Privacy policy

AfterSale Suite for Shopify · last changed 20 September 2026

AfterSale is built and run by Ștefănică Ștefan Gheorghe PFA, a sole trader registered in Romania.

Questions, requests and complaints: contact@maste.ro. Every message is answered within 48 hours, even when the answer is "still looking".

What AfterSale processes

AfterSale works inside a merchant's Shopify store. It reads orders through the Shopify Admin API and writes to its own database only what it needs to do its job:

• Shopify identifiers: shop domain, order id, order name, line item ids, customer id. Identifiers, not names.
• What the buyer did: an edit to their order, a survey answer, a warranty registration, a withdrawal request, a delivery problem report, an offer shown or taken.
• Files the merchant or the buyer uploads: an invoice, a photo of a damaged parcel. These carry personal data as the person wrote it, so they are encrypted on disk.
• Email addresses, only where the feature is an email: a buyer's address is taken from the order at the moment the message is sent, and is not kept afterwards.
• About the merchant's own staff: the name and email address of the person who installed the app, and the access token Shopify issues for the store. Both come from Shopify at install and are needed to call the Admin API on the store's behalf.

AfterSale does not copy customer names, addresses or phone numbers into its own tables. When a screen shows a name, that name is read from Shopify while the screen is open. The one exception is text a buyer types themselves: a warranty field the merchant defined, a message on a delivery problem, a reason for a withdrawal. AfterSale stores those words as written, and cannot tell in advance whether a buyer put a name or an address in them.

Why

Each of those is processed for one purpose only: to run the feature the merchant switched on, and to answer the merchant when something goes wrong. Nothing is sold, shared for advertising, used to train a model, or combined with data from other stores.

Who else sees it

• Shopify Inc., because the data is the merchant's Shopify data.
• Contabo GmbH (Germany), the host of the single server AfterSale runs on, located in France.
• Purelymail (United States), which carries the transactional email AfterSale sends, when the merchant switched an email feature on.

There is no analytics provider, no advertising network and no other third party.

How long

• Photos of a delivery problem: 180 days, after which the row and the file on disk are both removed.
• The trail of who read personal data: 400 days.
• The proof that ties a buyer to their order: 120 days.
• The log of order changes: 90 days.
• Everything else, including withdrawal requests and warranty registrations: for as long as the app is installed, because the merchant needs them for as long as the underlying right lasts.

Uninstalling the app stops all processing at once and cuts AfterSale's access to the store. The rows themselves are deleted when Shopify sends the redaction request that follows an uninstall, which Shopify sends 48 hours later; at that point every row belonging to that shop is deleted and every uploaded file is removed from disk. A merchant who wants it sooner can write to contact@maste.ro.

Rights

A buyer's rights are exercised through the merchant, who is the controller of their data. Shopify's own customers/data_request, customers/redact and shop/redact webhooks are implemented and answered. A merchant can also write to contact@maste.ro directly.

Security

Data is encrypted in transit with TLS 1.2 or better. Uploaded files are encrypted at rest with AES-256-GCM, one key per installation, and are stored outside the web root, readable only over a link that is signed and expires in five minutes. Logs hold identifiers and error codes, never personal data. The database is dumped nightly, encrypted, and kept 14 days. One person has access to the server, over an SSH key; password login and root login are switched off.