Privacy

Clawback is operated by Cleo Wangayi, 3 3rd Street, Westview, Kadoma, Zimbabwe. Questions about anything on this page go to dev@watacle.com.

This policy covers the Clawback Shopify app. Where the app processes personal data that belongs to your customers, you are the data controller and we are your processor. Where it processes your own account details, we are the controller.

Clawback asks for read permissions only, and only the ones below. Shopify shows them to you before you install. It cannot create a refund, change an order or an inventory level, or contact a customer: the app’s Shopify connection rejects anything that would change your store.

read_orders

Orders: order number, dates, statuses, totals, discounts, taxes, shipping charged, line items (product title, variant, SKU, quantity, price), payment transactions with their processing fees, fulfillments and refunds.

read_returns

Returns: status, items, return reasons, restocking fees, return shipping fees, inventory dispositions, and the carrier name of a return label.

read_inventory

Stock quantities per item per location, and inventory unit costs, to tell whether returned items went back into stock.

read_products

Product and variant titles and SKUs, and Shopify's Cost per item, to value returned inventory.

read_locations

Your location names, to show where returned stock was received.

read_shopify_payments_payouts

Shopify Payments payouts and the balance transactions inside them, to check each payout against its transactions.

read_shopify_payments_accounts

Access to the Shopify Payments account that payouts and balance transactions are read through.

Shopify limits how far back an app can read orders to 60 days unless it has approved access to full history. Clawback only reads further back if Shopify has granted that access to this app.

Clawback does not request a customer permission, and its queries to Shopify do not ask for any customer, email, phone, address or order-note field. It has no way to read your customer list, and it is never sent a customer’s name or contact details.

This is a design decision rather than an oversight. Working out what a refund really cost you needs amounts, products, dates and statuses. It has no use for a person, so we never collect one.

Clawback keeps a copy of the order data it needs, because finding a loss means comparing an order with its refund, its return, its stock movement and its payout, sometimes weeks apart. Here is exactly what is kept:

Orders

Order number (such as #1042), dates, statuses, totals, discounts, taxes and shipping charged; line items with product title, variant, SKU, quantity and price.

Payments

The payment gateway’s name (for example shopify_payments), amounts, and the processing fees Shopify reports. No card numbers, and nothing about the person paying.

Refunds and returns

Amounts, items, refund reasons, return status and reasons, restocking fees, return shipping fees, the carrier name on a return label, and whether the label has tracking. Tracking numbers are not stored.

Inventory

Stock quantities per item per location, unit costs, and where returned items were put back.

Payouts

Shopify Payments payout amounts and dates, and the balance transactions inside each payout.

What we work out

The costs, recoveries, issues, evidence and reports we calculate from the above, and the calculation version that produced them.

None of this contains a customer’s name, email address, phone number, postal address or order note. An order number such as #1042 does not identify a person on its own, but anyone with access to your Shopify admin can open that order and see who placed it, so treat Clawback’s screens the way you treat your orders page.

Notifications from Shopify. When an order changes, Shopify sends us a notification. We use it as a trigger and read the current data from Shopify. We keep only an identifier for the record it points to, any stock quantity it carries, and a fingerprint of the notification. The notification body itself is not stored.

Three kinds. None of it belongs to your customers.

Your shop record

Your shop’s domain, name, currency, timezone, Shopify plan, the permissions you granted, and install dates. Plus the access token Shopify gives the app so it can read your store. The token is encrypted (AES-256-GCM) with a key held outside the database, is never written to logs, and is deleted the moment you uninstall.

Your plan

Which Clawback plan you are on and when a trial ends, read from Shopify. Billing runs through Shopify, so we never see or store payment details.

Report email address

Only if you type one into Settings. Email delivery is not switched on yet, so nothing is sent: reports appear in the app, and the address is kept so it is ready if we switch email on.

What you type

Shipping and product costs you enter, and the notes you attach to them or to an issue. These are your own business notes. Please don’t put customer names or contact details in them.

