Data security
What it keeps, and for how long.
RefundSentry links your customers' orders by comparing hashes, never the names, emails or phone numbers themselves. Order addresses and dispute packs are kept encrypted, each for a set time, and a daily job deletes them once that time is up.
The hashes
It matches the hash, not the email.
A hash is a fixed code made from a value. The same email always gives the same hash, so two orders can be matched on the hash alone.
Email
Trimmed and lower-cased, with a +tag and the dots of a Gmail address set aside, then hashed with SHA-256.
Phone
Cut down to its digits, then hashed with SHA-256.
Address
Put in one standard form, then hashed with SHA-256.
Card
The card and the name on it, hashed with HMAC-SHA256 and a secret key.
[email protected]- THE +TAG= [email protected] SHA-2566eb8e3bc abfff027 5e7c03ab 7f0a496b0dc7be70 9f17b0c8 ae35858f a884f745
The customer record holds the email and phone hashes, the email's domain, the Shopify customer ID and its numbers: orders, returns, refunds and disputes. It holds no name, email address or phone number.
Storage
Kept for a set time, then deleted.
- Order addresses. An order's shipping and billing address, street to country, is kept encrypted for 365 days, then deleted.
- Dispute packs. What goes into a dispute pack, and the files you add to it, is kept encrypted for 180 days, then deleted.
- The key. Both are encrypted with AES-256-GCM, and the key is kept outside the database.
- Shopify's messages. A copy of what Shopify sends about orders, fulfillments, refunds, returns, disputes and customers is kept for 365 days, so an order can be scored again from it, then deleted.
- Where it runs. The app runs on Google Cloud Run, in the us-east1 region. The database is PostgreSQL at Neon, which encrypts what it stores with AES-256 and accepts only encrypted connections.
Erasure
When Shopify asks, it deletes.
- A customer. When Shopify sends a customer's erasure request, RefundSentry deletes, in one database transaction, the customer record, the addresses and dispute packs kept for them, their card hashes, their refunds, and the copies of Shopify's messages that carry their email, phone or customer ID. Their past orders stay in RefundSentry's order records.
- A store. 48 hours after a store uninstalls RefundSentry, Shopify asks for the store's data to be erased. RefundSentry then deletes it in one database transaction, unless the store has installed it again.
- You. In Settings, under Plan and data, you can download your returns and refunds, customer profiles and disputes as CSV files, and delete RefundSentry's analysis data.