, and how we meet Shopify’s privacy requirements. For the full picture, read our Privacy Policy.
1. Controller and processor
For personal data in your Shopify store, such as your customers’ details, you (the merchant) are the controller and NexRetain is your processor. We process that data only to provide the App to you, as described in our Privacy Policy. For merchant account details and Website form submissions, NexRetain is the controller.
2. Shopify’s mandatory privacy webhooks
NexRetain subscribes to all three of Shopify’s mandatory privacy webhooks:
| Webhook | When Shopify sends it | What we do |
|---|---|---|
customers/data_request | A store’s customer asks the store for their data. | We compile the data we hold about that customer for the store to provide to them. |
customers/redact | A store asks for a customer’s data to be deleted. | We delete that customer’s personal data from NexRetain. |
shop/redact | 48 hours after a store uninstalls the App. | We delete the store’s data, including access tokens, settings and synced records. |
We complete these requests within 30 days of receiving them.
3. Deletion on uninstall
When you uninstall NexRetain, we stop syncing your store immediately and delete your store’s data when Shopify sends the shop/redact request. Want it deleted sooner? Email support@nexretain.com from the store owner’s email address.
4. Making a data request
- Merchants and Website visitors: email support@nexretain.com to access, correct, export or delete your data. We reply within 30 days and may ask you to confirm your identity.
- Customers of a store using NexRetain: contact the store directly. It can make the request through Shopify, which forwards it to us automatically.
5. Security
- Read-only access to store data.
- Shopify and ad-platform access tokens encrypted when stored.
- Encrypted connections (HTTPS/TLS) for all data in transit.
- Production access limited to people who need it.
6. Subprocessors
| Subprocessor | Purpose |
|---|---|
| Shopify | App platform, store data source and billing |
| Google (Gemini API) | AI processing of store-level metrics for NexRetain Intelligence |
| Cloud hosting and database provider | Running the App and storing its data |
| Email delivery provider | Email reports, service emails and support replies |
| Vercel | Website hosting and form handling |
Ad platforms you connect (Meta, Google Ads, TikTok) are data sources you authorise, not subprocessors. We will update this list before adding a new subprocessor.
7. Data Processing Agreement
Need a Data Processing Agreement for your records? Email support@nexretain.com.