Who we are
We are Storeassist (storeassist.io). Email questions about personal data to support@storeassist.io.
Storeassist is an app for Shopify stores. It creates invoices and bookkeeping in Fortnox or Spiris and handles purchasing, stock, picking, packing and shipping, a customer club, staff and a workshop. It runs inside Shopify, as a web app on app.storeassist.io and as a mobile app.
Our two roles
For data about your customers, employees and suppliers, and stored data about B2B buyers, you as the merchant are the controller and we are your processor. We process that data only on your instructions, under our Data Processing Agreement.
For user accounts, sign-in and security, and for our dealings with you as a customer, we are the controller.
Data about your customers
Storeassist reads most data from Shopify when you need it and stores only what a feature requires. It may process the following about your customers:
- Contact details: name, email, phone, billing and shipping address, company name and registration number.
- Orders: products, amounts, discounts, payments, returns and refunds.
- Invoicing: what we send to and receive from Fortnox or Spiris, and the link between the Shopify customer and their customer number in your accounting.
- Customer club: customer ID, member number, points, total spend, birthday if the customer gave it, marketing consent and points history.
- Stored data from B2B storefronts, which are not part of Storeassist today: company, the buyer's name and email, delivery addresses with a contact person, orders, and hashed sign-in codes and sessions.
- Workshop: the customer's name, phone, email, item, notes, photos, signatures, notifications and answers to estimates, with a hash of the IP address when the answer comes through a link.
- Shipping: the receiver's name, address, phone and email, tracking events and shipping labels.
- Text messages: the recipient's number, and the text until the message is sent. They are used for workshop notifications and notices to employees, and numbers that opted out are kept.
- Suppliers: the contact person's name, email and phone, notes, and replies and uploaded files through the supplier portal.
The data comes from Shopify, from you and your staff, from suppliers who use the supplier portal, from customers who join the customer club or answer an estimate, and from carriers.
Data about you and your staff
- Account: email, name, language, password hash (argon2id), encrypted two-step verification key, hashed recovery codes and the role in each store.
- Sign-ins: hashed session tokens, device name, platform and app version, hashed device ID, and timestamps.
- When the app opens in Shopify: Shopify's session data, which can include the staff member's name and email.
- Traceability: the name of who did something, such as a stocktake, a points adjustment or a work order.
- Employees, if you use the Staff module: name, email, phone, personal ID number and bank account (encrypted), employment type, pay, clock-ins, timesheets, schedules, absence including sick leave, commission and sales per person. For this data you are the controller and we are your processor.
- Audit log: who opened or changed customer data and when, which record and which fields, the IP address shortened to its network, and a hash of the browser's user agent.
- Acceptances: which version of the terms and the Data Processing Agreement was accepted, when and by whom.
- Support: chats and email with us, your name and email, the store, attachments, ratings, the AI assistant's answers and what it looked up, and support access you granted. For website visitors who are not users: a random chat ID and the email address if you give it.
Purposes and legal basis
Where we are the processor, you decide the purposes and the legal basis. We process the data to deliver the features you use: invoicing and bookkeeping, customer club, purchasing, stock, picking, packing and shipping, labels, reports, staff and payroll, workshop, and notifications by email, text message and push.
