Who this covers
SafeLanding is a Shopify app that lets a merchant offer delivery protection on their own store. Two groups of people appear in this page: merchants, who install the app, and shoppers, who buy from them.
For shopper data, the merchant is the data controller and SafeLanding is their processor. We hold that data to run the merchant's protection program, and we act on their instructions. We never use it for our own marketing, we never sell it, and we never pass it to advertisers.
What we get from Shopify
When a merchant installs the app, Shopify grants it access to specific parts of the store. We request the narrowest set that makes protection work:
- Orders and fulfillments. To spot which orders have protection on them, read the order subtotal that sets the fee, and follow delivery state when a shopper reports a problem.
- Customers. Only to recognise a shopper when they open the protection block in their Shopify account. Signing in is handled by Shopify; we read the customer identity attached to that session so a shopper only ever sees their own orders.
- Products and publications. To create and maintain the hidden protection product the fee is charged through.
- Draft orders. To prepare a replacement order when a merchant approves one.
- Reports. To show the merchant their own store metrics inside the app.
What shoppers give us directly
When a shopper reports a delivery issue from their account page, they send us their name, email address, which order it concerns, what went wrong, and optionally photographs. A shopper can attach up to ten images of at most 15MB each. They can also exchange messages with the merchant about the request, and we store that thread.
All of it exists for one purpose: so the merchant can decide the request. Nothing here is used to build a profile or to market to anyone.
What the storefront widget records
The protection option in a merchant's cart records when it was shown, when a shopper switched it on, and when they switched it off, along with the cart subtotal and the cart's own token. The merchant uses this to see how often protection is being taken.
It sets no cookies of its own, does not follow anyone across sites, and carries no name, email or address. The cart token identifies a cart on that store, not a person.
Who else sees it
Three processors, and nobody else:
- Shopify, where the store and its data already live.
- Gadget, which hosts the application and its database.
- Resend, which delivers the emails about a delivery issue. These are service messages about one specific order, sent from
updates.safelandingapp.com. They are never marketing, which is also why they carry no unsubscribe link.
We do not sell personal data. We do not share it for advertising. We take no share of the protection fees a merchant collects, so we have no commercial reason to want shopper data beyond running the feature.
Deleting it
We implement Shopify's required privacy webhooks, and they do real work rather than acknowledging the request:
- A shopper erasure request removes their name, email and any internal notes from every request they filed at that store, clears their email from the protected order records, and deletes their message threads outright. A message has no non-identifying remainder worth keeping, so it goes rather than being stripped.
- A shopper data request is passed to the merchant, who holds the relationship and provides the data.
- Uninstalling the app triggers deletion of everything we hold for that store 48 hours later: requests, photographs, message threads, protected orders, widget events and settings.
Outside those routes, data is kept for as long as the merchant has the app installed, because a request can be reopened and a merchant needs their own history.
Security
Data is encrypted in transit and at rest by our hosting provider. Each store's data is isolated: every record is scoped to the store it belongs to, and the app's access rules prevent one store reading another's. Photographs are served from storage we control, restricted to known image types.
Getting in touch
Shoppers should contact the store they bought from, since the merchant controls their data and decides their request. Merchants, and anyone who cannot reach a store, can write to support@safelandingapp.com.
If this page changes we will update the date at the top. Material changes will be told to merchants in the app rather than left here to be discovered.