Data Deletion Instructions

Nerja AI provides multiple pathways for data deletion, in compliance with Shopify’s mandatory privacy webhooks, GDPR, and CCPA requirements.

1. Uninstall the App (Shop-Level Deletion)#

When you uninstall Nerja AI from your Shopify admin, Shopify sends a shop/redact webhook to our servers. Within 30 days of receiving this webhook, we permanently delete:

• All customer profiles and associated data
• All event data (browsing, cart, checkout events)
• All order data synced from Shopify
• All campaign execution history
• All suppression records (unsubscribes, bounces)
• All audience segments
• Your tenant configuration and settings

Provider credentials (API keys, tokens) are deleted immediately upon uninstall.

2. Customer Data Request (GDPR Access)#

When a customer submits a data access request through Shopify’s privacy portal, Shopify sends a customers/data_request webhook. We compile and return the following data about the customer within 30 days:

• Profile information (email, phone, name)
• Event history (page views, cart activity, purchases)
• Campaign messages sent to them
• Suppression status and reason
• Segment memberships

3. Customer Data Deletion (GDPR Erasure)#

When a customer requests data deletion through Shopify’s privacy portal, or when a merchant initiates deletion, Shopify sends a customers/redact webhook. We permanently delete all data associated with that customer:

• User profile and identifiers
• All tracked events
• Campaign execution records
• Suppression records (added to a permanent block list before deletion to prevent re-import)
• Segment memberships

Deletion is completed within 30 days of the webhook receipt. The customer’s email/phone is added to a suppression list before deletion to ensure they are never re-imported or messaged again.

4. Manual Deletion Request#

Merchants can also request data deletion manually by contacting support@nerja.ai with the subject line “Data Deletion Request” and including the shop domain. We process manual requests within 30 days.

5. Data Retained After Deletion#

The following data may be retained after deletion for legal or operational reasons:

• Suppression records: Email/phone hashes are retained to prevent re-messaging (required for CAN-SPAM/GDPR compliance).
• Billing records: Transaction records required for tax and accounting purposes are retained as required by law.
• Aggregated/anonymized data: Statistical data that cannot identify an individual (e.g., aggregate campaign performance metrics) may be retained.

6. Questions?#

For any questions about data deletion, contact us at support@nerja.ai or see our Privacy Policy.