Kombi is a Shopify app that ships several unfulfilled orders from the same customer to the same address together in one shipment. It does this by placing holds on, and later fulfilling, the orders' fulfillment orders. It never edits, cancels or refunds an order. This policy explains what data Kombi processes, why, how long it is kept and who can access it.
The short version: Kombi stores Shopify IDs and a one-way keyed hash of the shipping address. It does not store customer names, email addresses, phone numbers or readable addresses.
1. Who is responsible
Kombi is operated by Philip Rettig, a sole trader based in Sweden ("we", "us").
- For customer data (data about the shoppers of a store that installed Kombi), the merchant is the controller and we are a processor acting on the merchant's instructions under Article 28 of the EU General Data Protection Regulation (GDPR). We only use that data to provide the app's function to that merchant.
- For merchant data (the store's account with Kombi), we are the controller.
Contact: Philip Rettig, Sweden. contact@usekombi.com. Privacy requests are answered within 30 days.
2. What data we process
Kombi receives data from Shopify only, through the Admin API and webhooks, for stores that installed the app. It requests the minimum access it needs: reading orders, customers and locations, and reading and managing merchant-managed fulfillment orders. It has no access that would let it edit, cancel or refund orders.
What we store
| Data | Why |
|---|---|
| The store's myshopify.com domain, granted access scopes, plan and app settings (merge window, matching mode) | To identify the store and run the app with its settings |
| The store's Shopify access and refresh tokens, encrypted (AES-256-GCM) | To call the Shopify Admin API on the store's behalf |
| Order IDs and order numbers (such as #1001), the Shopify customer ID, fulfillment location ID, fulfillment order IDs, hold IDs, timestamps and an eligibility reason | To find orders that can ship together, hold them, and release only Kombi's own holds |
| A keyed hash (HMAC-SHA256, with a secret server key and the store's domain) of the normalized shipping address | To tell whether two orders go to the same address without storing the address. The hash cannot be turned back into an address. |
| Merge groups and an append-only audit log: which orders were grouped, held, shipped or undone, when, and by whom (the system, a webhook topic, or the numeric Shopify staff user ID that pressed a button) | So the merchant can see and undo what the app did, and so every change can be traced |
| Webhook delivery records: webhook ID, event ID, topic, store domain, time received | To process each Shopify notification exactly once |
| Records of GDPR data requests: the request ID and the IDs we hold for that customer | To answer the merchant's data requests |
What we do not store
- Customer names, email addresses or phone numbers.
- Shipping or billing addresses in readable form.
- Order line items, prices, payment details or notes.
When the app shows order details to the merchant inside Shopify admin (for example the customer's name, the address or the items), it fetches them from Shopify at the moment the page loads and does not store them.
Logs
Application logs record technical events: webhook topic, store domain, webhook ID and Shopify order IDs. They never contain request bodies, names, email addresses, phone numbers, addresses or tokens. The web server's access log records the time, the requested path without its query string, the response status and a shortened IP address (the last part is removed). Logs are kept for at most 14 days.
3. Purpose and legal basis
- Customer data is processed only to combine and ship the merchant's orders and to keep an audit trail of that, on the merchant's instructions. The merchant determines the legal basis towards its customers (typically performance of the purchase contract). We never use customer data for our own purposes, marketing, profiling or analytics, and we never sell or share it.
- Merchant data is processed to provide the app the merchant installed (GDPR Article 6(1)(b), performance of a contract) and to keep the service secure and working (Article 6(1)(f), legitimate interest).
4. How long we keep data
| Data | Retention |
|---|---|
| Records of orders Kombi has seen that are not part of a merge group | Deleted 60 days after the order was last seen |
| Merge groups and the audit log | For as long as the app is installed, so the merchant can review what happened |
| Access and refresh tokens | Deleted when the app is uninstalled |
| Everything about a store | Deleted when Shopify sends the
shop/redact request, which Shopify sends 48 hours after the app
is uninstalled. We delete the data as soon as we receive it. |
| Database backups | Nightly, kept for 14 days, then deleted. Data deleted from the database disappears from backups within 14 days. |
| Logs | At most 14 days |
5. GDPR requests from Shopify
Kombi handles Shopify's mandatory privacy webhooks:
- customers/data_request: we record the request and the data we hold about that customer (Shopify IDs, order numbers, and merge and audit records) so the merchant can provide it. We do not store the email or phone number contained in the request.
- customers/redact: we delete that customer's order records and group memberships, clear the customer ID from groups, and remove their order IDs from the audit log. If a group with their orders is still on hold, Kombi releases its own holds first and then removes the data.
- shop/redact: we delete all data about the store.
Customers who want to access, correct or delete their data should contact the store they bought from. The store's request reaches us through Shopify and is handled as described above.
6. Where data is stored and who processes it
All data is stored and processed in the European Union. We use one subprocessor:
| Subprocessor | Purpose | Location |
|---|---|---|
| Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany | Server hosting (application, database and backups) | Germany or Finland (EU) |
Shopify is the platform the merchant uses and the source of the data; it is not our subprocessor. We do not transfer personal data outside the EU/EEA. We will update this list before adding a new subprocessor.
7. Security
- All traffic to Kombi uses HTTPS (TLS) with automatically renewed certificates.
- Shopify access and refresh tokens are encrypted at rest with AES-256-GCM, bound to the store they belong to.
- Addresses are stored only as keyed hashes. Every Shopify webhook is verified by its signature, and every request from the app inside Shopify admin by a Shopify session token.
- The database is not reachable from the internet. Server access is restricted to the operator over a private network, and secrets are readable only by the system administrator.
8. Your rights
Under the GDPR you have the right to access, correct, delete, restrict and port your personal data and to object to processing. Customers of a store should contact that store (see section 5). Merchants can contact us as shown in section 1. You can also complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, imy.se) or the data protection authority where you live.
9. Changes
We will post any change to this policy on this page with a new effective date, and tell merchants in the app before a material change takes effect.