Privacy Policy

1. Overview

AS Flow Mail ("the App") is a Shopify application that lets merchants send custom HTML emails from Shopify Flow using the merchant's own SMTP credentials. This policy explains what data we process and why.

2. Data we process

• Shop identifiers — Shopify shop domain and session tokens required to authenticate the embedded app.
• SMTP credentials — host, port, username, and password provided by the merchant. Passwords are encrypted at rest (AES-256-GCM) and used only to send email on the merchant's behalf.
• Sender defaults — optional From name / From email configured by the merchant.
• Send metadata — timestamp, recipient address, subject, success/failure status, and error message. We do not store the HTML body of emails.
• Flow action payloads — fields the merchant configures in Shopify Flow (To, Subject, HTML body, optional From / Reply-To). HTML body is processed in memory to send the message and is not retained in our database.

The App does not request broad Admin API scopes for customer or order catalogs. Customer-related values appearing in emails are supplied by Shopify Flow when a workflow runs.

3. How we use data

We use the data solely to:

• Authenticate merchants inside Shopify Admin
• Deliver emails via the merchant's SMTP server
• Show recent send logs for troubleshooting
• Respond to Shopify mandatory privacy webhooks

We do not sell personal data. We do not use store data for advertising or unrelated analytics.

4. Merchant responsibilities

Merchants are the data controllers for emails they send. Merchants must ensure their use of the App complies with applicable laws (including anti-spam and marketing consent rules). The App is intended for transactional / operational messages triggered by Shopify Flow, not for unsolicited bulk marketing.

5. Data retention & deletion

• SMTP settings remain until the merchant updates them or the shop data is deleted.
• Send logs are kept for operational troubleshooting; merchants may request deletion via support.
• After app uninstall, Shopify sends a shop/redact webhook (typically after 48 hours). We then delete sessions, SMTP settings, and send logs for that shop.
• We honor customers/data_request and customers/redact webhooks for send-log metadata tied to a customer email.

6. Security

Access to the App is protected by Shopify authentication. SMTP passwords are encrypted before storage. Transport uses HTTPS for the App URL.

7. Subprocessors / infrastructure

The App runs on infrastructure operated by the developer (application hosting and MySQL database). Email delivery is performed through the SMTP provider chosen and configured by the merchant.

8. Contact

For privacy requests or questions, contact: support@adamssceptre.com.

App URL: https://mailflow.adamssceptre.com