Last updated: 2026-06-28
Winback IQ ("the App", "we", "us") is a Shopify embedded app that computes an RFM
(Recency / Frequency / Monetary) segmentation of a merchant's customers from the
merchant's own Shopify order history, and — for paying merchants — writes a
segment tag back to Shopify customers. This policy explains exactly what the App
accesses, what it stores, and your rights. It is grounded in what this specific
app does — not a generic template.
This policy applies to the Shopify merchant who installs Winback IQ ("you") and
to the merchant's customers whose order data the App processes on the merchant's
behalf. For that processing, the merchant is the data controller and Winback
IQ is a data processor.
Winback IQ requests the minimum Shopify Admin API scopes it needs:
| Scope | Why |
|---|---|
| read_orders | Read the order history (each order's creation date, the customer's opaque ID, and the order total in the shop's currency) to compute Recency, Frequency and Monetary signals. |
| read_customers | Resolve the opaque Shopify customer ID attached to each order (the key the worklist and segments are built on). |
| write_customers | Pro only. Add a single non-destructive tag (WinbackIQ:<Segment>) to a customer so the merchant can target each cohort in Klaviyo / Shopify Email / SMS. It never reads or modifies any other customer field. |
The App is GraphQL-only on Admin API version 2026-04. It does not use the
REST API and requests no other scopes.
Because the App requests read_customers and read_orders, Shopify classifies
it as a Protected Customer Data — Level 2 (customer identity) app at the
access boundary, and a Protected Customer Data review is completed in the Shopify
Partner Dashboard before listing. In practice the App reads only the **opaque
customer ID** (never name, email, phone or address fields), and the storage
boundary is "aggregate-and-discard" (section 4) — so no protected personal
fields are ever retained.
The analysis worker reads orders and customer identifiers transiently,
derives the aggregate scores, and then discards everything except:
customer in your own Shopify admin and, on Pro, to write back the segment tag;
count, total spend (shop currency), the R/F/M scores 1–5, the lifecycle
segment, and the revenue at risk;
the deterministic "as of" date;
token (AES-256-GCM at rest), billing/subscription status, and an idempotency
ledger of inbound webhook IDs.
We never store, log, or transmit to any third party: customer names, email
addresses, phone numbers, shipping or billing addresses, payment details, or
individual order line items.
Solely to provide the App's functionality to you: compute the RFM segmentation,
render the dashboard / worklist / insights, and (on Pro) write the segment tag
back to your Shopify customers and produce a CSV export you request. We do not
sell data, do not use it for advertising, and do not combine it across merchants.
running PostgreSQL and Redis. Data stays on this host.
arithmetic — no large-language-model or other AI sub-processor is involved, and
no data is sent to any AI provider.
We will keep this list current; we do not add a sub-processor that receives
customer data without updating this policy.
available across runs.
app/uninstalled we mark your shop inactive. On Shopify's shop/redact request (~48 hours after uninstall) we cascade-delete every row
for your shop.
customers/redact we delete that customer'saggregate rows by opaque ID.
customers/data_request we confirm that we holdonly an opaque ID and aggregate scores for the customer — there is no personal
data to assemble.
For EU/UK data subjects, the merchant (as controller) can exercise access,
rectification, erasure, restriction and portability rights via Shopify's
mandatory compliance webhooks above, which the App honours automatically. Because
we hold no personal identifiers beyond an opaque ID, most requests resolve to "no
personal data held" or a targeted aggregate deletion.
Offline access tokens are encrypted at rest (AES-256-GCM). Transport is HTTPS
only. Webhooks are HMAC-verified and de-duplicated. The database runs behind a
connection pooler with least-privilege credentials.
We will update this policy as the App changes and revise the "Last updated" date.
Questions or a data request: privacy@syncerp.work.
The in-app disclosure lives at https://winbackiq.syncerp.work/docs/protected-customer-data.