Policies & standards
Trust Centre
One place to find how HappifyApps handles merchant and customer data, what is built and tested, and what we have not yet proven in production.
Effective date: October 17, 2026
Overview
HappifyApps is built and run by Udaan Technologies Pvt. Ltd. Our eight Shopify apps share one platform: one Supabase Postgres database, with the apps running on our own server at Hetzner in Falkenstein, Germany. Each app requests only the Shopify access scopes its features need, and Shopify access tokens are encrypted at rest with AES-256-GCM.
This page summarises and links to our detailed pages. It is not a certification or an audit report. Where something is built and tested but not yet proven against live Shopify traffic, we say so below.
Policies and pages
- Security & Data Protection: Data minimisation, encryption, access control, backups, retention and incident response.
- Sub-processors: Supabase, Hetzner, Resend, Google, self-hosted Plausible and merchant-connected Klaviyo, with the data each one sees.
- Data Processing Terms: Our role as processor for merchant data and how to request a signed data processing agreement.
- Privacy Policy: What we collect on the website and in the apps, and your rights.
- Cookies: Google Analytics loads only after consent; Plausible sets no cookies.
- Accessibility: Our accessibility approach and how to report a barrier.
- System status: A live check of the website and all eight app subdomains, run when you open the page.
Uninstall and privacy webhooks
Shopify sends apps mandatory privacy webhooks. All eight apps use one shared handler on our platform. It checks Shopify’s signature, stores each delivery once, and writes an audit log entry for each privacy request. This is what happens for each webhook:
| Webhook | What happens |
|---|---|
| app/uninstalled | Marks the app as uninstalled and its subscription as cancelled, and stops syncing for it. Nothing is deleted at this point: Shopify sends the shop redaction request below 48 hours later, and any other Happify app on the store keeps working meanwhile. |
| customers/data_request | Logged on receipt. We prepare the customer’s data by hand and send it to you, the merchant, within 30 days. |
| customers/redact | Removes the customer’s name and email from the customer record; their name, email, phone and addresses from their orders; their contact details from Local Delivery Sheet run stops, along with any proof of delivery photo or signature for those stops; stored webhook records about them; and their email address wherever it was logged as an email recipient. Order lines and totals stay, so your sales history still adds up. |
| shop/redact | Deletes this app’s data for your store: its installation and encrypted access token, subscription record, settings, app-specific data (such as delivery runs and proof of delivery, zones, internal order notes), audit log entries and webhook records. The shared store data (products, inventory, orders, customers) is deleted too when no other Happify app is installed on the store. If one is, the shared data stays for that app, cut down to the customer details it needs. |
Status: this handling is implemented and tested locally with automated tests. We have not yet observed a live Shopify delivery of customers/data_request, customers/redact or shop/redact for any app, so live delivery evidence is still pending. Customer data requests are not exported automatically: we prepare the export by hand and send it to the merchant.
Per-app privacy
Each app has its own privacy page listing every Shopify permission it requests, what it stores and why, who else receives data, and how data is deleted. The buyer details an app can keep are fixed in code.
| App | Buyer details it may keep | Privacy page |
|---|---|---|
| Happify Pick List & Low Stock | None: orders without buyer details | Privacy and data |
| Happify Local Delivery Sheet | Name, email, phone, shipping and billing address | Privacy and data |
| Happify Delivery Rates by Zip | None | Privacy and data |
| Happify Invoice & Packing Slip | Name, email, phone, shipping and billing address | Privacy and data |
| Happify PWA: Home Screen App | None | Privacy and data |
| Happify Reorder Predictions | Customer ID, name and email | Privacy and data |
| Happify Dead Stock Rescue | None: orders without buyer details | Privacy and data |
| Happify Store Builder | None: no order or customer access | Privacy and data |
Store data is kept once per store, not once per app. Buyer details are kept only while an app that needs them is installed.
Data retention
- Store data synced from Shopify is kept while an app is installed. Uninstalling marks the app as uninstalled and cancels its subscription; nothing is deleted at that moment.
- An app’s data is deleted when Shopify sends its shop redaction request, 48 hours after uninstall. Shared store data stays while another HappifyApps app is still installed on the store.
- Webhook payloads are emptied once processed, and webhook delivery records are deleted after 30 days.
- Audit log entries are deleted after one year, except saved settings versions kept while the app is installed.
- Encrypted database backups are deleted 90 days after they are taken, so deleted data can remain in a backup for up to 90 days.
See Security: Retention for the full statement.
Live status
The status page checks the website data service and the health route of all eight apps each time you load it. It shows a snapshot, not a history, and we do not publish an availability target.
What is not yet verified
These items come from our internal readiness and data protection records. Each one is built or in progress, but we do not yet have dated evidence that it works on live Shopify stores or has Shopify’s sign-off. An item leaves this list only when that evidence is recorded.
