GDPR and Data Requests

Shopify privacy requests

Reco supports Shopify's mandatory privacy and data protection workflow. Shopify sends compliance webhooks to apps when merchants or customers request data access or deletion. Reco receives and verifies these webhooks before processing them.

Supported compliance webhooks

• customers/data_request: Reco acknowledges customer data access requests. The storefront widget currently uses anonymous session identifiers and does not intentionally store Shopify customer identities.
• customers/redact: Reco acknowledges customer erasure requests. Because Reco does not currently link conversations to Shopify customer IDs, there is no customer-identifiable widget record to redact.
• shop/redact: Reco deletes store-linked data, including store records, reviews, conversations, messages, analytics, and logged questions associated with the shop.

Webhook verification

Reco uses Shopify's webhook authentication flow to verify webhook signatures before accepting privacy requests. Invalid webhook requests are rejected by the app framework before processing.

Merchant and shopper requests

Merchants and shoppers can also contact support@askreco.com for privacy questions. When a request relates to a Shopify store, we may ask for the shop domain and enough information to verify and route the request appropriately.

Current protected customer data status

Reco's current app functionality does not require access to protected Shopify customer data. If that changes, Reco will update its app configuration, documentation, and review submission before requesting such access.