Last updated: April 2026
Stashback ("we", "us", or "our") provides a backup and restore service for Shopify merchants. This Privacy Policy explains what data we collect, how we use it, and your rights in relation to it.
Stashback is operated by Stashback Ltd. Our service is accessible at mystashback.com and through the Shopify App Store. For privacy enquiries, contact us at our contact page.
When you run a backup, we retrieve data from your Shopify store via the Shopify Admin API and store it as an encrypted archive. Depending on your plan, this may include:
This data is yours. We access it solely to perform the backup and restore services you request.
If you contact us via our website form, we collect your name, email address, and message. This data is used solely to respond to your enquiry.
We do not sell your data. We do not use your store data for advertising or analytics.
Backup archives are stored in Cloudflare R2 object storage. Pro plan merchants have their backups stored in both US and EU regions simultaneously. Operational data (subscription records, job metadata) is stored in a PostgreSQL database hosted on Heroku.
Access to stored data is restricted to authenticated requests. Shopify access tokens are stored encrypted at rest.
Backup archives are retained according to your plan's history limit (e.g. 30, 90, or 365 days). Older backups are automatically deleted when a new backup would exceed your plan's storage cap.
When you uninstall Stashback, your session data is immediately deleted. All remaining data — backup archives and account records — is permanently deleted 48 hours after uninstall, in accordance with Shopify's GDPR requirements.
Under GDPR and applicable data protection law, you have the right to:
To exercise any of these rights, contact us via our contact page.
Your backup archives contain personal data belonging to your customers (names, email addresses, order history). You are the data controller for this information; we process it as a data processor acting on your behalf.
When Shopify notifies us of a customer data deletion request (customers/redact), we log the request. Note that backup archives are point-in-time snapshots stored as binary files — individual customer records cannot be selectively redacted from an existing archive. If a customer requests complete erasure, we recommend deleting all backup archives that may contain their data from within the app.
The Stashback web app (embedded in Shopify admin) uses a session cookie to maintain your authenticated session. Our marketing website (mystashback.com) does not use tracking or analytics cookies.
We may update this policy from time to time. Material changes will be notified via the app or by email. Continued use of the service after changes constitutes acceptance of the updated policy.
For any privacy-related questions or requests, please use our contact form.