Data Protection

Last updated: 8 July 2025

This page sets out the technical and organisational measures we apply to merchant data, and serves as our data processing summary for merchants who need one for their own compliance records.

Roles

The merchant is the controller. Ignite Apps is the processor, acting only on the merchant's documented instructions.

Categories of data

Product and inventory data (title, description, price, SKU, stock levels) from the primary store, pushed to the paired secondary store.

Purpose of processing

To keep the secondary store's catalog and stock levels in sync with the primary store.

Protected customer data

This app requests no customer or order scopes, so no protected customer data is accessed. Scopes granted: read_products, write_products, read_inventory, write_inventory, read_locations.

Security measures

• TLS in transit; access tokens encrypted at rest with AES-256-GCM.
• HMAC-verified OAuth callbacks and webhooks; session-token-authenticated dashboard API.
• Least-privilege scopes — we request only what the app needs.

Retention and deletion

• No snapshots are retained — this app syncs live data, it does not store historical copies.
• On uninstall and on the shop/redact webhook, which purges the shop's rows and, if it was the last connection in its pair, the pair itself.

GDPR / CCPA compliance webhooks

We implement all three of Shopify's mandatory compliance webhooks. Each request is verified with an HMAC signature and an unsigned or mis-signed request is rejected with HTTP 401.

• customers/data_request — responds with the customer data we hold.
• customers/redact — erases the named customer's data.
• shop/redact — erases the store's stored connection and all associated records.

Sub-processors

Cloudflare (compute, storage, DNS).

Contact

Data protection enquiries: support@shop-2-shop.com.