Ctrl Z · Waslio Connect

Privacy policy

Effective 24 September 2026. This policy applies to the Ctrl Z: Store Activity & Undo Shopify app. It does not cover other Waslio Connect products or the separate policy for the Waslio delivery app.

Who we are and what the app does

Mohamed Elsawy, trading as Waslio Connect, operates Ctrl Z. Merchants use it to record supported store changes, compare before and after values, schedule supported price changes, and restore supported changes. For store data, we process information on behalf of the merchant. Questions and privacy requests can be sent to founder@waslioconnect.com.

Our merchant data terms describe the processing arrangement for stores using Ctrl Z.

Information we process

• Store identity and app access information, including the shop domain, granted permissions, and the Shopify access token needed to operate the app.
• Store activity and snapshots for supported products, variants, inventory, collections, discounts, themes, and orders. These can include resource identifiers, timestamps, changed fields, before and after values, and content needed for supported restoration.
• Order-related identifiers, status, line-item quantities, variant identifiers, and monetary amounts needed for activity history and sales comparisons. Order, refund, and fulfillment webhook data is reduced to fields the app uses before it enters the processing queue. We do not need customer names, addresses, email addresses, or phone numbers for these features.
• Staff identifiers, names, or email addresses where Shopify makes them available for change attribution; attribution is sometimes unknown.
• Merchant settings, schedule and restore history, alert destinations, subscription state, and usage counters.

How we use and share information

We use this information to operate the activity timeline, detect changes, show differences, run requested schedules and restores, compare sales around a change, deliver configured alerts, provide support, and maintain the service. We do not sell store or customer data. The app does not install a shopper-facing tracking pixel.

Service providers process data for hosting and storage: Fly.io runs the app, Neon stores the database, Upstash handles background-job queues, and Tigris stores change snapshots. Shopify processes app installation, platform API access, and any approved app charges. We may disclose information when required by law or to protect the service.

Retention and deletion

Activity events are deleted according to the store's plan history window. Other operational records and current snapshots can remain while the app is installed because they support change detection and restoration; the history window is not a promise that every data type expires at that time. When Shopify sends a shop-redaction request after uninstall, we delete the shop's app records, sessions, and stored snapshots. Customer-redaction requests remove matching order snapshots and redact related order activity. Backups or provider logs may take additional time to expire under the providers' retention schedules.

Your choices and requests

Merchants can review available activity in the app, export it on plans that include CSV export, choose what alerts to configure, and uninstall the app through Shopify. For access, correction, or deletion requests involving store or customer data, contact your merchant first if you are a shopper or staff member. Merchants can contact founder@waslioconnect.com with the shop domain and request details; we will verify the request and work with the merchant and Shopify to respond. Do not send customer personal data in an initial email.

Security and updates

Access to app data is restricted to operating and supporting Ctrl Z. No internet service can guarantee absolute security. We may update this policy as the app changes; the effective date above identifies the current version. Material changes will be reflected here.