GDPR Compliance & Webhooks

Shopify requires all apps to implement three mandatory GDPR webhooks. These webhooks ensure that apps properly handle customer data requests and shop data deletion. This page explains how FilterIQ responds to each one.

Our Data Processing Approach

Before diving into the webhooks, it is important to understand what customer data we handle:

FilterIQ does not store personal customer data. We store search queries and filter interactions as aggregated analytics (e.g., "the query 'red dress' was searched 47 times this week"). These analytics are not tied to individual customers -- we do not record who searched for what.

The only data we store is:

• Merchant product data (indexed for search)
• Merchant configuration (filters, synonyms, merchandising rules)
• Aggregated analytics (search query counts, filter usage counts)

This design means GDPR data requests and redaction requests have minimal impact, since we do not have individual customer data to return or delete.

Mandatory GDPR Webhooks

1. customers/data_request

When it fires: A customer requests a copy of their data from a store (under GDPR Article 15, "Right of Access"). Shopify forwards this request to all installed apps.

What we do:

1. We receive the webhook with the customer's email and/or ID
2. We search our systems for any data tied to that specific customer
3. Since we do not store per-customer data (no customer profiles, no individual search history, no personal identifiers), we respond that no customer-specific data is held
4. If the merchant has questions, we provide a summary of the aggregated data types we do store

Response time: We acknowledge the webhook immediately (within Shopify's 5-second SLA) and process the request within 48 hours. If any data were found, we would provide it to the merchant within 10 business days as required by GDPR.

2. customers/redact

When it fires: A store owner requests deletion of a specific customer's data (under GDPR Article 17, "Right to Erasure"), or Shopify sends it automatically 6 months after a customer requests deletion from the store.

What we do:

1. We receive the webhook with the customer's identifying information
2. We search our systems for any data tied to that customer
3. Since we do not associate analytics data with individual customers, there is no customer-specific data to delete
4. We log the redaction request for audit purposes (the log entry contains only the request timestamp and shop domain -- no customer data)

Response time: Acknowledged immediately. If any customer-specific data existed, it would be deleted within 48 hours.

3. shop/redact

When it fires: A merchant uninstalls the app. Shopify sends this webhook 48 hours after uninstallation to ensure the app deletes all of the shop's data.

What we do:

1. We receive the webhook confirming the shop has uninstalled
2. We permanently delete all data associated with that shop:
   • Product search index (purged from our search engine)
   • All configuration data (filters, synonyms, merchandising rules, settings)
   • All analytics data (search queries, filter usage, click data)
   • All cached data (cleared from Redis)
   • AI conversation history
   • Webhook processing logs
   • The shop's account record itself
3. We log the deletion completion for audit purposes (timestamp only, no shop data retained)

Response time: All data is permanently deleted within 48 hours of receiving the webhook. In practice, our automated cleanup process typically completes within a few hours.

Data Deletion Verification

After processing a shop/redact webhook, there is no way to recover the deleted data. If a merchant reinstalls the app, they start with a completely fresh setup -- no previous configuration, analytics, or indexed data carries over.

Audit Trail

We maintain a minimal audit log of GDPR webhook processing:

Audit log retention is two-tier:

• GDPR-event rows (shop/redact, customers/redact, customers/data_request) are retained for 6 years with the shop_domain pseudonymized via SHA-256. Legal basis: GDPR Art. 30 records-of-processing + Shopify App Store compliance.
• Non-GDPR audit rows are retained for 30 days and then permanently deleted.

See docs/governance/DATA_RETENTION.md on the project repository for the canonical retention matrix.

Contact for Data Requests

If you have questions about your data, need to make a data access request, or want to verify that your data has been deleted after uninstalling, contact:

privacy@filteriq.app

We respond to all data-related inquiries within 5 business days.

For general support questions, use support@filteriq.app instead.