Where we are the controller, the following applies under the General Data Protection Regulation (GDPR):
| Purpose | Data | Legal basis |
|---|---|---|
| Give you and your staff accounts and sign-in | Account and sign-in data | Contract with you (Art. 6(1)(b)). For your staff: our and your legitimate interest in secure access (Art. 6(1)(f)). |
| Send sign-in codes, password links, invitations and new-device notices | Email, name, language | Contract (Art. 6(1)(b)) and legitimate interest (Art. 6(1)(f)). |
| Protect the service, detect abuse and investigate incidents | Audit log, sign-ins, hashed rate-limit keys | Legal obligation to protect the data (Art. 6(1)(c) and 32) and legitimate interest (Art. 6(1)(f)). |
| Show that the terms and the Data Processing Agreement were accepted | Version, time, user, IP address | Legal obligation (Art. 5(2) and 28) and legitimate interest (Art. 6(1)(f)). |
| Answer support requests in the chat and by email | Messages, attachments, account and store details and the store's technical state (errors and sync status) | Contract with you (Art. 6(1)(b)). For visitors who are not customers: legitimate interest (Art. 6(1)(f)). |
| The AI assistant in the support chat | The conversation and the store data the assistant looks up for the question | Legitimate interest (Art. 6(1)(f)). A person can always take over. |
| Help in your store when you grant us access | The access level and time, the staff member and what was done | Contract with you (Art. 6(1)(b)). |
| Extend trials | Store, number of days, reason and staff member | Contract with you (Art. 6(1)(b)). |
How long we keep data
Shopify sends shop/redact 48 hours after you uninstall the app, and we then delete the store's data. The exceptions are in the table: proof of requests from Shopify, the install record, used trials and our staff's log.
If the app has been installed again we erase nothing, because Shopify sends a new request after the next uninstall. If we can't tell whether the app is still there, we wait up to 14 days. At the uninstall itself we immediately delete sessions, access keys and queued jobs, and suspend staff access.
| Data | How long | How it is deleted |
|---|---|---|
| Shopify sessions, including the name and email of staff who open the app in Shopify | Until the app is uninstalled | Deleted as soon as Shopify reports the uninstall. |
| Access keys for accounting (Fortnox and Spiris), payroll and carriers | Until you disconnect or uninstall | Deleted when you disconnect, and immediately on uninstall. |
| The invoice log: what we sent to and received from your accounting, with the customer's name, address and email | Personal data: until the customer is deleted. Accounting data: until the store is deleted | Not deleted when Shopify sends customers/redact, but scrubbed: name, address, email, comments and line descriptions are removed. What credits and reconciliation need stays, such as document number, customer number, order number, dates, article numbers, accounts, VAT and amounts. Everything is deleted at shop/redact. |
| The link between a Shopify customer and their customer number in your accounting | Until the customer or store is deleted | Deleted when Shopify sends customers/redact or shop/redact. The customer number can remain in the invoice log. |
| Customer club members: customer ID, member number, points, spend, birthday, marketing consent and points history | Until the customer or store is deleted | Deleted when Shopify sends customers/redact or shop/redact. |
| Stored data from B2B storefronts, which are not part of Storeassist today: companies, buyers, addresses and orders | Until the customer or store is deleted | When Shopify sends customers/redact, the buyer's name, address and Shopify link are removed and the buyer is blocked; amounts and order lines stay. Everything is deleted at shop/redact. Other erasure of a single buyer we carry out on request within 30 days. |
| Stored sign-in codes and sessions from B2B storefronts, as hashes | Until the customer or store is deleted. No new ones are created | Deleted when Shopify sends customers/redact or shop/redact. |
| Suppliers, their contact people, and replies and uploaded files through the supplier portal | Until you remove the supplier or the store is deleted. Uploaded files never submitted: until the link expires | You remove the supplier in the app; everything is deleted at shop/redact. Files never submitted are deleted automatically. |
| Original imported files (cost prices, payout files, purchasing imports) | 90 days | Deleted automatically by the storage and a daily cleanup, and at shop/redact. |
| Stored images from B2B storefronts (logo, hero image), public to anyone with the link | Until the store is deleted | Deleted at shop/redact. |
| Bookkeeping evidence (PDF) and other store data such as purchasing, stock and stocktakes with the name of who did it | While the store uses Storeassist | Deleted at shop/redact. Export anything Swedish bookkeeping law requires you to keep before you uninstall. |
