ShopMailPrivacy policy
Last updated September 27, 2026
ShopMail is a Shopify app, operated by Triple Layer, that sends marketing and order emails on behalf of Shopify merchants. This policy explains what data the app handles, why, and for how long. Merchants are the controllers of their customers’ data; ShopMail processes it on their behalf.
What we collect from the merchant’s store
- Store details: name, contact email, currency, postal address and domain, used for the email footer and sender name.
- Customers: email address, first and last name, email marketing consent, number of orders, amount spent and last order date.
- Orders and abandoned checkouts: order number, email, items, totals, fulfilment and tracking details, and the checkout recovery link.
We do not collect payment details, phone numbers or customer addresses.
What we record when emails are sent
- Each email sent: recipient, subject, time and delivery outcome (delivered, bounced, marked as spam).
- Opens and clicks: the time, the link clicked and the browser’s user agent. We do not store IP addresses.
- Unsubscribes, bounces and spam reports, kept as a suppression list so that address is never emailed again by that store.
How we use it
- To send the emails the merchant turns on or schedules, and only marketing emails to customers who subscribed in Shopify.
- To show the merchant results such as opens, clicks and revenue from emails.
- To protect deliverability, for example pausing a store’s marketing if too many emails bounce.
- When a customer unsubscribes, we update their consent in Shopify so the merchant’s other tools respect it.
We do not sell data, share it for advertising, or use it to train AI models.
Who processes it
- Amazon Web Services (Amazon SES) delivers emails.
- Resend delivers emails if Amazon SES is unavailable.
- Railway hosts the app and its database.
- Cloudflare hosts our website and forwards email sent to our own addresses.
Each receives only what it needs to do that job. These providers may process data in the United States or other countries outside your own.
How long we keep it
- Incoming data from Shopify is processed and the raw event deleted after 14 days.
- When a merchant uninstalls ShopMail, all of their store’s data is erased when Shopify sends the shop erasure request, 48 hours after uninstall.
- When a customer asks a merchant to erase their data, Shopify tells us and we delete that customer’s records, emails and events.
How we protect it
- Everything travels over encrypted connections (HTTPS).
- Merchants sign in through Shopify, and every message Shopify sends us is checked to be genuinely from Shopify before we use it.
- Unsubscribe and tracking links in emails are signed, so they cannot be forged or changed.
- Only the Triple Layer team can reach store data, only to run and support ShopMail, and access to our own admin tools is protected and logged.
- Passwords, access keys and store tokens are never written to our logs.
If a security incident affects a store’s data, we will tell that merchant without undue delay, with what happened and what we are doing about it.
Our website
Our website does not use analytics or advertising cookies and does not track visitors. It is hosted by Cloudflare, which may use strictly necessary cookies for security, and it loads its fonts from Google Fonts, which receives your browser’s IP address to deliver them.
Your rights
If you are a merchant, you can ask us for a copy of your store’s data, or to correct or delete it, by emailing privacy@shopmailapp.com.
If you are a customer of a store that uses ShopMail, contact that store to access, correct or delete your data; they can do this through Shopify, and we act on their request. You can stop marketing emails at any time with the unsubscribe link in every email.
Children
ShopMail is a tool for businesses and is not meant for children. We do not knowingly collect data from children under 16 other than as a store’s customer, under that store’s own policies.
Changes to this policy
When we change this policy we update the date at the top. If a change matters to how your data is handled, we will tell merchants in the app before it takes effect.
Contact
Questions about this policy or your data, from Triple Layer: privacy@shopmailapp.com