Data Deletion

There are two routes, and they do different things.

Uninstall the app. In your Shopify admin, go to Appsand uninstall Shop Buddy. This starts Shopify's own deletion lifecycle and ends with your store's data being deleted — see section 2 for the two steps and what happens in each.

Email us. If you want your data deleted sooner than the uninstall lifecycle would do it, or deleted without uninstalling, write to support@softora.store or support@softora.store from an address associated with the store, and tell us your store domain (for example your-store.myshopify.com) and what you want removed.

Being straight about this: there is no self-service "delete all my data" button in the app today. A request by email is carried out by hand by our team. We will confirm to you when it has been done.

Uninstalling triggers two separate events from Shopify, and only the second one deletes anything.

Immediately, on uninstall.Shopify notifies us and the app deletes the store's widget API keys, discards the Shopify access token it was using, and marks the store inactive. From that moment the storefront chat widget stops working, the app can make no further calls to your Shopify store, and scheduled jobs skip the store entirely — so no cart-recovery or other automated emails go out. Nothing is deleted at this point. It is a soft switch-off: your catalog index, knowledge base, settings, conversations and analytics all still exist.

About 48 hours later. On Shopify's schedule, Shopify sends the app a shop/redactrequest. That is what performs the deletion: the store record is deleted and every store-scoped record goes with it — products and their embeddings, knowledge-base entries and store policies, bot configuration, conversations and their messages, cart snapshots, behavioural events, support requests, feedback, logged unanswered questions, order-attribution records, and the store's audit and system logs.

The only thing that survives is platform-level system log entries that are not attached to any store — operational records of the app as a whole, which contain no store or shopper data. Those age out on the schedule in section 5.

If you reinstall within that window, you reinstall onto the same store record and your settings and knowledge base are still there.

This is the part that matters most, so here is the mechanics of it rather than a reassurance.

The chat widget is anonymous. Each shopper's browser is given a random session identifier which is kept in that browser's local storage, and everything the app stores about a chat is keyed to that identifier. The app never receives or stores a Shopify customer ID.So when Shopify asks us to delete a named customer's data, there is no direct link from that customer to any record we hold.

There are exactly three ways an anonymous session becomes connected to something Shopify can name, and in all three the shopper volunteered it:

• They typed their email address into the widget's cart-recovery prompt, so a cart snapshot carries both their email and their session.
• They filled in the "talk to a human" support form, which carries their email and points at the conversation it came from.
• They placed an order that was matched back to a chat session, so an attribution record links a Shopify order id to that session.

When we can match a customer through one of those routes, a deletion request removes, for that store: the linked conversations and every message in them, support requests carrying that email, cart snapshots matching that email or session, behavioural events, feedback, logged unanswered questions, and order-attribution records for those orders and sessions. Email matching is case-insensitive, and the request is scoped to the one store it came from — the same shopper's data on a different merchant's store is that merchant's and is not touched.

The limit, plainly: a shopper who only ever chatted anonymously cannot be matched.No email given, no support request, no matched order means there is nothing that ties any of the store's anonymous sessions to that person, and a deletion request for them will honestly delete nothing — not because we declined it, but because we cannot tell which records are theirs. That data is removed instead by the retention schedule in section 5, which deletes it on age regardless of who it belongs to.

Two related consequences, for completeness:

• Multiple devices. Session identifiers are per-browser. Someone who chatted on their phone and bought on their laptop only has the sessions we can prove are theirs deleted. Deletion is best-effort across devices.
• Shared devices. A household or in-store tablet can put more than one person behind one session. For deletion that errs towards removing more than strictly required, which is the safer direction.

The app stores no shopper phone number anywhere, so a phone number is never used for matching.

Shop Buddy implements Shopify's three mandatory privacy webhooks. Each one verifies Shopify's signature before doing anything, and rejects an unsigned or wrongly signed request.

Separately from uninstalls and deletion requests, a job runs once a day and deletes shopper data that has passed the age limit for its type. It applies to every store. These are the windows the app actually enforces:

• Conversations and their messages — 180 days, measured from the last message in the conversation.
• Feedback on an answer — 180 days, kept in step with the conversations it rates.
• Cart snapshots, including any shopper email held for cart recovery — 90 days from the last time the cart changed.
• Behavioural events — 90 days.
• Unanswered questions — 180 days while still awaiting your review, 90 days once you have approved or dismissed them.
• Support requests — 365 days after the request is marked resolved. Open and in-progress requests are never deleted by age.
• System logs — 90 days.

Two things are deliberately kept for as long as the store exists. Order-attribution records hold a Shopify order id and an anonymous session id, and exist so your revenue reporting stays consistent year over year — but they are deleted on a shopper deletion request, and they go when the store is deleted. The audit trail of administrative actions is kept because its purpose is to record who did what, including that a deletion was carried out; purging it would defeat the point. It too is deleted with the store.

Your own content — catalog index, knowledge-base entries, store info and bot settings — is not aged out. It stays until you delete it, or until the store's data is deleted.

The job works in batches so that a single run cannot stall. If a large backlog has built up, it is cleared over several daily runs rather than all at once.

Deletion requests, and any question about what is held or what was deleted: support@softora.store. General support: support@softora.store, which will route a privacy request for you if you are not sure where to write.

Please include the store domain. For a request about a specific shopper, the email address they used and the rough date of the conversation give us the best chance of finding the records — see section 3 for why.

Shoppers: the merchant whose store you were shopping on is the controller of your data. You can raise a request with them, or through Shopify, and we act on it. Shop Buddy is operated by Softora. Our Privacy Policy sets out what is processed and why, and our Contact page lists every route to us.