Project
Privacy & data
Exactly what data Envie stores, where it lives, and how deletion works — short because the list is short.
What Envie stores, where, and how it leaves. The list is short by design.
What we store
- Wishlist rows: product id, variant id, product handle, a best-effort title snapshot, and a timestamp — per saved item.
- List owners: a Shopify customer id, or a random anonymous browser id. That's the only personal data in the system. No emails, no names, no addresses — when an integration needs a customer email (Klaviyo), we read it from Shopify at send time and cache it briefly rather than storing it.
- Shop configuration: settings, API keys (hashed), webhook endpoints (secrets encrypted), integration keys (encrypted).
All of it lives in the EU (Hetzner, Germany).
What we never do
- Sell, share, or enrich data across shops — each shop's data is isolated and serves that shop.
- Contact shoppers. Envie sends no shopper email of any kind.
- Keep data hostage: export is self-serve, complete, and re-importable elsewhere.
Deletion
- A shopper removes an item / a list: deleted immediately, propagated to the customer-metafield mirror on the next sync.
- A customer asks the merchant to be forgotten: Shopify's redaction request deletes their lists automatically — no support ticket involved.
- A merchant uninstalls: wishlist data is retained briefly so a re-install (theme switches, migrations) doesn't wipe shoppers' lists, then purged automatically when Shopify sends the shop-redaction request (~48 h later).
- A data request: Shopify's customer-data-request webhook produces a JSON export of that customer's lists, delivered to the merchant — the only email Envie ever sends, and it goes to the merchant, not the shopper.
Anonymous ids
Guest wishlists are keyed by a random UUID in the shopper's browser (localStorage). It
identifies a browser, not a person; it's never linked to a profile unless that shopper logs in,
at which point the list merges into their customer account and the anonymous id stops existing.
Anonymous lists that stay untouched are purged on a rolling schedule.
For a DPA or specific compliance questions: support.