| Email sent in the store's name (proformas, invitations, notices about customer exports) and stored email from B2B storefronts | Until the recipient or store is deleted | Deleted for the address when Shopify sends customers/redact, and entirely at shop/redact. |
| Employees in the Staff module: name, email, phone, encrypted personal ID number and bank account, pay, clock-ins, timesheets, schedules, absence and commission | Until you erase the employee or the store is deleted. Payroll exports: 7 years | When you erase an employee in the app, the person is anonymised and the personal ID number, bank account and contact details are removed; clock-ins, timesheets and commission stay as payroll records. Payroll exports are deleted after 7 years. Everything is deleted at shop/redact. |
| Workshop customers: name, phone, email, item, notes, photos, signatures, notifications and answers to estimates | Until the customer or store is deleted | When Shopify sends customers/redact, photos and signatures are deleted and contact details and notes are removed; order number, lines and amounts stay. Everything is deleted at shop/redact. |
| Shipments: the receiver's name, address, phone and email (encrypted), tracking events and shipping labels | Labels: 90 days after booking. Receiver and tracking: 90 days after the final status, otherwise 120 days after booking | Deleted by a daily cleanup and when Shopify sends customers/redact; carrier, service, status, order ID and cost stay. Everything is deleted at shop/redact. |
| Text messages sent: the recipient's number, sender, template and status. The text is deleted once the message is sent or has failed | Until the customer or store is deleted | Deleted for the number when Shopify sends customers/redact, and entirely at shop/redact. |
| Text message opt-out list: phone numbers that opted out | Until the store is deleted | Kept after customers/redact so the opt-out keeps applying. Deleted at shop/redact. |
| Customer club confirmations waiting for an answer: a hashed link and a hash of the email address | 48 hours | Deleted when the link expires, when Shopify sends customers/redact, and at shop/redact. |
| Earlier POS sales on invoice: key, order, document number and result. The feature is no longer offered | 30 days | Deleted automatically, even if the store has stopped selling. Error texts are removed when Shopify sends customers/redact. |
| Export files when a customer has requested their data | 30 days | Deleted automatically, and at once when Shopify sends customers/redact for the same customer or shop/redact. |
| Requests from Shopify about customer data and erasure: type, dates, number of records and a hash of the store | The customer's details are cleared when the request is finished. The row is kept as proof for 24 months | Customer requests are deleted at shop/redact. The shop/redact row is kept for 24 months with a pseudonym in place of the store's name. |
| Install record: a hash of the store's domain, the install generation and timestamps | 730 days after the uninstall, also after shop/redact | A pseudonymous record is kept so that a late event from Shopify can't erase a store that has installed the app again. Uninstall events are kept for 90 days. Deleted by a cleanup. |
| Used trials: the store's domain, module and start date | No end date, also after shop/redact | Kept so the same store can't get a new trial. Not deleted automatically. |
| Email to users about sign-in, passwords and new devices | 30 days | Deleted by a daily cleanup. |
| User accounts: email, name, password hash, two-step key and roles | Until the account is deleted | Users delete their own account. An account that belongs to one store only is deleted at that store's shop/redact. |
| Sign-ins and devices | Web: 12 hours idle, 30 days at most. Mobile: 30 days since last use, 90 days at most | Deleted a day after the session expires or is signed out, by the daily cleanup. |
| One-time codes, device pairings and unanswered invitations | Codes last 10 minutes at most; invitations until they expire | Deleted by the daily cleanup: codes and pairings a day after they expire, invitations when they expire. |
| Background jobs | 30 days after the job finishes | Deleted automatically. Queued jobs are deleted on uninstall. |
| Duplicate-submission guard | 24 hours | Deleted automatically. |
| Audit log of access to personal data (who, when, which record and which fields, never the data itself) | 12 months | Deleted on a rolling basis and at shop/redact. |
| Support cases and email with support: messages, names, email addresses and attachments | 24 months after the case is closed, then the case is anonymised | A daily cleanup removes the text, attachments and who it was about; only status, tags, rating and counts remain. Everything for the store is deleted at shop/redact, and one person's cases are anonymised at once on request or when the account is deleted. |
