Kept Subscriptions

Privacy Policy

Last updated: July 26, 2026

Kept Subscriptions ("the App") provides subscription management services for Shopify merchants ("the Service"). This policy describes how we collect, use and protect personal information when a merchant installs the App and when customers of that merchant interact with subscription features.

Information we collect

When installed on a Shopify store, the App accesses:

Customer information — name and email address of subscribers, used solely to display subscriptions in the merchant admin and the customer portal, and to send transactional subscription emails (renewal reminders, failed-payment notices, cancellation confirmations).
Subscription and order data — subscription contracts, selling plans and related order totals, used to operate recurring billing, payment-failure recovery (dunning) and merchant analytics.
Store information — store name, contact email, currency and timezone, used to configure the Service.

We never see or store payment card details. Payment methods are vaulted and processed exclusively by Shopify. Secure card-update pages are hosted by Shopify.

How we use information

To operate subscription billing, the customer portal and merchant dashboards.
To send transactional emails related to a customer's own subscription.
To help merchants recover failed payments and, when enabled by the merchant, send win-back offers.

We do not sell or rent personal information, use it for advertising, or share it with third parties other than the infrastructure sub-processors below.

Sub-processors

Shopify — commerce platform and payment vaulting.
Railway — application hosting and database (encrypted at rest).
Email provider configured by the merchant (e.g. Resend or the merchant's SMTP) — transactional email delivery.

Data retention & deletion

Customer redaction requests received from Shopify (GDPR webhooks) anonymize the customer's personal data in our records.
When a merchant uninstalls the App, all store data is permanently deleted following Shopify's shop/redact request (sent ~48 hours after uninstall).
Data is retained only as long as needed to provide the Service.

Security

All traffic is encrypted in transit (HTTPS/TLS). Data is stored in an access-controlled database encrypted at rest. Application-level logs record processing of personal data (e.g. email sends) for accountability.

Your rights

Customers can request access, correction or deletion of their personal data through the merchant they purchased from; merchants can contact us directly. We honor all verified requests within 30 days.

Contact

Questions about this policy or your data: support@trackwise.studio