1. Overview & Commitment
ToroSachi ("we", "our", or "us") provides subscription billing management, customer portal self-service, dunning recovery, and analytics for merchants using the Shopify platform. This Privacy Policy details how we handle merchant and subscriber data when you install and use the ToroSachi Control Center application.
2. Data We Collect
To deliver subscription management and billing services, ToroSachi collects data via Shopify's standard Admin and Storefront APIs strictly within authorized scopes:
- Merchant Account Information: Store domain, merchant contact email, timezone, currency, and store identifier.
- Subscription & Order Information: Subscription contract identifiers, line items, billing schedules, order totals, and fulfillment statuses.
- Subscriber Information: Customer identifiers, names, shipping addresses, customer emails and phone numbers (used solely for order and failed-payment recovery notifications and portal authentication), and tokenized payment method references provided securely by Shopify. We never see or store full card numbers.
3. How We Use Data
Collected data is used solely to provide core subscription services, including:
- Executing scheduled recurring billing cycles via Shopify Subscription APIs.
- Powering self-service subscriber management in the customer portal (pause, skip, swap, frequency adjustments).
- Automating failed payment dunning recovery and retry cadences.
- Delivering store-level subscription retention and cohort analytics.
4. Email We Send on a Merchant's Behalf
Failed-payment recovery emails are transactional notices about the customer's own subscription. By default they are sent from our shared, authenticated sending domain mail.torosachi.com, with the store's name as the sender name and, where we can read the store's contact address (from the merchant's settings or from Shopify), that address as the reply-to so replies reach the merchant. A merchant may instead send from their own domain. These notices carry no marketing content and no third-party advertising.
5. SMS / Text Messaging Program
When a customer consents directly to ToroSachi, ToroSachi sends transactional text messages about subscriptions the customer manages through the ToroSachi customer portal (for example, a failed-payment notice with a secure payment-method update link). A message may name the store tied to the affected subscription so the customer knows which subscription needs attention; ToroSachi remains the sender of the messaging program. Message frequency varies with account activity and is capped. Message and data rates may apply. Customers can reply STOP at any time to opt out and HELP for help. Opt-outs are honored immediately and permanently unless the customer opts back in. To honor an opt-out permanently, the opted-out phone number itself is kept on a suppression list used only for that purpose. Phone numbers and consent records collected for this program are never shared with or sold to third parties for their marketing purposes; text-messaging originator opt-in data and consent are not shared with any third party.
6. Multi-Tenant Data Isolation & Security
We enforce strict multi-tenant isolation across all databases and caching layers. All merchant data is partitioned by unique tenant IDs, and all API calls require authenticated and scoped HMAC or cryptographic session tokens. We do not sell, rent, or cross-monetize merchant or customer data.
7. Service Providers (Sub-processors)
We use a small number of providers, each limited to the data its job requires:
- Amazon Web Services (AWS): hosting, databases, and encrypted storage for the services described above (United States).
- Mailgun: delivery of the transactional email described in section 4.
- Telnyx: delivery of the text messages described in section 5.
- Klaviyo: only when a merchant connects their own Klaviyo account; failed-payment events are then sent there at the merchant's direction.
- AI providers (OpenRouter, OpenAI, and Google Gemini / Vertex AI): only for optional AI-assisted features a merchant chooses to use, such as the in-app assistant and image tools.
- Attentive: only when a merchant who uses Attentive forwards their customers' text-message replies to us; we receive the reply (the customer's phone number and message text) to act on the customer's keywords, such as STOP, HELP, and subscription actions requested by text.
8. How Long We Keep Data
- Account and subscription data: kept while the app is installed and the subscription relationship lasts, then erased as described in section 9.
- Raw webhook archive: the encrypted copies of Shopify webhook payloads we keep for reliable processing and replay expire automatically after 25 days.
- Webhook processing records: copies of webhook bodies kept in our processing database are cleared after 7 days; records of webhooks that could not be processed are deleted, or scrubbed of their contents, after 30 days; messages waiting in the processing queue expire after 14 days.
- Data-request exports: files generated for a customer data request are deleted after 30 days.
- Compliance and transaction records: minimal records proving that a privacy request was honored, and transaction records required for accounting or dispute defense, are kept for as long as the law requires, with direct contact details removed wherever possible.
9. GDPR & CCPA Compliance (Access, Deletion & Redaction)
ToroSachi fully adheres to mandatory Shopify GDPR compliance protocols. We act on every request without undue delay; Shopify's rules require completion within 30 days:
- Customer Data Requests: When Shopify sends a customer data request, the customer's personal data held across our services is compiled and provided directly to the store owner, who is responsible for sharing it with the customer.
- Customer Redaction: When a customer redaction request is received via Shopify webhooks, the customer's personal records (contact details, captured emails, tracking logs, portal credentials, and notification history) are deleted or blanked of personal details across our subscription, billing, recovery, and analytics services.
- Shop Redaction: Upon app uninstallation and subsequent shop redaction requests, all store credentials, configurations, staff account details, and customer PII for that shop are permanently erased across the same services.
10. Contact Us
If you have questions about this Privacy Policy or your data, contact our data protection team at privacy@torosachi.com.