AppSpend SentinelPrivacy policy
Last updated: 18 October 2026
This policy explains how AppSpend Sentinel (the "app"), a Shopify app made by Elektraset, s.r.o. ("we"), processes data. Contact: help@elektraset.com, website elektraset.com.
Who is responsible
For the data a merchant puts into the app, the merchant is the controller and we process it on the merchant's behalf. For account and billing data about the merchant's use of the app, we are the controller.
What the app does not touch
The app asks Shopify for no access scopes to orders, customers or products. It does not read or store data about your store's customers. Shopify's customer data requests (customers/data_request, customers/redact) therefore find no data in the app.
What we process
| Data | Where it comes from | Why |
|---|---|---|
| Store domain, store name, store email, currency, whether it is a development store | Shopify Admin API (shop query) when you open the app | To run the app for your store, prefill the reminder email and use your currency |
| Session data (access token) | Shopify OAuth | To call the Shopify Admin API for your store |
| Your app register: app names, plans, prices, trial and renewal dates, ceilings, usage numbers, notes, cancellation links | You enter it, or the app reads it from billing emails you send in | To remind you and to check charges |
| Billing emails, .eml files and bill CSV files you send in or forward | You | To find charges, notices and cancellation confirmations; kept as evidence with a SHA-256 fingerprint |
| Evidence entries and files (screenshots, PDFs) | You | Your cancellation timeline and refund packets |
| Refund packets | Generated by the app from the above | So you can send them to a developer, vendor, Shopify or your bank |
| This app's own subscription (plan, status, price, dates) | Shopify Billing API | To apply plan limits |
| Reminder email address | You (prefilled with the store email) | To send reminders |
| Aggregated usage counts (number of stores, activated stores, paying stores) | Computed by the app | To measure whether the app is useful; no store names or content leave the app |
Billing emails can contain personal data of you or your staff (names, email addresses, the last digits of a card). Only send in emails about app billing.
Processors
- App hosting: the app and its database run on servers operated for Elektraset, s.r.o.
- Resend (Resend, Inc.): sends reminder emails, and receives emails forwarded to your private forwarding address (Pro plan).
- Shopify: authentication, billing of this app and the compliance webhooks.
We do not sell data and do not use it for advertising.
Retention and deletion
- You can remove apps, charges and demo data in the app at any time.
- When you uninstall the app, Shopify sends us a shop/redact request 48 hours later; we then delete all data of your store (register, emails, files, evidence, packets, reminders, sessions). We keep only an anonymous record (install and uninstall dates, whether the app was used, this app's subscription amounts) for our aggregated statistics, without the store domain.
- Server access logs do not contain query parameters, tokens or store names and are rotated by the host.
Security
Transport is encrypted (HTTPS). Access to your data requires a valid Shopify session for your store. Evidence files are only served to your store's authenticated session. Each email and file is fingerprinted with SHA-256 so changes can be detected.
Your rights
Under the GDPR and similar laws you can ask for access, correction, deletion, restriction or a copy of your data, and object to processing. Write to help@elektraset.com. You can also complain to your data protection authority (in Slovakia: the Office for Personal Data Protection of the Slovak Republic).
Changes
We will post changes on this page and update the date above.