MarginGuard Privacy Policy

MarginGuard processes each merchant's Shopify order, refund, customer-email and product-cost data — including which product variants were bought, in what quantity and at what price — to calculate explainable exclusion signals and write them to that merchant's Klaviyo account. Merchants control whether these signals are used in their marketing.

Data and security

The application database and recovery backups are encrypted at rest; provider credentials are additionally encrypted individually. Connections use HTTPS. Store data is tenant-isolated, and authenticated access to customer-data screens is recorded. We do not import customer names, postal addresses, phone numbers, card data or marketing-message content. Support messages are stored when you submit them.

Retention

Local order history is retained for 18 calendar months, covering the default one-year scoring window and six months of review history. Daily maintenance removes older orders and their refunds and refreshes local scores. Merchant overrides remain until removed or the customer or shop is redacted. Recovery backups expire after seven days. Retention removes our copies, not orders or profiles in Shopify or Klaviyo.

Access and deletion

Shopify privacy requests are handled through customers/data_request, customers/redact and shop/redact webhooks. Customer data requests are compiled for secure manual delivery. Customer redaction deletes matching local orders, refunds, scores, overrides and associated copies. Keyed, non-readable identifiers prevent old deliveries from recreating erased data without blocking legitimate new orders. Shop redaction deletes the store and dependent records. Clearing MarginGuard-owned properties in Klaviyo requires working access to that account; we do not delete Klaviyo profiles or merchant-owned segments. Deleted data can remain in encrypted recovery backups until their seven-day expiry and must not be reintroduced during recovery.

Processing terms

The Data Processing Agreement states our role as processor, the sub-processors that receive data, our security measures and how we assist with data-subject requests and breach notification.

Contact

Contact admin@shelfcompass.com for data access, deletion or security concerns.