Shopify customer data: how Clearbox processes it

1. Roles

You, the merchant, are the data controller for your customers' data. Clearbox is your processor: it processes that data only to provide the service described on this page and on your instructions, given through the app's settings and the actions of your team.

• Processor: Yao Elom ESSAN, entrepreneur individuel (individual entrepreneur, micro-enterprise), operating the Clearbox brand. Full identification in section 8 of the privacy policy and in the legal notice.
• Contact for anything about this notice: contact@getclearbox.com.

2. Purpose

Clearbox processes your customers' data for a single purpose: customer service for your store, first of all replying to order-status questions (« where is my order », WISMO) from your support inbox. In practice this means:

• Showing the customer card and order history next to a customer's email in your inbox.
• Drafting replies to order-status and refund-status questions, grounded in the Shopify order.
• Letting your team act on an order from the inbox (refund, cancellation, return, exchange, order note, shipping address), each action being triggered by a person.
• Clearbox does not sell your customers' data, does not share it with third parties for their own purposes and does not use it for advertising, profiling or marketing.

3. Data categories

Clearbox reads the following data from your store through the Shopify Admin API, with the access scopes requested at install, and keeps a copy in its database so that the inbox can display it without calling Shopify each time. When Shopify has approved the app for them, the orders/create, customers/create and customers/update webhooks keep that copy up to date.

• Customers: Shopify customer id, email address, first and last name, default address (including its telephone number), number of orders, total spent and date of the last order.
• Orders: order number, customer email, dates, payment and fulfilment status, amounts and currency, line items (product, SKU, quantity, price), shipping address (name, address, telephone), fulfilment tracking (carrier, tracking number, tracking link), refunds, order note and tags.
• Support conversations: the emails your customers send to the mailbox you connected (sender, recipients, subject, body, attachments) and the replies your team or Clearbox sends.
• Data derived by Clearbox: the detected intent of a message, the drafted reply, the review decisions of your team, and one access log entry for each read of customer data (see section 8).

4. Role of AI

Clearbox uses an AI model only to draft replies. It never decides anything on its own about a refund, a cancellation, a return or an exchange.

• What the model receives when your team asks for a draft: the customer's message (subject and body), the customer's name, the order number, the order status, the tracking link, the language of the message, and the intent, risk level and action type Clearbox detected. Nothing else.
• AI provider: Anthropic (Claude API) is the provider the code uses by default. The code can be configured on the server to use another provider instead (OpenAI, Google Gemini or a self-hosted Ollama model).
• Automatic sending is off by default: depending on your plan, a store starts in « off » or « shadow » mode, and neither sends anything. In shadow mode, Clearbox drafts the reply and records whether it would have sent it; a person always sends.
• You can turn automatic sending on, in Settings, for order-status and refund-status replies only. By default that switch stays locked until your team has reviewed at least 20 shadow examples with an acceptance rate of 90 % or more and the built-in evaluation check passes. The owner of your Clearbox organisation can override that lock.
• Even when it is on, Clearbox sends an order-status reply only when a matching Shopify order exists, Shopify provides a tracking link, the order is not partly shipped, the carrier does not report the parcel as delivered or in trouble, the confidence score is above your threshold and the draft still contains the tracking link. A refund-status reply is sent only when Shopify already records the refund. Every other request goes to a person.
• Refunds, cancellations, returns and exchanges are never automatic: a person on your team triggers each one, and the refunds, returns and exchanges Clearbox pre-fills from a customer request can only be approved by an owner or admin.
• A kill switch turns all automatic replies off at any time. When a customer writes back on a thread where Clearbox replied automatically, automatic replies stop on that thread and a person takes over.
• Your customers can object to automated replies and ask for a person at any time: they ask you, as the controller, and your team answers them from the inbox. Clearbox never emails a customer on its own initiative; it only answers messages sent to your mailbox.

5. Subprocessors

Clearbox relies on the following providers to run the service. Each one receives only what its role requires.

• Vercel Inc. (United States): hosting and execution of the application, including the inbox and the API.
• Prisma Data Platform (Prisma Accelerate): the connection layer through which the application reaches its PostgreSQL database, where cached Shopify data and conversations are stored.
• Anthropic (Claude API): generation of draft replies, with the elements listed in section 4.
• Inngest: scheduling of background jobs (mailbox synchronisation, automatic replies, daily retention sweep). It receives technical identifiers and job results, not the content of your customers' emails.
• Pusher: real-time updates of the inbox. New emails are relayed to your team's open browser sessions as they arrive.
• Cloudflare R2 (S3-compatible object storage): storage of email attachments.
• Resend: emails from Clearbox to your team (account, billing, alerts, notice that a customer data request package is ready). Replies to your customers are not sent through Resend but from your own connected mailbox.
• Your mailbox provider (Google, Microsoft or your IMAP/SMTP host): Clearbox reads and sends email through the mailbox you connected. That provider is yours, not a Clearbox subprocessor.
• Stripe and Shopify Billing handle your subscription and receive no customer data.