| Chats with the AI assistant that were never handed to a person | 30 days after the last message, 90 days if you were signed in | Deleted by a daily cleanup. |
| Chat visitors on the website: a random chat ID and the email address if you give it | 9 months after the last visit | Deleted by a daily cleanup once no case with personal data is left. |
| Support access you granted Storeassist | 24 months after the access ended | Deleted by a daily cleanup and at shop/redact. |
| Log of what our staff did, including in your store with your access | 24 months | Deleted by a daily cleanup. At shop/redact the store's name is replaced by a pseudonym and the reasons given are deleted. |
| Trial extensions: store, number of days, reason and staff member | While the store uses Storeassist | Deleted at shop/redact. |
| The AI assistant's usage per day (number of questions and cost, no content) | 13 months | Deleted by a daily cleanup and at shop/redact. |
| Support email we send | 90 days | Deleted by a daily cleanup. |
| Backups of the whole database | 14 days | A nightly encrypted copy on the server and an encrypted off-site copy. Data you delete stays in backups for 14 days at most. Stored files, such as bookkeeping evidence, are not part of the backups. |
| Server logs | Rotated by size, 3 months at most | The application logs record no visitor IP addresses, customer data or link tokens. |
Who we share data with
We never sell personal data or use it for advertising. Our sub-processors, and the services you connect yourself such as Fortnox, are listed on the Sub-processors page.
We disclose data to authorities only when the law requires it.
Transfers outside the EU/EEA
The database and its backups live on encrypted disks at UpCloud in Stockholm. The off-site backup copy is stored in Cloudflare R2 in the EU and is encrypted before it leaves our server. Uploaded files, bookkeeping evidence, shipping labels, workshop photos, payroll exports, customer exports and stored B2B storefront images are also stored in Cloudflare R2 in the EU; Cloudflare encrypts them at rest, but not with our own key. Where a sub-processor is a company outside the EU/EEA, the transfer is covered by the EU Standard Contractual Clauses or the EU–US Data Privacy Framework. The AI assistant in the support chat is run by Anthropic in the USA; that transfer is covered by the EU Standard Contractual Clauses and the EU–US Data Privacy Framework. Push notifications to the mobile app go through Expo in the USA, and that transfer is covered by the EU–US Data Privacy Framework. Address search and maps use open services, one of them in the United Kingdom; they are listed on the Sub-processors page.
How we protect data
- All traffic is encrypted with TLS, and stored data and backups are encrypted.
- Passwords are hashed with argon2id. Owners and admins must use two-step verification, and new devices are confirmed with a code.
- Members with the staff role never see customers' email, phone or addresses. Only admins and owners do, and every such access is logged.
- Stores are separated in every database query, and no store can see another store's data.
- The server can only be reached over SSH with a key from an approved address, behind two firewalls.
The full list of technical and organisational measures is Annex 2 to the Data Processing Agreement.
Website and cookies
storeassist.io uses no analytics or advertising cookies and no analytics tools. Your choice of light or dark mode is saved only in your browser.
The support chat uses one necessary cookie, __Host-sa_visitor, on storeassist.io and app.storeassist.io. It holds a random ID so you see your earlier chats, and lasts 9 months after your last visit. Whether the chat button is hidden or shown is kept in your browser's local storage.
The web app on app.storeassist.io uses one necessary session cookie (__Host-sf_session) for sign-in.
Your rights
You have the right to access your personal data, have it corrected or erased, restrict processing, object to processing based on legitimate interest, and receive your data in a machine-readable format. You can ask us to export or delete your support conversations.
If you shop at a store that uses Storeassist, the store is responsible for your data, so contact the store. If you contact us, we pass your request on to the store. For questions about your user account, email support@storeassist.io. We reply within one month.
Complaints
If you think we process your personal data incorrectly, you have the right to complain to the Swedish Authority for Privacy Protection (IMY), Box 8114, 104 20 Stockholm, Sweden, imy.se. Please contact us first so we can try to resolve it.
Changes
For material changes we email the store owner at least 30 days before they take effect. The date at the top shows which version you are reading.