A CLEAR ACCOUNT OF YOUR DATA
Your data.
Its purpose.
Which information Revuka uses, why it is needed, what can become public and when it is removed.
Reviews, not unrelated reuse.
Merchant customer data is processed to run the review service on the merchant’s instructions. It is not used for advertising audiences, data sales or training AI models.
Public feedback. Private evidence.
A published review can show the chosen display name and review content. The buyer’s email, private purchase references and review-link credentials stay out of the public storefront response.
| Information | Source | Purpose | Public or private? | Retention |
|---|---|---|---|---|
| Store and app accessStore domain, installation reference and dates, granted permissions, encrypted Shopify access/refresh tokens and their expiry. | Shopify installation and authenticated app sessions. | Connect the correct store, authorize its actions and synchronize reviews. | Private. Access tokens are never part of a public review. | For the active installation. Tokens are erased on uninstall; remaining store data follows the deletion workflow below. |
| Order and purchase evidenceShopify order ID, customer ID where available, cancellation/refund/payment status, test-order status and purchase-verification result. | Relevant Shopify order and lifecycle events. | Check eligibility, link feedback to a real purchase, avoid duplicates and stop requests for cancelled/refunded orders. | Private purchase references. They are excluded from the public storefront response. | Can remain with the request or review as purchase evidence until deletion. There is no shorter automatic expiry for these references. |
| Invitation address and languageOrder email address, collection language/locale, scheduled/sent/completed/expiry dates, request state and reminder count. | The Shopify order and Revuka’s request workflow. | Deliver the review request in a supported language, apply the merchant’s timing and stop reminders after submission. | Private. Merchant screens mask the recipient address; delivery requires the address to reach the mail infrastructure. | Encrypted email and review-link data are erased when the request expires: 180 days after its scheduled invitation date. |
| Product contextProduct and variant IDs, SKU, item title and product image URL; current item quantity is checked when preparing the request. | Line items in the relevant Shopify order. | Show the purchased items, accept feedback only for those items and associate product ratings correctly. | Product context appears in the customer’s private form. Published reviews can identify the reviewed product, without exposing the order/customer reference. | Request item records remain with their request until deletion. Product associations remain with the review. |
| Review text and display nameChosen display name, product/store review kind, 1–5 rating, optional title/text, language, submission/publication dates and merchant reply. | The reviewer, a merchant-authorized import or an authorized Shopify review record. | Collect, manage and display feedback while keeping product and store ratings separate. | Public only when the review is published. The display name is review content; it is not a Shopify customer first-name field. | Retained while the merchant uses the service unless deleted. Deleted reviews are hidden immediately; remaining deletion records are purged after 30 days when synchronization is safe. |
| Source and verification contextOriginal source/date and external reference, import provenance, verification status, source app attribution, moderation reason and synchronization state. | The source review, verified request and merchant moderation actions. | Preserve origin, explain verification, handle imports without inventing purchase evidence and synchronize the correct records. | Source and verification context can be public. Internal provenance, moderation and synchronization records are private. | Kept with the review and subject to its deletion process. CSV imports remain unverified. |
| Photos and videosSubmitted original file, any embedded metadata, media reference, file type/size, upload date and its request/review association. | The reviewer’s optional product-review upload. | Preview the submission and display media attached to a published product review. | Pending media requires the review link. Attached media becomes public only with a published review. Embedded metadata, such as EXIF, is not stripped and can become public with the file. | Unattached uploads expire after 7 days. Attached files follow review deletion; privacy deletion can remove them sooner. |
| Review-link securityHashed review-link token, encrypted delivery copy, expiry and completion/idempotency references. | Revuka generates the link for a specific review request. | Allow the recipient to open the correct form without a password, prevent duplicate submissions and enforce expiry. | Private. The link grants access to its form and should not be shared publicly. | The encrypted delivery copy is erased at request expiry. Request records and the non-reversible token hash can remain until deletion. |
