This policy covers the Uddom CRO app (the "app") and this documentation site. It explains what data the app processes, why, who it is shared with, and how it is deleted.
Uddom is installed from the Shopify App Store by a merchant. When a merchant installs it, the merchant is the controller of their store's data and Uddom acts as a processor on their behalf.
What the app processes#
The app processes four kinds of data, and nothing else.
- Store and account data. Your shop domain, the plan the app is on, the settings you save for each module, your email templates, and your chosen email provider settings. Email credentials you supply are stored encrypted.
- Storefront analytics. Anonymous visitor and session identifiers generated by the app, the page path, and the events the app records (module shown, module clicked, add to cart, checkout started). These identifiers are not Shopify customer IDs and are not connected to a customer identity by the app.
- Customer data for abandoned checkout recovery. If you use the abandoned checkout recovery feature, the app reads the checkout's first name, last name and email address from Shopify so it can send the recovery email you configured. This is the only protected customer data the app reads. It is used for that email, and for the recovery reporting you see in the app.
- Email marketing data. The lists and contacts you create or import, the consent status you attest to for each contact, and the outcome of the emails the app sends for you.
Reviews you collect are stored as metaobjects inside your own Shopify store. Review imports are performed only when you start them, and an imported review is labelled with where it came from.
What the app does not do#
- It does not sell, rent or share your data for advertising.
- It does not build cross-store profiles.
- It does not show one shopper's name, email or address to another shopper. Social-proof features show the product and the real time of the purchase, never who bought it.
- It does not store the content of your customers' orders, payment details or addresses.
Who processes it#
Data is handled by these providers, only as needed to run the app:
- Shopify — the platform the app runs on and the source of all store, order and customer data.
- Fly.io — application hosting.
- Supabase — the managed PostgreSQL database that stores app settings, analytics events, lists and send logs.
- Your email provider — either the SMTP server you connect, or the Uddom-managed sending service, which is used only to deliver the email you asked the app to send.
- Review import providers — only when you run a marketplace review import, the product you select is requested from the import service named in the app.
Retention and deletion#
Analytics events are kept so the reporting in the app and the Insights area can show the periods you select. Email lists, contacts, templates and module settings are kept for as long as you use the app.
Deletion is handled through Shopify's standard data requests, which the app implements:
- Customer data request — the app returns what it holds for that customer so you can answer the request.
- Customer redact — the app erases that customer's data from its records.
- Shop redact — when this is sent after uninstall, the app erases the shop's data, including stored email credentials.
Uninstalling the app also stops its background processing. You can ask us to delete your data at any time using the contact address below.
Security#
Requests are served over HTTPS. Access to the app's Shopify APIs uses Shopify's session-token authentication. Email credentials you save are encrypted with a key held in the app's server environment, never returned to your browser, and never shown back to you after saving.
Changes and contact#
If this policy changes, the updated version is published on this page with a new revision date. Questions about it, or a data deletion request, can be sent to support@uddomcro.com.
Last updated: 11 October 2026.