GDPR and data requests

Checkout Commander handles GDPR-mandated data subject requests through Shopify’s mandatory GDPR webhooks. The webhooks are configured automatically when the app is installed; you don’t need to set anything up.

What data the app holds

The app holds the following data on behalf of your store:

Shop data — your Shopify shop’s basic details (name, domain, plan, contact email), used to render the home dashboard and route your subscription.
Operations — the hide, rename, and sort rules you’ve created. Each operation stores the rate or method it targets, the conditions, and the mode.
User data — the email and name of users signed in to the app, used to populate the user notification email setting.
Settings — your shop’s default weight unit, primary locale, available locales, and notification email addresses.
Job statuses — short-lived records of background-job state, pruned automatically.
Marketing preferences — your opt-in status for product updates, special offers, and educational content.

The app does not store customer cart contents, customer purchase history, or any of the order data Shopify itself keeps.

Customer data request

When a customer of your store makes a GDPR data-subject access request through Shopify, Shopify forwards a customers/data_request webhook to the app. The app’s background job compiles the data it holds about that customer (limited to app-internal records like the user’s email if they’re a collaborator) and emails a copy to the store owner. There is no app-side action required from you.

Customer redact

When a customer of your store is deleted through Shopify, Shopify forwards a customers/redact webhook. The app removes any internal records it holds about that customer. The customer’s order data and the customer’s record on Shopify are not affected — those are Shopify-side.

Shop redact

When your store uninstalls Checkout Commander, Shopify forwards a shop/redact webhook. The app removes all shop-level data: the shop record, sessions, operations, settings, and job statuses. After this, no Checkout Commander data remains on your store.

Uninstalling also stops the background publishing job, so any operations you had set up stop running at checkout from that point on. If you reinstall the app later, you start from a clean state.

What you need to do

For normal use, you don’t need to do anything. The webhooks are pre-registered when the app is installed. If you receive a customer data request from a customer directly, route it through Shopify’s standard request flow — the webhook chain takes care of the rest.

If you have a specific question about data the app holds or about how a particular request was handled, contact support.