Roles
The merchant is the controller of shopper data; Composa is the processor.
Processing
We process configurator answers, uploaded files and usage events only to provide the service and on the merchant's instructions.
Security
Data is encrypted in transit and at rest. Access tokens and signing secrets are encrypted in the database. Staff access is role-based, and every support session is logged.
Deletion
On uninstall, store data is deleted after 48 hours. Shopify redaction requests are completed within 30 days.