Privacy policy

Last updated: October 26, 2026

This policy explains what the Post Purchase Surveys app (“the app”) stores, why, and for how long. Furvur Inc. (“we”) makes the app. The app is used by Shopify merchants (“merchants”) to survey the people who buy from them (“buyers”).

What we store about buyers

• The Shopify order ID that an answer belongs to.
• The buyer’s answers. Before we save a written answer, we automatically replace email addresses and phone numbers in it with [email] and [phone]. We also replace a name with [name] when it starts with a capital letter and follows a phrase such as “my name is”, “I’m” or “I am”, or when it ends the answer after a sign-off such as “Thanks,” or “Cheers,”. These rules run on all plans. On paid plans, an AI check then replaces remaining names, email addresses, phone numbers and street addresses with placeholders (see “AI features” below). If the AI check fails, or changes any other text, we keep the version from the rules. Other names can stay in the answer, so the survey asks buyers not to type personal details.
• The order total, so that merchants can see revenue and average order value for each answer.
• The date and time of each answer.
• Which survey, and which version of its questions, the answer belongs to.
• Whether the answer came in after the store reached its plan’s monthly answer limit. Such an answer is stored but hidden from the merchant, and it is not added to the order. If the store upgrades, the hidden answers from the current calendar month are shown, oldest first, up to the new plan’s limit. Hidden answers from earlier months stay hidden. Hidden answers follow the same retention period as all other answers.

The app does not store buyers’ names, email addresses, phone numbers or postal addresses, and we do not save IP addresses with answers. The app does not ask Shopify for access to customer records. When a merchant uses reminders, the app reads a buyer’s email address from the order in Shopify at the moment it is needed, uses it once, and does not store or log it (see “Reminders” below). Apart from the unsubscribe list described there, the only personal details we can hold are ones a buyer types into a written answer and our scrubbing misses.

A merchant can show a different survey, or different questions, based on the products in an order or its amount. To choose, the survey on the checkout pages reads the order’s product and variant IDs, its subtotal and its total in the buyer’s browser. It does not send them to the app: with the answers, it sends only the IDs of the survey and the questions it showed. When a store has such rules and a buyer opens a survey link, or a reminder is due, the app reads the same details from Shopify, uses them only to choose the survey, and then drops them. The products in an order are never stored, logged or exported.

Our hosting provider, Cloudflare, keeps short technical logs of requests to the app and of the app’s error messages. These logs can include IP addresses and store domains, and are deleted after at most 7 days. They contain no order IDs, no answer text and no questions asked to Ask AI. When an AI request fails, the log holds only the store domain, the day and the kind of error.

Answers are not anonymous. Each answer links to an order, and the merchant can see who placed that order in their Shopify admin.

What we store about merchants

• The store’s Shopify domain and currency.
• Shopify access tokens, encrypted, so the app can read order totals and the store’s products and collections, and add tags and answers to orders.
• The merchant’s survey questions and settings.
• Earlier versions of the survey questions: the titles, types, rating scales and option labels that the merchant wrote. They let the app show each answer with the question the buyer saw. We delete a version when no kept answer uses it, but we always keep the latest version and the last version of each question and option.
• For survey rules: the products, variants and collections that the merchant chooses (IDs and titles), and the product IDs in each chosen collection, refreshed once a day. This is catalog data, not customer data.
• The store’s app plan and subscription status, as Shopify reports them.
• The number of answers each month, to apply the plan’s limits.
• An access log: the time and the type of each export; each Ask AI question, recorded as ai:ask with the time only; each REST API read (api: and the endpoint); each AI client tool call (mcp: and the tool); and each AI client connection. The log never holds query values, order IDs, answer text, keys or tokens. We keep each entry for 365 days.
• The texts that the merchant writes for the survey on the checkout pages.
• On paid plans: the merchant’s Ask AI questions and the AI’s answers (the latest 20), and the weekly insights (the latest 12).
• For reminders: the reminder settings, and the merchant’s Klaviyo key, encrypted. For reminder emails from the merchant’s own domain: the domain, the From address and name, the Reply-To address, the DNS status, and a record that the domain belongs to the store. We delete these when the merchant removes the domain, or when we delete the store’s data.
• For the weekly summary email: the address that the merchant enters, if they enter one. Otherwise the app reads the store’s contact email from Shopify when it sends the summary.
• For webhooks: the merchant’s endpoints, and a delivery log of the last 50 deliveries with the time, the endpoint, the event and the status only.
• For the REST API and AI clients: API keys and tokens, stored only as hashes (see “Webhooks, the REST API and AI clients” below).
• Problems with adding tags or answers to orders: the time, and Shopify’s reason with any IDs removed. These records hold no order ID, and we delete each one after 90 days.
• Problems with webhook, Klaviyo, Shopify Flow, reminder email and weekly summary email deliveries: the time and a masked reason only, with no order IDs, email addresses or message content. We delete each one after 90 days.
• For stores that used the earlier version of the app: daily answer counts from that version, with no text and no revenue.

