Ctrl Z · Waslio Connect

Merchant data terms

Effective 24 September 2026. These terms apply to Ctrl Z: Store Activity & Undo and supplement its privacy policy. The operator is Mohamed Elsawy trading as Waslio Connect. For a separately signed agreement or questions about data processing, contact founder@waslioconnect.com.

Roles and instructions

The merchant determines the purposes of processing personal data in its store. We process store data on the merchant's behalf to provide the features the merchant chooses: activity history and differences, supported schedules and restores, sales comparisons around changes, configured alerts, security, and support. We do not sell store or customer data or use it for unrelated advertising.

The merchant is responsible for required notices to shoppers and staff, its lawful basis for processing, and responding to their rights requests. We assist with verified requests concerning data in Ctrl Z.

Data and retention

We process shop identity, Shopify app access information, supported product, inventory, collection, discount, theme, and order activity, before-and-after snapshots, available staff attribution, merchant settings, alert destinations, and subscription and usage records. Order processing uses identifiers, status, line-item quantities, variant IDs, and amounts. We do not need shopper names, addresses, email addresses, or phone numbers for these features. Merchant-authored fields can contain incidental personal information.

Activity events expire under the plan's 14-, 90-, or 365-day history window. Current snapshots and operational records may remain while the app is installed where needed for change detection, restoration, security, billing, and support. On Shopify's shop-redaction request after uninstall, we delete the store's app records and stored snapshots, subject to backup and provider-log expiry. Customer-redaction requests remove matching order snapshots and redact related order activity.

Security and service providers

We restrict access to operational needs and use encryption in transit and at rest for customer data. Job bodies are encrypted before they enter the background queue. Fly.io hosts the app; Neon stores the database; Upstash handles queued work; Tigris stores snapshots; and Shopify supplies platform access and app billing. We remain responsible for our use of these providers and will reflect material provider changes in the privacy policy.

If we become aware of a confirmed security incident affecting a merchant's personal data, we will notify the merchant without undue delay, share reasonably available facts and updates, and cooperate with reasonable investigation and remediation requests. The merchant remains responsible for any notifications it owes to shoppers or authorities.

Assistance

Merchants can request access, correction, export, or deletion assistance at founder@waslioconnect.com. We verify requests and coordinate with Shopify's privacy webhooks where applicable. Contact us before installing if you need separate contractual terms for cross-border processing.