6. Retention periods

The periods below are the ones implemented in the application. A job runs every day at 04:15 UTC to apply them.

• Cached Shopify orders: deleted 730 days after they were cached. The cached customer card is deleted when none of its orders remains in the cache; otherwise its statistics are recomputed. The inbox reads Shopify live when needed.
• Support conversations and attachments: kept as long as your account and the connected mailbox exist. They are deleted when you delete the mailbox, when a customer is erased (customers/redact, unless that customer is still cached by another installed store of yours, see section 7) and when the store is erased after uninstall (shop/redact, limited to the customers of that store as described in section 7).
• Customer data request packages (customers/data_request): 30 days, then the content is wiped.
• Customer data access log: 365 days.
• Temporary install tokens: deleted when they expire (one hour).
• Uninstall: see section 7.

7. Uninstall and Shopify compliance webhooks

Clearbox subscribes to the three compliance webhooks Shopify requires and verifies the signature (HMAC) of every webhook before acting. If processing fails, Clearbox answers with an error so that Shopify sends the webhook again.

• customers/data_request: Clearbox assembles a package with what it holds about the customer (customer card, cached orders, conversations and replies, within size limits), keeps it for 30 days and emails your owners and admins, without any customer data, that the package is ready. Owners and admins download it from Settings → Shopify and pass it on to the customer. Each download is logged. One package per Shopify request, even if Shopify retries.
• customers/redact: as for shop/redact, this erasure covers only the store that received the request. Clearbox deletes that store's cached customer card and orders (including the orders Shopify lists, even when cached under another email address), that store's stored data request packages, the actions staged for that store on those orders, and the compliance audit rows of that store about that customer, including the ones that held the raw email address. It also deletes the conversations with that email address, with their attachments, drafts, suggestions and events, unless that customer is still in the cached customer list of another store of yours that is still installed: the conversations are then kept for that other store, and if the requesting store is already uninstalled, that customer stays on its pending shop/redact list so that shop/redact checks again later. The cached customers and orders of your other stores are not touched. An audit entry of the erasure is kept with a pseudonym, never the email address.
• app/uninstalled: as soon as you uninstall, Clearbox deletes the store's API tokens and its cached customers and orders, ends the Shopify billing on its side and records the customer addresses of that store for the erasure below.
• shop/redact: when Shopify sends it (48 hours after uninstall according to Shopify's documentation), Clearbox deletes the conversations with the customers recorded for that store, the stored data request packages, any residual token and the related compliance audit entries. If you reinstall before that, nothing is deleted. If shop/redact never arrives, the same erasure runs automatically 30 days after uninstall.
• If your Clearbox organisation has several stores connected, this erasure covers only the uninstalled store. It starts from the customer addresses recorded for that store and keeps the conversations of the customers who are still in the cached customer list of another store of yours that is still installed; the conversations of the other recorded customers are deleted. The cached customers and orders of your other stores are not touched, and your Shopify subscription is only ended if the uninstalled store was the one it was billed through. The 30-day fallback above applies the same rule.
• Disconnecting the store from Settings, without uninstalling, deletes its cached customers, orders and tokens immediately; conversations stay in your inbox.

8. Security and encryption

What exists in the application today:

• Shopify API tokens and mailbox credentials (passwords, OAuth tokens) are encrypted at rest with AES-256-GCM before they are stored.
• Connections between Clearbox and Shopify, the AI provider, Pusher and the database layer use HTTPS/TLS.
• Mailbox connections (IMAP/SMTP): the presets for Gmail, Outlook, Yahoo, iCloud, Zoho and Fastmail use TLS, and TLS is enabled by default for custom servers. Making TLS mandatory for every mailbox is in progress.
• Every mail server address is checked and resolved right before connecting, and private or internal hosts are refused.
• Every request to Clearbox is limited to your own organisation. Customer data request packages are visible only to owners and admins.
• Access log: each read of customer data by a member of your team through the customer card, the order lookup, the order search, the buyer profile and the download of a data request package is recorded with who, what, when and the store, using a keyed pseudonym of the customer rather than the email address. Kept 365 days.
• Team passwords must have at least 10 characters with a lowercase letter, an uppercase letter and a digit.
• Shopify webhooks are accepted only with a valid HMAC signature, compared in constant time.
• Clearbox's internal administration routes do not read merchants' conversations or cached Shopify data.

9. Your customers' rights

Your customers exercise their rights with you, the controller. Clearbox gives you the means to answer them:

• Access and portability: the customers/data_request package described in section 7, or the data visible in your inbox.
• Erasure: Shopify's customer erasure request (customers/redact), which Clearbox executes as described in section 7. You can also delete a conversation or a mailbox yourself.
• Objection to automated replies: turn automatic sending off for your store, or answer the customer yourself. A reply from the customer on an automated thread already stops automatic replies on that thread.
• If you need Clearbox's help to answer a request, write to contact@getclearbox.com.

10. Changes

This page describes the application as implemented on the date above. We update it when the processing changes.