How long we keep it

Each merchant chooses a retention period of 7, 30, 60 or 90 days. New stores start at 30 days. Every night, the app adds answers up into daily totals: for each day and answer, the number of answers and the sum of their order totals. In the first nightly run after the retention period ends, the individual answers are deleted, including the text of written answers. So an answer can stay up to about one day longer than the retention period.

The daily totals stay, so that charts keep their history. They contain no order ID and no text. Next to them, the app keeps for each day and question the number of answered orders, the number of those with an order total, and the sum of those totals, for “Revenue with an answer” in Insights.

On paid plans, the app also groups written answers into themes every night, before the text is deleted. A theme is a name of 2 to 5 words, such as “shipping cost”, with a count for each day. The theme names and their daily counts stay after the text is deleted, like the other daily totals. Themes are automatic on paid plans, with no setting. The Free and Legacy plans have no themes.

To stop one order from answering twice, we keep the Shopify order ID of each answered order. We delete it when a buyer’s deletion request covers that order, or when we delete the store’s data.

For the response rate in Insights, the app counts every new order of the store on its day (UTC). The daily order counts hold no order IDs and stay while we keep the store’s data. To count each order only once, the app keeps the order ID and the time it was counted for 7 days, and then deletes them. We also delete them when a buyer’s deletion request covers that order, or when we delete the store’s data.

What we do with it

• Show merchants totals and charts for their own store, and, on the Answers page, the single answers that the app still keeps (the order ID, the scrubbed written answers and the order total). Answers that are hidden because of a plan limit are not shown.
• Let merchants download CSV exports: the individual answers that the app still keeps (with the order ID, a link to the order in Shopify, the question, the answer, the scrubbed written answer, the order total and the currency), and the daily totals. Exports never contain buyers’ names, email addresses, phone numbers or postal addresses, and they never contain answers that are hidden because of a plan limit.
• Add tags, when the merchant sets them up, and the buyer’s choice, checkbox, rating and NPS answers to the order in Shopify. For an “Other” answer, only the word “Other” is added. Written answers are never added to the order.
• On paid plans, make themes, scrub written answers, answer Ask AI questions and write weekly insights (see “AI features”).
• Send reminders and answer events through the merchant’s own tools, when the merchant turns them on (see “Reminders”).
• Send data to the merchant’s own webhooks, REST API clients and AI clients, on the merchant’s instruction (see “Webhooks, the REST API and AI clients”).

In the app’s reports, an answer given by fewer than 3 buyers is never shown on its own. The daily totals export uses the same rule for each day and question: such answers are merged into one “Small groups” row, or left out when that row has fewer than 3 answers. The REST API and AI clients get totals under the same rule, and the AI features get data only after it: themes with fewer than 3 answers are hidden in Insights. Only the answers export, the Answers page, webhooks, and the recent answers in the REST API and for AI clients list single answers, with their order IDs. Each answer is also attached to its own order in the merchant’s Shopify admin, through tags and the order’s app data. We do not sell data, and we do not use it for advertising.

