How's Business Privacy Policy

Last updated: October 24, 2026

How's Business: Store Reports ("How's Business" or "the app") is provided by Duskford Digital, a trade name of SAB Ventures LLC ("we", "us"), 30 N Gould St, STE R, Sheridan, WY 82801, USA. You can contact us at howsbusiness@duskforddigital.com.

This policy explains what personal information the app processes when a Shopify merchant installs it, builds report files from the store's data, and emails them to the people the merchant chooses.

Our role

Merchant information: we decide how it is used.
Information about the merchant's customers: we process it on the merchant's behalf, only to provide the app. The merchant controls it. Customers with questions about their data should contact the store first. We help the store respond.

What we collect

From merchants, when the app is installed

Store details from Shopify: the store's domain, name, account email address, time zone, currency and plan.
Access credentials: the access credentials Shopify issues so the app can work with the store.
App settings: the default file type (CSV or Excel) and which day the week starts on, and the progress of the setup guide.

About the merchant's customers

The app builds report files from the store's Shopify data. It reads that data through Shopify's Admin API and ShopifyQL while a report is made. Most reports hold no customer information at all: sales by product, sales by day, tax by jurisdiction and inventory value. Two do, and their files contain:

customer names and emails, in the Top customers report (name and email) and in Orders for your accountant (customer name);
billing country and region, in Orders for your accountant. (Tax by jurisdiction adds up tax by country and region, not by customer.)

Each report's page in the app says whether its file contains customer names or emails.

Never read: customers' phone numbers, street addresses or postal codes. We do not collect or store payment card details.

Not stored as such: Shopify's responses are streamed into the report file as it is built. We don't keep them, or anything from them beyond the file itself. A file has no customer ID or order ID attached, only the rows the report prints.

Report files

Each report we make is stored as a file, so it can be emailed, downloaded and checked again.

Files with customer names or emails (the customer-data reports) are kept for 14 days, then deleted.
All other files are kept for 30 days, then deleted.
A file is sent to the recipients the merchant has added, once each has confirmed (see below; the store's own email address is the one exception), and can be downloaded by the merchant in the app.
Download links in emails are signed. They stop working when the file is deleted.

Report recipients

The email addresses the merchant adds to receive reports. For each one we keep:

the address and its status: waiting for confirmation, confirmed, unsubscribed, bounced, or marked as spam;
when the person was invited and when they confirmed;
for each email we send them (a delivery record, which keeps the address the email went to for 90 days, even if the merchant later removes the recipient): which report and run it was, when it was sent, whether the file was attached, and when and how many times the download link was used (link previews and mail scanners aren't counted).

To limit how many invitations can be sent, we also keep a one-way scrambled (hashed) form of each address that was invited, with a count, for 2 days. It can't be turned back into the address.

Each person the merchant adds confirms by email before they get anything, except the store's own email address, which Shopify gives us and which we treat as confirmed. Each person can unsubscribe from any report email. If someone marks a report as spam, we keep their address so they aren't emailed again, until the store's data is deleted after the app is uninstalled.

Run history

For each report the app makes, we keep:

the report, the period, the options chosen, its state and its row count;
a short summary of the run, used for the report email and the History page: totals and the top rows. For the Top customers report the top rows include customer names, and for the Orders report for your accountant they include order numbers, dates and totals; they never include email addresses. These customer rows are removed 14 days after the run, when its file is deleted; the totals stay;
who ran it, when the merchant ran it by hand: the Shopify staff user ID from their session;
for files with customer names or emails, each download from the app by the merchant: the staff user ID and the time;
the delivery records described above.

Data requests

When Shopify passes on a customer's request for their data, we keep the customer's Shopify ID and the order IDs the request names, so the merchant can see what to send. Shopify's request also includes the customer's email and phone; we don't keep those. We delete the request 30 days after it arrives.

Server logs

Like any website, our hosting provider records technical details of each request to the app, such as the IP address, browser type and time. We use these logs only to keep the app running and secure. Our own logs never contain email addresses or the contents of reports.

How we use it

To build the report files the merchant asks for, now or on a schedule, and to email them to the recipients the merchant has added and who have confirmed (or who are the store's own email address).
To let the merchant download their files, and to show them their history and who has downloaded what.
To apply the merchant's plan limits. Plans are billed by Shopify.
To provide support, keep the app secure, and meet legal obligations.

