Privacy Policy
Compass Subscriptions — last updated 19 July 2026.
Who we are and our role
Compass Subscriptions (“the App”) is a subscription and loyalty application for Shopify stores, operated by Ecropolis LLC.
When a merchant installs the App, the merchant is the data controller for their customers’ personal data and we are a data processor acting on their instructions. We do not decide the purposes for which a merchant’s customer data is used, and we do not use it for our own purposes.
Where we process a merchant’s own account details (store domain, billing status), we act as a controller.
What we process
About a merchant’s customers
We store the minimum needed to operate a loyalty and subscription programme:
| Data | Why | Source |
|---|---|---|
| Shopify customer ID | The only identifier we key on. Every record hangs off it. | Shopify |
| Email address | Identifying a member in the merchant’s admin, member search, and matching the same person across the merchant’s connected apps | Shopify |
| Name | Displaying and searching members in the merchant’s admin | Shopify |
| Points balance, ledger entries, tier | Operating the loyalty programme | Generated by the App |
| Subscription contract state (status, cadence, next billing date, renewal count) | Operating subscriptions | Shopify |
| Activity history (purchases, renewals, event attendance, survey completions) | Awarding points and computing tiers | Shopify and the merchant’s other connected apps |
We do not store payment card details, addresses, or order line contents. Payment methods remain in Shopify’s vault; the App references them by identifier only.
About merchants
Store domain, Shopify shop ID, installed plan, subscription/billing status, and an encrypted Shopify access token.
What we do not do
- We do not sell personal data. There is no mechanism to do so.
- We do not send marketing messages. The App sends only transactional messages relating to a customer’s own subscription or account. Marketing communication is handled by a separate application the merchant may optionally connect.
- We do not use personal data to train machine learning models.
- We do not combine data across merchants. Every record is scoped to a single store, enforced at the database level.
Automated decisions
The App automatically awards loyalty points and assigns tiers based on rules the merchant configures. These decisions affect discounts and rewards only. They produce no legal or similarly significant effect, and a merchant can adjust any customer’s balance or tier manually.
Where data is stored
On Cloudflare’s global network (Workers and D1), with the primary database in the Western North America region. Data may be processed at Cloudflare edge locations worldwide.
Sub-processors
| Sub-processor | Purpose |
|---|---|
| Cloudflare, Inc. | Application hosting, database, queueing |
| Shopify Inc. | Source of merchant and customer data; order and billing processing |
| Compass, operated by Ecropolis LLC | Optional. Where a merchant connects it, the App forwards loyalty and subscription events for marketing automation |
We will give merchants notice before adding a sub-processor.
Security
- All traffic is encrypted in transit (TLS).
- Data is encrypted at rest by Cloudflare.
- Shopify access tokens are additionally encrypted with AES-256-GCM before storage, so a database copy alone does not yield access to a merchant’s store.
- Access to a merchant’s data through the App requires an authenticated, cryptographically signed admin session tied to that store.
- Reads of personal data are logged.
- Production, development, and test data are kept in separate databases.
Retention
Personal data is retained only as long as needed, enforced by an automated nightly process rather than by policy alone:
| Data | Default retention |
|---|---|
| Activity history | 24 months |
| Forwarded event queue | 90 days |
| Webhook delivery records | 90 days |
| Audit and access logs | 24 months |
| Inactive member records | Retained unless a merchant enables removal |
Records tied to an outstanding points balance or an active subscription are never removed by this process. Merchants may shorten these periods.
When a merchant uninstalls the App, Shopify notifies us and all of that store’s data is deleted.
Customer rights
A merchant’s customers should contact the merchant to exercise their rights, as the merchant is the controller. We respond to requests forwarded to us through Shopify’s standard mechanisms:
- Access: on a
customers/data_requestwe report every record we hold for that customer so the merchant can fulfil the request. - Erasure: on a
customers/redactwe delete that customer’s member record, points ledger, activity history, subscription mirror, and any queued events carrying their identifiers. - Store erasure: on a
shop/redactwe delete all data for that store.
These run automatically and are covered by automated tests asserting that no table holding customer data escapes deletion.
Consent
Installing the App or subscribing to a product is not treated as consent to marketing. Where the App captures a marketing consent decision, it records it and forwards it; it does not infer consent from a transaction.
Changes
We will post changes here and update the date above. Material changes will be notified to merchants.
Contact
[email protected] — 8001 Valcasi Dr. Ste 101, Arlington, TX 76001,
USA
⟨EU/UK representative, if required⟩