Last updated: 5 August 2026

This page supports merchants who need to document their use of Super Simple Subscriptions ("the App") for GDPR purposes. It is written to answer the questions that come up in a supplier review: who processes what, where it sits, how it is protected, and when it is deleted. It supplements our privacy policy rather than replacing it.

Our role

You are the controller of your store's personal data. We act as a processor on your behalf, processing personal data only to provide the App and only on your documented instructions, which are given through your use of the App and our agreement with you.

Where our sub-processors process personal data, they act as our sub-processors under Art. 28(4) GDPR, and we remain responsible to you for their performance.

Data processing agreement (Art. 28 GDPR)

We enter into a data processing agreement with any merchant who requests one. To receive a copy for signature, email support@subscriptions.super-simple.com with your company name, registered address, and the name of the signatory. This page forms the technical annexes to that agreement: the sub-processor list, the storage locations, and the description of our technical and organisational measures.

What personal data we process

The App is built to hold as little personal data as possible. We do not store your customers' names, email addresses, postal addresses, or payment details in our database. Subscription records reference only Shopify's internal customer ID, and customer details are read from the Shopify Admin API at the moment they are shown to you and are not retained afterwards.

What we do store:

• Store and account data: your myshopify domain, store name, store contact email address, store country, plan, and your App settings.
• Subscription records: the Shopify subscription contract ID, the Shopify customer ID, billing frequency, status, renewal counts, pause and cancellation history, and the reasons a customer selected in your cancellation or pause flow.
• Order and product metadata: order numbers, order totals, currency, discounts, product and variant titles, and SKUs, used for the analytics shown in the App.
• Authentication data: the OAuth access token Shopify issues when you install the App.
• Support and usage data: messages you send us through the in-app chat, and product analytics events recording how the App's admin interface is used.

Customer email addresses are processed transiently in two places: when a subscription notification email is sent to your customer, and when a customer signs in to the legacy customer portal by email link. In the second case the address is encrypted into a token that expires after seven days and is not written to our database.

Sub-processors

We use the following sub-processors. We will give notice before adding or replacing a sub-processor so you have the opportunity to object.

Storage locations

The App runs in the European Union. Application servers, background processing, email delivery, and file storage run on AWS in Ireland (eu-west-1). Error monitoring is handled in Sentry's German region and product analytics in PostHog's EU region.

Our company is established in the United Kingdom, and our staff access production systems from there. Personal data may therefore be accessed from the UK for support and maintenance purposes.

Technical and organisational measures (Art. 32 GDPR)

The measures below apply to the App and its supporting infrastructure.

• Encryption in transit: all traffic between your browser, the storefront, our servers, and our sub-processors is served over HTTPS with TLS.
• Encryption at rest: the database and file storage are encrypted at rest by our infrastructure providers.
• Data minimisation by design: customer names, email addresses, postal addresses, and payment details are read from Shopify when needed rather than copied into our database, so the majority of customer personal data never rests in our systems.
• Authentication and access scoping: access to your store is via a Shopify OAuth token limited to the permissions listed on our App Store listing. Every request from the merchant admin is verified as a signed Shopify session, and customer portal requests are authenticated per customer.
• Token protection: customer portal sign-in tokens are AES encrypted and expire after seven days.
• Webhook verification: all webhooks from Shopify are verified against their HMAC signature before being processed, so requests cannot be forged.
• Tenant separation: every record is scoped to a single store, and queries are filtered by store on every read.
• Monitoring: application errors are captured and monitored continuously so faults are detected and addressed.
• Backups: the database is backed up automatically by MongoDB Atlas so that it can be restored after an incident.

Deletion of customer and shop data

We are registered for and receive Shopify's mandatory privacy webhooks (customers/data_request, customers/redact, and shop/redact).

When you uninstall the App:

• Your OAuth access token is deleted from our database immediately, so we lose all ability to access your store's data through Shopify.
• Your subscription records are deactivated, and no further billing attempts, notifications, or automated actions are run for your store.
• Your store settings and subscription history are retained so that your configuration is restored if you reinstall.

To have that retained data erased rather than kept, email support@subscriptions.super-simple.com from your store contact address. We will erase all data associated with your store within 30 days and confirm in writing once it is done. The same applies to an individual customer's data on request: send us the customer's Shopify customer ID or email address and we will erase the records referencing them.

Data subject requests

Because we act as a processor, requests from your customers to access, correct, or delete their personal data should be directed to you as the controller. Where you need our help to answer such a request, contact us and we will assist without undue delay, as required by Art. 28(3)(e) GDPR.

Personal data breaches

If we become aware of a personal data breach affecting data we process on your behalf, we will notify you without undue delay and provide the information you need to meet your own obligations under Art. 33 GDPR.

Contact

For data protection questions, a copy of our data processing agreement, or to exercise any of the rights described above, contact us at support@subscriptions.super-simple.com or by post: