Data, privacy and hosting
Legal documents and data-protection information for Workflow Suite. The documents open on our main website.
Data protection
- Data Processing Agreement (DPA) - the agreement for processing personal data on your behalf.
- Privacy Policy - what we process, where it is hosted, our sub-processors, and retention.
Company
Workflow Suite is made by Code Creation Labs GmbH. For a security questionnaire or a specific compliance question, email support@codecreationlabs.com.
Hosting
Workflow Suite is hosted in the European Union: Google Cloud, region europe-west1 (Belgium).
Sub-processors
| Sub-processor | What for | Where |
|---|---|---|
| Google Cloud | Hosting of the app and the data it stores | europe-west1 (Belgium) |
| Shopify | The platform the app runs in: store data, billing, authentication | As agreed between you and Shopify |
| Amazon Web Services (Amazon SES) | Sending the app's own alert emails to you: failure alerts, quota alerts, confirmation emails for alert recipients | eu-central-1 (Frankfurt) |
If you turn on text message alerts, the text messages to the phone numbers you verified are sent through a text message provider. The Privacy Policy is the binding list of sub-processors.
Emails your workflows send do not go through us. The Send email step sends through your own sender, the mail server or service you connected. That provider is yours, not our sub-processor. The same holds for every system a workflow calls with an HTTP request, a chat message or a file transfer: you choose where your data goes.
What is stored, and how
- Run data. The event that started a run and the results of its steps are stored so you can see and repeat runs. They can contain personal data, for example an order's customer. Run data is stored encrypted, and deleted after the run history period of your plan (30 to 180 days).
- Secrets, sender logins and your store's access token are encrypted with a dedicated key management service. A secret's value cannot be read back through the app or the API.
- Filled-in step fields are not stored with a real run. Secret values are masked in step results and error messages.
- Change triggers keep an encrypted copy of the fields they watch, to find out what changed. It exists only while a workflow that needs it is turned on.
- The email send log keeps the number of recipients, not their addresses.
- Storefront behaviour triggers only receive events from visitors who gave analytics consent. The only shopper identifier an event carries is the customer id of a signed-in customer.
Deletion
- You can delete workflows, files, secrets, key-value entries and senders yourself at any time.
- After you uninstall the app, Shopify asks us to erase your store's data, and we delete it.
What the Developer API returns
Run data returned over the Developer API is masked for personal data. The masking is a heuristic: it recognises typical fields and patterns such as names, email addresses, phone numbers and addresses, but free text can still hold personal data. Treat API keys accordingly. See Developer API and MCP.