The short summary in each report email (a few totals and the top rows) is built from the same data as the file. For the Top customers report it can show customer names, never their email addresses.

We do not sell personal information. We do not use it for advertising or analytics, and we do not use it to train AI models. We do not make automated decisions about anyone that have legal or similarly significant effects.

Who we share it with

We share information only with the service providers needed to run the app, and only for that purpose:

Shopify: the platform the app runs on, and billing.
Vercel: application hosting.
Neon: database hosting. Report files are stored in the database.
Resend: sending the emails: the confirmation and report emails, with the file attached when it is small enough, to the recipient addresses the merchant added.

We use no other services. The merchant chooses who receives their reports. Once a report has been emailed to a recipient, it is in that person's mailbox and under their control.

We may also disclose information when the law requires it, or as part of a merger or sale of the business. In that case the commitments in this policy continue to apply.

Where it is stored

Information is stored with our providers in the United States. Where data from the EU, the UK or elsewhere is transferred to the US, we rely on appropriate safeguards, such as our providers' standard contractual clauses.

How long we keep it

Report files: 14 days for files with customer names or emails, 30 days for all others. They are deleted sooner:
- when Shopify tells us a customer's data must be deleted (a customer redaction request): we delete every stored customer-data file for that store, because a file can't be edited for one customer, and we remove the customer rows (names, or order numbers) from the stored run summaries, keeping only the aggregate figures;
- when the store's data is deleted after the app is uninstalled.
Customer rows in run summaries (customer names, or order numbers, in the top rows of customer-data reports) are kept for 14 days, like the files.
Run history, run summaries and delivery records (including download counts and the staff user IDs described above, but without those customer rows) are kept for 90 days.
Backups: the database keeps its recent history for up to 7 days, so deleted data can remain in backups for up to 7 days after we delete it.
Sent emails at Resend: Resend, our email provider, keeps a copy of each email and its delivery log for 30 days. We can't shorten this.
Emails already delivered are outside our control. A redaction request or deletion on our side can't remove a report from a recipient's mailbox, or from the mail systems that carried it.
Report recipients are kept while they are on the merchant's list. Delivery records keep the address each email went to for 90 days (see Run history), so a removed recipient's address can remain there until then. A recipient who never confirmed is deleted 30 days after the last invite or change to their status. A recipient who marked a report as spam is kept so they aren't emailed again, until the store's data is deleted after the app is uninstalled.
Invitation limit counters (the hashed form of invited addresses, above) are kept for 2 days.
Data requests are kept for 30 days after they arrive.
Merchant information is kept while the app is installed. When a store uninstalls, Shopify tells us to delete its data 48 hours later, and we do. If that message never reaches us, we delete it 6 days after uninstall, so within 7 days of uninstall at the latest.
Server logs are kept by our hosting provider for a short time and then deleted automatically.

Security

We protect the information we hold:

encryption in transit (HTTPS) and at rest, including backups;
download links are signed, so a link can't be guessed or changed to reach another file;
access to production systems is limited to the owner, with strong, unique passwords and two-factor authentication;
any direct access to production data is logged, and the log is reviewed monthly;
a written security incident response process.

Your rights

Merchants can ask to access, correct, export or delete their information by emailing howsbusiness@duskforddigital.com.
Report recipients can unsubscribe from any report email with the link in it. To have an address removed, contact the store that added it, or email us.
Customers should contact the store. The store can send us their request through Shopify. When it does, the merchant sees the list of stored files that may include that customer on the app's Customer data requests page, and we help the store respond within the time the law requires.
Depending on where you live (for example under the GDPR, the UK GDPR or California law), you may have rights to:
- access, correct and delete your information;
- object to or restrict processing;
- data portability;
- not be discriminated against for using these rights.

We do not sell or share personal information for cross-context behavioral advertising.

Children

The app is not directed to children under 16, and we do not knowingly collect their information.

Changes

If this policy changes, we will update the date above. If the change is significant, we will tell merchants by email or in the app.

Contact

Duskford Digital (SAB Ventures LLC), 30 N Gould St, STE R, Sheridan, WY 82801, USA. howsbusiness@duskforddigital.com