Clawback uses your store’s own access token rather than a token for each staff member, so it does not receive or store the name or email address of the person using it.

• We do not sell your data, or anyone’s, to anyone, under any circumstances.
• We do not share your data with other merchants. Every query in the app is scoped to your shop, using an identifier taken from your signed Shopify session and never from a web address or form. Automated tests check that one store cannot read another’s data.
• We do not use your data to train models, ours or anyone’s.
• We do not send marketing to your customers, and could not: we hold nothing that can contact them.
• We do not use advertising or analytics cookies, tracking pixels or third-party analytics. The app’s screens load their font and Shopify’s own admin scripts from Shopify’s content network (cdn.shopify.com), and nothing else from a third party.
• We do not change your store, refund or charge your customers, or contact them.

Shopify sends every app three notifications: a customer asks what data an app holds about them (customers/data_request), a customer asks for it to be erased (customers/redact), and a shop is to be erased 48 hours after it uninstalls (shop/redact). We respond to all three automatically.

For the first two the answer is that we hold nothing to disclose or erase, because we never collect customer names, contact details or addresses (section 3). We acknowledge each request and record that we did. The third deletes everything we hold for your shop (section 8).

Your access token

Deleted immediately when you uninstall the app. The token is dead at that moment anyway.

Notification records

The identifier-only records described in section 4 are deleted after 90 days once processed. Records of a notification that failed are kept so we can diagnose it, until your shop is deleted.

Stock snapshots

The stock quantities we compare over time are deleted after 120 days.

Everything else

Orders, refunds, returns, payouts, calculations, issues, reports, settings and history are kept while the app is installed. Everything is deleted in full 48 hours after you uninstall, when Shopify sends the shop redaction notification. It is not recoverable afterwards.

The 48 hour gap is Shopify’s, not ours, and it exists so that a merchant who uninstalls by accident and reinstalls the same day gets their history back. If you want your data deleted sooner, email dev@watacle.com and we will do it.

• All traffic is over HTTPS.
• The app can only read your store. Its Shopify connection rejects anything that would change it.
• Your Shopify access token is encrypted with AES-256-GCM in our database, with the key held outside the database. A copy of the database is not a set of working credentials for your store.
• Access tokens, secrets, email addresses and similar fields are redacted from our logs, and raw notification bodies are never logged or stored.
• Database encryption at rest: AES-256, applied by the database host (Neon) to all stored data
• Access to production is limited to the people who operate the service. If we become aware of a breach affecting your data we will tell you without undue delay, and in any case within 72 hours of becoming aware of it.

Clawback runs in the eastern United States. These are the only third parties that can reach your data, and each is bound by its own data protection terms:

Vercel Inc.

Runs the app, its background jobs and its scheduled tasks · United States (Washington, D.C.)

Neon (a Databricks company)

Managed PostgreSQL: all merchant data, and the job queue, live here · United States (Northern Virginia)

Email delivery is switched off, so no email provider handles your data. We will add one to this list before we switch it on.

Shopify is not on this list because Shopify is where your data already is. We read from it; we send it nothing. We will update this page before adding a sub-processor, not after.

Clawback is operated from Zimbabwe and your data is stored in the United States, so using the app means your data is transferred there. It is held only by the providers above, under their data protection terms, and is never moved anywhere else.

Depending on where you are, you may have the right to access, correct, export or delete personal data we hold about you, to object to processing, or to complain to a data protection authority. We are subject to Zimbabwe’s Cyber and Data Protection Act, whose authority is the Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ); you may also complain to the authority where you are. Email dev@watacle.com and we will respond within 30 days.

For personal data belonging to your customers, you are the controller and the request should come through you. We will help with any such request, though as set out above the honest answer is usually that we hold nothing.

If this policy changes in a way that affects what we collect or what we do with it, we will tell you inside the app before the change takes effect. Cosmetic changes we will just make.