Privacy

Demfilz Support Tickets is a help desk. To do its job it has to store the conversations your customers have with your team. This page says exactly what that means.

What this app stores

• Your .myshopify.com domain, the offline access token Shopify issued at install (encrypted at rest), your store name, contact email and primary domain.
• Your help desk configuration: departments, canned replies, settings, email templates, and the SMTP details you choose to enter (password encrypted at rest).
• Your staff who use the app: Shopify staff id, name and email, as reported by Shopify when they open the app.
• Tickets: the customer's name and email, their Shopify customer id when they were signed in, the order number they chose, every message in the thread, internal notes, attachments, ratings, and an activity log.

What this app does not do

It does not sell, share or analyse customer data, does not use it for anything but showing it to your team, and does not read orders or customers from Shopify unless you grant those permissions to show order context beside a ticket. There is no tracking and no telemetry.

Email

Notifications are sent from the app's sending address with your store's address as the reply-to, or from your own SMTP server if you configure one. Emails contain the ticket text and a private link to the ticket.

Shopify's privacy webhooks

• customers/redact: every ticket, message and attachment belonging to that customer (matched by customer id or email) is deleted.
• customers/data_request: everything held about that customer is sent to your store's notification address as a JSON file, for you to pass on.
• shop/redact and uninstalling: your store's entire record, tickets and attachments included, is deleted.

Retention

Tickets are kept until you delete them, your customer is redacted, or you uninstall the app. Attachments are stored under random file names and served only through short-lived signed links.