AI features

On paid plans, the app uses Claude, an AI model made by Anthropic, through the Claude API (model claude-haiku-5-5). The Free and Legacy plans use no AI, and the app makes no AI calls for them. Anthropic gets only this:

• Themes: the text of written answers, after our scrubbing rules ran.
• Scrub assist: the text of written answers, after our scrubbing rules ran.
• Ask AI: the merchant’s question, and totals: the counts, shares, revenue and average order value of each answer group, the change against the period before, weekly counts and theme counts.
• Weekly insights: totals for 2 weeks.

Anthropic never gets order IDs, customer details from Shopify, the amount of a single order, or answers that are hidden because of a plan limit. Totals reach the AI only after the small-group rule: groups of fewer than 3 answers are left out. When a store has several surveys, each question is sent with its survey name, which the merchant writes. A written answer can still hold a name that our rules missed; scrub assist exists to remove such names.

Ask AI keeps the merchant’s latest 20 questions and the AI’s answers in the store’s data. Each question is recorded in the access log as ai:ask, with the time only. The number of questions each calendar month (UTC) is limited by plan: 50 on Starter, 200 on Growth, 500 on Pro and 1,500 on Scale. Weekly insights are made every Monday for paid stores with 3 or more answers that week. They are shown in the app, and the latest 12 are kept.

Reminders

On paid plans, a merchant can turn on reminders: a message with a survey link for buyers who did not answer on the checkout pages. For this, Shopify tells the app about each new order, and the app keeps only the order ID and the time the order was created. A pending reminder holds the order ID, the time it is due, and the time it was sent on each channel. We delete a finished reminder after 60 days.

Survey links in reminders point to v2.postpurchase.net/s/…, the app’s address. A survey link, and an unsubscribe link (/u/…), holds only the store and a random ID, so request logs contain no order IDs. The app keeps a record of each link in the store’s data: the random ID, its purpose, the order ID and the expiry date. A survey link works for 30 days and accepts one answer. Reminder unsubscribe links work for 365 days. Unsubscribe links in the weekly summary email work for 365 days and hold no order ID. We delete a link record when it expires, when a buyer’s deletion request covers the order, or when we delete the store’s data.

Reminders go out through the merchant’s own tools:

• Klaviyo: when a reminder is due or a buyer answers, the app reads the buyer’s email address from the order in Shopify and sends it once to the merchant’s own Klaviyo account, with the order ID, the order number, the survey link and the choice answers. Written answers are never sent. The app does not store or log the email address.
• Shopify Flow: the app sends Flow the order ID, a survey link and the time the reminder is due. When the merchant turns on the Flow channel, the trigger “Post-purchase survey answered” also sends Flow the order ID and the chosen answers and ratings as text. Flow never gets written answers or customer details.
• Webhooks, on the Pro and Scale plans (see “Webhooks, the REST API and AI clients” below).

Reminder and answer events (to Klaviyo, Shopify Flow and webhooks) also carry the survey’s ID and name, which the merchant writes. To stop the same event from going out twice, the app keeps a “sent” mark (the order ID or the week, and the destination) for up to 60 days. We delete these marks when a buyer’s deletion request covers the order, or when we delete the store’s data.

Reminder emails from the merchant’s own domain are not available yet. When a merchant uses them, they work like this. When a reminder is due, the app reads the buyer’s email address and the order name from Shopify, and uses the address in one request to Amazon SES, which sends the email from the merchant’s own verified domain. Then the app drops the address: it is not stored or logged. The emails have no tracking pixels and no click tracking. Amazon SES reports only bounces and complaints back to the app, through Amazon SNS. Such a notice contains the email address. The app uses it only in memory to make the hash for the store’s block list (below), and never stores or logs it. A permanent bounce or a complaint stops further reminder emails from that store to that address; a temporary bounce changes nothing.

When a buyer unsubscribes, the app reads the email address from Shopify at that moment and stores only a one-way keyed hash of it (HMAC-SHA256, with a different key for each store) and the time. We keep the hash while we keep the store’s data, so that the unsubscribe stays in force, and we delete it when we delete the store’s data.

