Our approach
Retention is based on purpose, merchant configuration, contractual obligations, security needs, and applicable law. A period below is a default or operational target, not permission for a Merchant to collect unnecessary information. Legal holds, fraud or security investigations, and mandatory accounting obligations may require limited longer retention.
Retention schedule
| Record | Normal period or trigger | End-of-life action |
|---|---|---|
| Merchant account, configuration, services, technicians | While the shop uses DFI; until authenticated shop-redaction after uninstall | Delete shop records and associated app sessions |
| Installation and repair jobs | While needed for active service, merchant records, disputes, and applicable obligations | Delete with shop or redact customer fields on a valid customer request |
| Completion photographs | Merchant-configurable; 180-day default from upload | Expired evidence becomes unavailable and is eligible for deletion |
| Private scheduling invitations and portal links | Until expiry, revocation, use, customer redaction, or shop deletion | Invalidate or delete token records |
| Temporary slot holds | 15 minutes unless confirmed or released earlier | Expire and cease blocking availability |
| Communication and delivery logs | While needed to demonstrate delivery, suppress duplicates, troubleshoot, or resolve disputes | Delete with shop; redact recipient details on matching customer request |
| Google Calendar connection | Until disconnected, technician removal, revoked authorization, or shop deletion | Delete encrypted tokens and connection metadata |
| Dollflow-created Google event references | While the linked job/calendar connection exists | Delete local reference; remove linked event when the active workflow permits |
| Shopify sessions | While required for authorized app access | Delete on uninstall/shop redaction or session expiry |
| Audit, security, and webhook receipts | Only as long as reasonably needed for security, reliability, compliance, and replay prevention | Delete or anonymize when no longer necessary |
Shopify privacy requests
Customer data request: DFI matches supported identifiers such as Shopify order IDs, normalized email, and normalized phone, then prepares the matching records for delivery through the verified merchant privacy process.
Customer redaction: DFI removes or redacts customer identity, contact details, address, access instructions, notes, completion records, evidence, private links, message recipients, provider references, and connected event references for matching jobs while preserving only non-identifying operational records where needed.
Shop redaction: DFI deletes the tenant shop and associated records after receiving Shopify’s authenticated request. Shopify normally sends this request after uninstall according to its platform schedule.
Google disconnection
Disconnecting Google Calendar deletes the encrypted OAuth connection from DFI and stops new synchronization. Where possible, DFI removes a linked event through the connected workflow before deleting its reference. Events remaining in Google Calendar are controlled through the connected Google account.
Backups and providers
Deletion from active systems may not immediately remove encrypted backup copies maintained for resilience. Backup data remains protected, is not restored except for recovery, and ages out under provider backup cycles. If restored, applicable deletion and redaction controls are reapplied.
Requests and exceptions
Customers should normally contact the Shopify merchant, which controls their job data. Merchants and Google-connected users can contact dollflowapp@gmail.com. We may verify identity and authority before acting. We may retain the minimum information required to establish, exercise, or defend legal claims or comply with law.