Privacy Policy

Last updated: 2026-08-14

Anchor Subscriptions ("Anchor", "we", "us") is a Shopify app that enables merchants to manage subscription contracts. This policy explains what customer data we access, how we use it, and how we protect it.

1. Data controller and contact

Anchor Subscriptions acts as a data processor on behalf of the Shopify merchant who installs the app. The merchant is the data controller for their customers' data. For privacy-related requests, contact privacy@anchor-subscriptions.com.

2. Data we access

With merchant consent (granted at app install via Shopify scopes), Anchor accesses the following customer data through the Shopify Admin API:

• Customer name — to display the subscriber in the merchant admin and in dunning emails.
• Customer email address — to send transactional subscription emails: payment recovery notifications when a recurring charge fails, and lifecycle notices (subscription created, upcoming renewal, renewal confirmed, paused, resumed, skipped, cancelled). We never send marketing email.
• Customer shipping address, including the contact phone number it carries — to populate the shipping address on orders generated by subscription contracts, to show it to the merchant on the subscription detail view, and to let the subscriber correct it from the customer portal. Carriers require a contact number for delivery in several countries.
• Subscription contract metadata (status, next billing date, line items, billing attempts) — to mirror Shopify's state and render the merchant admin views.

We never store any of the above. Customer name, email, shipping address and phone number are read from Shopify at the moment they are needed and discarded once the request is served (see section 3).

We never receive payment card details at all: Shopify handles all payment processing and charges subscription contracts on our behalf. The one remaining piece of technical data we touch is the visitor IP address on requests to our storefront analytics endpoint, which is used in memory to rate-limit bursts and is never stored, logged, or associated with a customer.

3. How we store data

Anchor follows a strict data minimization principle. We persist only Shopify resource identifiers (customer GID, contract GID, order GID) and the outcomes of subscription events (success / failure / status changes). We do not store customer names, emails, addresses, phone numbers, or payment data in our database.

When customer information is needed (to render an admin page or compose an email), we fetch it on-demand from the Shopify API, use it during the single request, and discard it afterward. The information transits through our servers in memory only and is never written to logs or third-party analytics.

4. Data retention

Subscription contract metadata is retained for the lifetime of the merchant's installation of Anchor. Upon uninstall, all merchant data is purged within 48 hours, except where law requires extended retention (e.g., dispute resolution).

5. Sub-processors

We use the following sub-processors to operate the service. All those that can touch customer data are SOC 2 Type II certified.

• Vercel Inc. — hosting and serverless functions execution, and cookieless page metrics (Vercel Analytics) on our own pages. DPA
• Supabase Inc. — PostgreSQL managed database (stores only subscription metadata). DPA
• Functional Software, Inc. (Sentry) — error monitoring, configured to never capture customer PII. DPA
• Resend, Inc. — transactional email delivery for payment recovery and subscription lifecycle notifications. DPA
• Cloudflare, Inc. — CDN and DDoS protection (transitive via Vercel). DPA
• Healthchecks.io — uptime monitoring of our scheduled jobs. Receives a job name and a success or failure signal, and no customer data of any kind. Privacy

6. Security

All connections use TLS 1.3. Secrets are stored encrypted in our hosting platform's environment variable store and never committed to source control. Database connections use pgBouncer transaction pooling over TLS. Source code is in a private repository. Sentry error capture is configured with sendDefaultPii: false on both the server and the browser bundle, so request headers, cookies, IP addresses and user identifiers are never attached to an error event, and errors are reported with operational context only (shop domain, Shopify resource identifiers, error message).

7. Customer rights (GDPR, CCPA)

Customers can exercise the following rights by contacting the merchant who installed Anchor (the data controller). The merchant can relay the request to us via Shopify's standard compliance webhooks:

• Right of access — request a copy of stored data. Anchor responds within 30 days via customers/data_request webhook.
• Right to erasure — request deletion of stored data. Anchor purges within 10 days via customers/redact webhook.
• Right to portability — receive data in a machine-readable format. Available via the data_request endpoint.

Because Anchor only stores Shopify resource identifiers (no PII), most erasure requests result in nullifying our internal reference to the customer; the actual customer record remains with Shopify.

8. Shop data deletion

When a merchant uninstalls Anchor, Shopify sends a shop/redact webhook 48 hours later. Upon receipt, we delete all data associated with that shop (subscription contracts, billing history, webhook event logs) from our database. Sentry error events related to the shop are retained for 90 days as per Sentry's default retention, then deleted.

9. Cookies

Anchor does not set tracking cookies. Authentication uses Shopify session tokens (JWTs) passed via the App Bridge.

10. Changes to this policy

We may update this policy. Material changes will be announced via email to installed merchants. The "Last updated" date at the top reflects the most recent revision.

11. Contact

For any privacy question or to exercise your rights: privacy@anchor-subscriptions.com.