“Send a test” on the Reminders page reads the store’s own email address from Shopify when the merchant clicks it, and sends one reminder email with sample values to that address only, from the merchant’s domain. The address is not stored or logged. The app counts test sends for the current UTC day, with no address, and allows at most 5 a day. Each sending domain in Amazon SES carries a tag with its store. If Amazon SES cannot delete a domain when we delete the store’s data, the domain record and the former store domain stay until a daily retry deletes the domain from Amazon SES. These records hold no customer data.

postpurchase.net never sends email to buyers. The weekly summary email to merchants is not available yet. When a merchant on a paid plan turns it on, it comes from digest@summary.postpurchase.net through Cloudflare Email Sending, to the store’s contact email (read when the summary is sent) or to an address the merchant enters. It holds short points and a link to the app, with no attachments and no survey data, and it has an unsubscribe link.

Webhooks, the REST API and AI clients

On the Pro and Scale plans, a merchant can send survey data to their own systems, and read it with their own tools:

• Webhooks: order IDs, choice answers, ratings and scrubbed written answers, and weekly summaries, go to endpoints that the merchant chooses.
• The REST API (with API keys) and AI clients such as Claude (through the MCP server, connected with OAuth) can only read. They get the same data as Insights and the CSV exports: totals with groups of fewer than 3 answers hidden (daily totals as in the CSV export), and recent answers by order ID with scrubbed written answers. They get only answers within the retention period, never answers hidden because of a plan limit, and no customer details.

When a merchant connects an AI client or uses an API key, survey data, including order IDs and scrubbed written answers, goes to that tool on the merchant’s instruction, under the merchant’s own account with that provider.

We store API keys and OAuth codes and tokens only as SHA-256 hashes: API keys (with a name, the last 4 characters, and when the key was created and last used), access tokens (valid for 1 hour), refresh tokens (30 days, replaced at each use), authorization codes (5 minutes) and connection codes (10 minutes). For each registered AI client, we keep its name and redirect addresses. We delete a registration that is not used within 1 day.

To stop abuse, the app counts wrong connection codes for each IP address, and allows at most 20 client registrations per hour from one IP address. For this it keeps only a SHA-256 hash of the IP address, never the address itself: for 15 minutes for connection codes, and for about 1 hour for registrations.

The access log records each API read, each AI client tool call and each AI client connection (see “What we store about merchants”). Revoke and Disconnect take effect at once. A downgrade or an uninstall stops access at once. We delete all keys, tokens and registrations when we delete the store’s data.

Where it is processed

The app runs on Cloudflare, at v2.postpurchase.net. Answers and settings are stored in Cloudflare. An export file is stored in Cloudflare, can be downloaded through a private link for 15 minutes, and is deleted within about an hour after that. Shopify provides the order data. On paid plans, Anthropic processes the data listed under “AI features”, through the Claude API. When you write to support@postpurchase.net, your message is kept in our mailbox at Fastmail.

When a merchant uses reminder emails from their own domain (not available yet), Amazon SES gets the buyer’s email address and the message, and Amazon SNS carries bounce and complaint notices from Amazon SES to the app. When a merchant uses the weekly summary email (not available yet), Cloudflare Email Sending gets the merchant’s address and the message. Klaviyo, Shopify Flow, webhooks, API clients and AI clients get data only when the merchant connects them; they are the merchant’s own tools, under the merchant’s own accounts.

Who is responsible

For buyers’ answers, the merchant decides what the survey asks and how long answers are kept. The merchant is the controller of that data, and we process it on the merchant’s behalf. For merchants’ own account data, we are the controller.

Deletion requests

We handle Shopify’s privacy requests. When a buyer asks a merchant to delete their data, Shopify tells us which orders are affected, and we delete the answers and order IDs for those orders. Daily totals that were already made stay: they hold only counts and sums for each day and answer, with no order ID. Tags and answers that were already added to an order belong to the merchant’s order in Shopify, and the app does not remove them.

When a merchant uninstalls the app, Shopify asks us to delete the store’s data about 48 hours later, and we delete all of it, including the plan and subscription records.

When a buyer asks for a copy of their data, we have no names or contact details to send. Answers are linked only to an order ID, and the merchant can see them on the order in Shopify.

Buyers who want their answers deleted can ask the store they bought from, or write to us at the address below.

Contact

Write to support@postpurchase.net.