Privacy Policy

Who we are

GuardUp is a Shopify app that monitors your store's discounts, prices, and inventory for configuration mistakes and potential revenue leaks. This policy covers what data the app reads, what it stores, and how we handle it.

Data we access

With your consent during install, GuardUp requests the following Shopify scopes:

• read_discounts / write_discounts - to evaluate discount rules and disable a code on request.
• read_products / write_products - to detect price anomalies on product updates.
• read_inventory - to detect overselling.

We do not request access to orders or customer data.

Data we store

On our servers we store only:

• Your store domain and the offline Shopify access token (required to receive webhooks).
• Your GuardUp settings (thresholds, which triggers are on, which tags to exclude).
• Anomaly records that reference Shopify resource IDs (product, variant, discount) along with relevant metadata like the detected discount percentage or price delta.
• A log of webhook event IDs for idempotency.

We do not store customer names, emails, addresses, order contents, payment details, or any other personally identifiable information about your shoppers. If a Shopify webhook payload contains PII, we read only the non-PII fields we need and discard the rest.

Data retention

Your data stays on our servers for as long as GuardUp is installed on your store. When you uninstall, we delete every trace of your shop within minutes via Shopify's app/uninstalled webhook, and Shopify's 48-hourshop/redact safety webhook runs a second cleanup pass.

GDPR / customer data requests

GuardUp implements Shopify's three mandatory GDPR webhooks:

• customers/data_request - We record that the request was received and return a confirmation. Since we do not store customer PII, there is no data to return.
• customers/redact - No action required; we do not store customer PII.
• shop/redact - Triggered by Shopify 48 hours after uninstall. We delete every remaining shop record at this point.

Third-party services

We use Mantle to handle billing and subscription state. Mantle receives only the minimum information needed to identify your shop and its subscription status: your store domain, Shopify shop ID, and the plan you are on.

Security

All traffic is encrypted in transit with TLS. Webhook requests are verified with HMAC signatures before processing. Secrets are stored in environment variables on a locked-down VPS and never committed to source control.

Contact

Questions, concerns, or GDPR requests? Email hello@boost-apps.co and we will respond within 5 business days.