| Unsubscribe preferenceA per-store keyed email fingerprint and opt-out date; an invitation can also record that it was unsubscribed. | The recipient’s unsubscribe action. | Stop review invitations and reminders from that merchant, including requests for later orders. | Private pseudonymous marker. It is not a public email address, and it is still personal data. | Retained to keep honoring the opt-out until customer erasure or store-data deletion. Removing it may remove the remembered preference. |
| Merchant settings and acceptanceBranding, sender name/reply-to address, notification address, collection/timing/language settings, installation ID, DPA version/URL, accepting Shopify staff reference and acceptance date. | An authorized merchant user in Shopify. | Apply the merchant’s instructions, send operational notices and record acceptance of the available processing agreement for that installation. | Branding is shown in collection emails/forms. Staff, notification and acceptance records are private. | Settings and acceptance records remain for the store relationship and its deletion workflow; store redaction removes them. A new installation requires acceptance again. |
| Subscription and approvalStore/installation references; Shopify subscription ID, status, test flag, price, currency and current period; encrypted pending approval URL; creation-uncertainty, request-lease and update metadata. | Shopify’s authorized billing flow and the merchant’s subscription request. Paid entitlement is checked with Shopify rather than a merchant-editable paid flag. | Confirm the current plan, resume an outstanding approval safely and avoid requesting a duplicate charge. | Private, authenticated billing information. Neither the approval link nor subscription details enter public review responses. Shopify handles payment approval directly. | The encrypted link is cleared when Shopify confirms its matching pending subscription is active, frozen, cancelled, declined or expired, or when its pending reference is removed. Still-pending or unconfirmed links become eligible for scheduled cleanup after two days from the last checkout attempt or saved approval state; ordinary plan refreshes do not extend it. Local account metadata remains until store-data deletion. Shopify’s billing records follow its terms. |
| Invitation usage and reservationsStore reference, UTC calendar month, and sent/reserved invitation counts. Aggregate usage contains no customer identifier. | Invitation reservations and delivery processing. | Apply the Free invitation allowance safely across concurrent requests and account for sent or reserved messages. | Private usage totals shown to the authorized merchant; not public review content or advertising profiles. | Roughly 13 calendar-month periods. Customer erasure removes linked personal request/delivery records, but not these account-level aggregate counts. Store-data deletion removes the usage records. |
| App operational and access recordsJob/delivery IDs and status, store/installation/request references, message IDs, quota-month/count markers, event IDs, action/resource references, authenticated staff/shop, timestamps, data category, request method, HTTP status/outcome and sanitized error details. Application access logs exclude request bodies, searches, tokens, email and IP addresses. | App actions, authenticated Shopify events and delivery/synchronization processing. | Complete work reliably, prevent duplicate mail/events, trace protected-data access and investigate problems. | Private. No public review response includes these records. | Application audit records, completed jobs and sent-mail metadata: 365 days. Processed event deduplication metadata: 30 days. Unresolved jobs, uncertain mail and failed minimal events require operator resolution. Len checks failed privacy/background work each business day and reviews still-open cases at least every 30 days; these are not an indefinite archive. |
| Shopify deletion follow-upStore reference, opaque task ID, Shopify review-object ID or handle, product ID, prior-ownership flag, action state, attempt/lease/error code and creation, completion or next-attempt times. No customer/order ID, email, review body or access token. | An authorized review or privacy deletion instruction and its Shopify synchronization outcome. | Finish the required external review-object deletion when possible without postponing local erasure or reviving an erased review. | Private pseudonymous identifiers, still treated as personal data. They are excluded from public review responses. | Open solely for resolving the deletion instruction, with Len ownership and review at least every 30 days. Completed records are kept for 30 days to prevent revival, then purged. Store-data redaction removes the follow-up records too; external deletion can remain unconfirmed if access has been revoked. |
