Privacy Policy

Last updated: 9/22/2026

Introduction

Subsy respects your privacy and the privacy of your customers. This policy explains what data we collect, why we collect it, and how it's protected when you use Subsy on your Shopify store.

Merchant data

When you install Subsy, we access certain information through Shopify to provide the Service:

  • Your store's domain and a secure access token, used to communicate with your store via the Shopify API.
  • Your store's contact email, so we can reach you about your account or support requests.
  • Your subscription plan, billing status, and usage of Subsy's features.
  • Support ticket messages you send us, if you contact support.

Your customers' data

When one of your customers subscribes to a product through Subsy, we collect and store the information needed to manage that subscription:

  • Their name, email address, and Shopify customer ID.
  • Subscription details — plan type, frequency, price, delivery schedule, and order history.

We do not collect or store payment card details. Recurring charges are processed entirely by Shopify through Shopify's own subscription contracts — Subsy never sees or stores card numbers, expiration dates, or CVV codes.

We do not store your customers' shipping or billing addresses. When an address is needed to process an order (for example, a subscription renewal), it is passed directly to Shopify at that time and is not retained in Subsy's own systems.

Data storage & security

Where your data is stored and how it's protected.

Storage location

Subsy's data is stored on secure cloud infrastructure located in the United States (Central US), with restricted access controls.

Security

We take reasonable technical and organizational measures to protect the data we store, including restricting access to production systems. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

Sensitive credentials — including the access tokens Shopify issues us to communicate with your store — are encrypted at the field level (AES-256-GCM) before being stored in our database, and are only decrypted in memory when needed to make an authorized API call to your store on your behalf.

Third parties we share data with

Subsy shares data with the following third parties, only as needed to provide the Service:

  • Shopify — processes all orders, payments, and subscription billing.
  • Klaviyo — if you connect your Klaviyo account, we send subscription events (created, renewed, paused, cancelled) along with your customer's email so you can automate email flows.
  • Google Analytics 4 — if enabled on your store, we send an anonymous conversion event when a customer subscribes. No customer personal data is sent to Google.

Data retention & deletion

How long we keep data, and how it gets deleted.

While you use Subsy

We retain merchant and customer data for as long as your store is actively using Subsy, so that subscriptions, analytics, and support history continue to work correctly.

Shopify data-erasure requests

In compliance with Shopify's requirements, we respond to Shopify's mandatory data-request and data-erasure webhooks: when Shopify notifies us that a customer has requested their data or its deletion, or that a shop has uninstalled the app and requested erasure, we delete or provide the relevant data accordingly.

After uninstalling

When a store uninstalls Subsy, we retain the store's merchant and customer data for a short period, in case the store is reinstalled. Approximately 48 hours after uninstallation, Shopify automatically sends us notice via its shop-data-erasure webhook, and we then permanently delete that merchant's and their customers' data from our systems.

Cookies

Cookies used within the Subsy admin dashboard.

How we use cookies

  • Session cookies, to keep you signed in to the Subsy dashboard within Shopify admin.
  • Security cookies, to protect the Service from abuse.

Children's privacy

Subsy is not directed at children.

Subsy is a business tool for Shopify merchants and is not directed at anyone under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can remove it.

Changes & contact

How we handle updates to this policy, and how to reach us.

Changes to this policy

We may update this policy from time to time. Changes take effect as soon as they're posted on this page, and the "Last updated" date above will reflect the most recent revision.

Contact us

For questions about this policy, or to request access to or deletion of your data, contact us at [email protected].