Information we process
We process Shopify installation identifiers, store configuration, orders selected for tracking, order transactions, risk assessments, disputes, evidence drafts, provider alerts, merchant-confirmed actions, audit records, billing status, and verified notification recipients.
Shopify requires protected customer data access for the ShopifyQL reporting capability used by Chargeback Rate Guardian. Lower Chargeback does not request customer names, postal addresses, phone numbers, or email addresses in its Shopify Admin API queries and does not persist those customer identity fields.
Payment and decision boundaries
Lower Chargeback does not store card numbers. Provider credentials are encrypted before storage and are never returned after they are saved. The service does not create Shopify refunds, automatically accept or decline network cases, automatically report provider outcomes, or submit dispute evidence without the merchant action required by that workflow.
How information is used
Information is used to synchronize Shopify operational data, calculate ShopifyQL chargeback metrics, match provider alerts to eligible Shopify transactions, notify verified recipients, maintain billing entitlements, and record merchant-confirmed actions.
Service providers
Lower Chargeback uses Shopify for commerce data and embedded application services, Cloudflare for Worker execution and storage, Brevo for transactional email, and only the merchant providers explicitly connected and verified through Provider Hub.
Retention and deletion
Shopify compliance webhooks are used to answer data requests and delete store data when Shopify instructs the app to redact it. Uninstalling removes active Shopify credentials. Provider retention and backup lifecycle remain governed by the applicable provider’s service terms.
Security and access
Production secrets are held in Cloudflare secret configuration. Stored provider credentials use authenticated encryption. Administrative access is restricted, operational changes are audited, production data is not copied into demo or test datasets, and security incidents are investigated and contained through the documented response procedure.
Contact
Privacy and data-protection requests can be sent to marian@agilemedia.com.