Handpicked privacy policy
Last updated: 3 November 2026
Handpicked is a Shopify app that writes a personal marketing email for each subscribed customer of a store, sends a generic newsletter to a random control group, and measures which one led to more orders. This policy explains which personal data Handpicked processes, why, for how long and with whom.
Who we are
Handpicked is offered by Alexander Storgaard, Irisparken 18, Ikast, Denmark ("we", "us"). Questions about privacy: [email protected].
Our role
- For the customers of a store (the people who receive the emails), the merchant who installed Handpicked is the controller. We are the merchant's processor and process their customers' data only to run the merchant's campaigns, as set out in our Data processing agreement.
- For the merchant's own account (store name, contact email, address, and the IDs of staff members who open customer data in the app), we are the controller.
What we process and why
| Data | About | Why |
|---|---|---|
| First name, email address, Shopify customer ID | Customers who subscribed to the store's email marketing | To address and send the campaign email, and to keep unsubscribes in sync with Shopify |
| The store's customer list with each customer's marketing consent | All of the store's customers, briefly | To choose the recipients: only subscribed customers are kept, the rest are dropped at once |
| Order history: products bought and order dates | Subscribed customers | To pick products that suit each customer |
| The store's orders during a campaign's measurement window, including the buyer's email and order totals | Anyone who ordered in that window | To count which group's customers ordered and how much. Read in memory only; only totals per group are stored |
| Email marketing consent | The same customers | To email only customers who subscribed, checked again right before sending |
| The email written for each customer, and delivery reports (delivered, bounced, complained) | The same customers | To let the merchant review the emails before sending, and to protect deliverability |
| Store name, contact email, physical address, plan | The merchant | To run the app, show the store's address in every email (required by law) and handle billing through Shopify |
| Shopify staff user ID, the time and kind of access | The merchant's staff | An access log of who opened customer data in the app |
We do not process phone numbers or postal addresses of customers, and we never sell personal data.
What goes to the AI provider: to write an email, only the customer's first name and their order history (products and dates, without prices or order numbers) are sent, together with the store's own product data, notes, brand texts and example newsletter. Email addresses and Shopify IDs are never sent.
How long we keep it
- A campaign's personal data (customer details, order details and email text) is deleted 30 days after the campaign's 14-day measurement window ends. A campaign that was approved but never measured is cleared 90 days after approval, and one that was never sent 90 days after it was last changed.
- Results are kept only as aggregated numbers, with no names, email addresses or Shopify customer IDs.
- Delivery reports are deleted after 60 days.
- The access log is deleted after 365 days.
- Blocked addresses (unsubscribes, hard bounces and spam complaints, and addresses the merchant imports from another email tool's do-not-email list) are kept as one-way hashes, so they are never emailed again, for as long as the store has the app installed. An imported file is read once to make the hashes and is not kept; the addresses in it are not stored. An unsubscribe keeps the Shopify customer ID only until Shopify has confirmed the consent change.
- Data requests from Shopify (the customer ID and a summary of what we held) are kept so the merchant can answer them, until Shopify asks us to delete that customer's data or the app is uninstalled.
- When a store uninstalls Handpicked, it is logged out at once, and all its data is deleted when Shopify's deletion request arrives 48 hours later. A scheduled check deletes it if that request never comes. One thing is kept: a keyed one-way hash of the store's domain with the date its free campaign was used, so the free campaign can only be used once. It contains no customer data.
Our subprocessors keep their own copies for a limited time under their terms, for example Resend's logs of sent emails.
Who processes it for us (subprocessors)
| Provider | What for | Where |
|---|---|---|
| Shopify | The store platform the app runs in; source of customer and order data | Per Shopify's terms |
| Render | Hosting of the app and its background worker | Frankfurt, Germany (EU) |
| Neon (Databricks) | The database | AWS eu-central-1, Frankfurt (EU) |
| OpenRouter, routed only to Anthropic | Writing the email text with AI. Data collection by the provider is turned off for every request, and Anthropic does not train models on this data | United States |
| Resend | Sending the emails and reporting delivery | Sends from its EU region; Resend is a US company and processes data in the United States |
Transfers to the United States are covered by the EU Standard Contractual Clauses, and where the provider is certified, the EU-US Data Privacy Framework. See the Data processing agreement for details.
Your rights
- Customers of a store: the merchant answers your requests. Ask the store, or Shopify, for access to or deletion of your data. We handle Shopify's data requests: for
customers/data_requestwe give the merchant what we hold about you, and forcustomers/redactwe delete your data, except the one-way hash that keeps you from being emailed again if you unsubscribed. Every email has a one-click unsubscribe link. It stops further emails at once, and your consent in Shopify is updated shortly after (retried until Shopify confirms). - Merchants: you can ask us at [email protected] for access to, correction or deletion of your account data. Uninstalling the app deletes your store's data as described above.
- Complaints: in Denmark, you can complain to Datatilsynet (www.datatilsynet.dk).
Security
- In transit and at rest: data is encrypted in transit (TLS) and at rest by our database provider (AES-256, backups included).
- Accounts: every service that holds or reaches production data uses a strong, unique password and two-factor login.
- Access: only the developer, and the tools the developer operates, have access to production data. Every opening of customer data in the app is logged, and the developer records a reason before looking at production data outside the app.
- Incidents: if a breach affects personal data, we inform affected merchants without undue delay and at the latest within 48 hours of becoming aware of it.
Changes
If this policy changes, we update the date at the top. Material changes are announced to merchants in the app before they take effect.