| Privacy requests and exportsThe minimum customer/order/email references needed to locate data, request status and an encrypted export of the matching information, including a pseudonymous opt-out marker when present. | Shopify privacy requests and the merchant’s authorized privacy workflow. | Provide access and erase the correct person’s/store’s information without disclosing another person’s data. | Private. Exports are available only through the authenticated merchant workflow. | Server-held privacy request/export records expire after 30 days. Downloaded support/export copies are manually deleted on task closure, no later than seven days afterwards unless a separately documented legal requirement applies. Erasure removes matching data and the opt-out marker; store deletion removes retained tenant data. |
| Website requestsNetwork and HTTP request metadata handled by hosting to route, serve and secure the request. | A visit to the website, handled by Cloudflare. | Deliver and protect the site. | Private operating information. The website demo does not upload its entries or selected files. | Provider technical retention follows its service terms; the website adds no analytics or tracking cookies. |
| Support and privacy correspondenceSender/recipient email addresses and display names, message headers, content and any attachments the correspondent supplies. | An enquiry sent to info@revuka.com, routed through Cloudflare and received in Google Workspace. | Answer the enquiry and handle support or privacy requests. Customer exports use the authenticated app workflow and must not be sent as ordinary support-email attachments. | Private correspondence, available only to authorized people and the providers needed to handle it. | Ordinary resolved enquiries are manually deleted 90 days after resolution unless a specific continuing purpose is documented. This is an operating duty, not an automatic app-mailbox expiry; provider deletion/recovery terms also apply. |
What we leave out
The order query does not request a customer’s first/last name, postal address, phone number or payment-card details. Revuka’s billing flow does not collect structured payment-card or bank details; Shopify handles approval and payment directly. A reviewer chooses their own display name. The app does not import a merchant’s full historical order archive.
Shopify can send a broader event payload to an app. Authentication requires receiving that message; Revuka reduces it to the fields needed for the relevant task before retaining it. Review text and files are voluntary content, so do not include sensitive or unnecessary private information.
Store isolation and testing
Revuka runs one production app service. Store identity and authenticated permissions scope each merchant’s data. The dedicated QA development store uses its own tenant and marked test records; another store’s customer information must not be copied into those tests.
Who receives information?
Cloudflare provides application hosting, database, private media storage, invitation delivery and inbound email routing. Google Workspace receives support and private privacy correspondence. Shopify provides the merchant platform and authorized review/order exchange. Published review content is available to storefront visitors. The processing agreement’s provider schedule explains these roles and international-transfer safeguards.
Providers maintain their own security and administrative records separately from Revuka’s application logs. Cloudflare documents 18 months of administrative audit-log retention. This does not establish complete logging of every runtime or customer-data read.
Deletion and retention limits
The periods above describe the service’s cleanup rules. Cleanup runs in bounded batches, and safe deletion can depend on completing Shopify synchronization. Uninstall removes access credentials and stops ordinary review-collection work and mail; it is not a promise that every retained review is erased at that instant. Shopify’s store-data deletion workflow removes retained local store data and media, with protection for a newer active installation.
Local erasure proceeds even if Shopify has revoked the access needed to delete a separate native review object. External deletion then remains unconfirmed. Minimal pseudonymous store/object/product references can be held only to resolve that instruction through fresh authorized access or controller/platform assistance, with Len responsible and still-open cases reviewed at least every 30 days. Completed follow-up records expire after 30 days. Store-data redaction removes those local records too; erasing a local queue is not proof of external erasure.
The canonical D1 database has a configured 30-day Time Travel recovery window; available history begins with the database’s creation. Deleted information can remain in restricted recovery history until it rotates out. Other recovery copies and provider records follow their applicable service lifecycles. We do not promise immediate selective erasure from every recovery copy. Any necessary restoration must reapply deletion and suppression instructions before affected processing resumes.
Ask about your information
For a store’s review or invitation data, contact that merchant first. You can also email info@revuka.com and identify the store. We will help route the request and may need to verify it. The privacy policy explains your rights and how Wndr.digital B.V. handles its own website and contact information.