Live GDPR webhook delivery
Not yet verified. Built and tested in our code; not yet confirmed on a live store.
- What we have
- Automated tests run the customer and shop redaction handlers against a real Postgres database with every migration applied, and read the rows back after each webhook. Personal details in a privacy request are removed before the request is stored.
- Still open
- We have not yet observed a live Shopify delivery of customers/data_request, customers/redact or shop/redact for any app. Our manual data-request export has not yet been run for a real request.
- Last reviewed
Protected customer data approval
Not yet verified. Our answers are filed with Shopify; Shopify’s approval is still open for some app versions.
- What we have
- Our answers to Shopify’s protected customer data questions are documented with the control behind each one. Apps without approval keep working with reduced features and tell the merchant what is unavailable.
- Still open
- Shopify’s approval of protected order data is not yet complete for every app version, and Store Builder’s request is not yet finished.
- Last reviewed
Merchant consent to new permissions
Not yet verified. Handled in our code; some app versions that ask for new permissions are not yet released.
- What we have
- An app reads the permissions a store has actually granted and tells the merchant which features are unavailable, instead of locking them out.
- Still open
- Merchants approve new permissions only when a new app version is released to them. Some of those versions are still waiting for release testing on a development store.
- Last reviewed
Store Builder theme-file write approval
Not yet verified. Waiting on Shopify; Store Builder does not write to a live store yet.
- What we have
- In an October 12 production check, Store Builder showed a saved demo project, the unpublished-theme picker and its review controls. No change was written to Shopify.
- Still open
- Shopify’s permission for Store Builder to write theme files is still open, as is live acceptance of publish, rollback, checkout and privacy flows.
- Last reviewed
App Store listing review
Not yet verified. Store Builder’s App Store submission is a draft and is on hold.
- What we have
- The Store Builder listing is prepared as a draft in the Shopify Partner Dashboard.
- Still open
- Store Builder has not been submitted for App Store review. Submission waits until the permission and acceptance items above are closed.
- Last reviewed
Theme Store listing
Not yet verified. One of our eight themes is in Shopify’s review; none is on the Theme Store yet.
- What we have
- All eight themes pass Shopify’s theme check with no errors, and each demo store renders its main pages without errors. Lighthouse and 320px reflow checks were recorded on October 4, 2026.
- Still open
- Theme Store approval, a physical-device review, designer sign-off and confirmation of the rights to some demo images are still open.
- Last reviewed
Live merchant workflows
Not yet verified. Built and tested in our code; not yet confirmed end to end on a live merchant store.
- What we have
- Thousands of automated tests pass across the apps and platform, and each app has a health route that checks its database, tokens and billing readiness.
- Still open
- End-to-end checks on a live store are still open, including invoice email delivery and order imports on a store that runs two of our apps together.
- Last reviewed
Tag clean-up before uninstall
Not yet verified. Built and tested in our code; not yet confirmed on a live store.
- What we have
- Reorder Predictions and Dead Stock Rescue offer a confirmed, audited clean-up of the Shopify tags only they own.
- Still open
- The clean-up has not yet been run on a live Shopify store.
- Last reviewed
Health checks after our server move
Not yet verified. Running on our own server since October 14, 2026; a full per-service health record is not yet in place.
- What we have
- The apps, admin console and website moved to our own server at Hetzner in Germany. Earlier release checks were taken on our previous host.
- Still open
- A recorded health check of each service on the new server.
- Last reviewed
Automated health alerts
Not yet verified. Health checks are run by hand; automated alerts are defined but not yet active.
- What we have
- Each app has a health route. A public check on October 13, 2026 found seven of eight apps healthy; Store Builder reported that its billing set-up needs attention. Our status page runs a live check whenever it is opened.
- Still open
- Scheduled health checks with alerts to our team are written but not yet switched on.
- Last reviewed
Off-site backup copy
Not yet verified. Nightly backups are encrypted; a second, off-site copy is not yet in place.
- What we have
- The database is backed up every night, encrypted before it is written to disk, and kept for 90 days.
- Still open
- An encrypted copy of each backup in a second location.
- Last reviewed
AI provider data terms
Not yet verified. Not yet reviewed for the plan Store Builder uses.
- What we have
- Store Builder sends Google’s Gemini API only the store and product text needed for an AI draft the merchant asks for. No Shopify customer data is sent.
- Still open
- A review of Google’s retention and training terms for the Gemini API plan in use.
- Last reviewed
We hold no independent security certification and have not published a penetration-test report.
Contact
- Security reports: security@happifyapps.com. We acknowledge reports within two business days.
- Privacy requests and signed data processing agreements: privacy@happifyapps.com. Name the store and app involved.
- Accessibility feedback: admin@happifyapps.com.
- Complaints: use our grievance process.
Do not include passwords, full payment-card details, Shopify access tokens or unnecessary personal data in a report.