Privacy policy

Last updated: 29 October 2026.

Drop Control Room is a Shopify app that lets a merchant run timed product drops with a virtual queue. It is operated by Dragan Arsić, Jurija Gagarina 173, 11070 Belgrade, Serbia. This policy explains what the app stores, why it stores it, who it shares it with, and how it is removed. You can contact us about this policy or about personal data at arsicd@gmail.com.

Who is responsible for the data

The merchant who installs Drop Control Room decides why and how its shoppers' data is used and is the controller of that data. We process shopper data on the merchant's behalf and only as needed to run the app. For data about the merchant's own account and for the operation of the app, we are the controller.

Why we process data

• To install the app, authenticate it with Shopify, and keep its API connection working.
• To create and run drops, keep queue positions, issue entry credentials, and record claims.
• To enforce a drop's checkout restriction for the shop's cart and checkout.
• To protect joins and signups with Cloudflare Turnstile and with rate limits.
• To let shoppers join a waitlist when a drop is full.
• To settle or release a claimed item when Shopify reports an order as paid or cancelled.
• To keep the app secure, diagnose failures, and send the operator operational alerts.
• To answer Shopify's privacy requests and meet legal obligations.

Where the GDPR or UK GDPR applies, we rely on performance of our contract with the merchant, our legitimate interests in keeping the app secure and reliable, and our legal obligations. The merchant is responsible for its own legal basis for shopper data.

Data we store for a merchant

• The shop's myshopify.com domain, its display name, and whether the app is installed.
• The app's Shopify access and refresh tokens, encrypted at rest, plus token expiry and refresh status.
• Drop settings entered by the merchant: names, schedule, item references, titles, images, prices, allocations, queue and lobby copy, and enforcement mode.
• An audit log of merchant actions: the Shopify staff account identifier, the action, a request identifier, a timestamp, and a summary of the change.
• The verification document published to the shop: drop identifiers, enforcement mode, a public verification key, and item-to-variant mappings.
• The result of the last attempt to install or repair the shop's cart validation rule.
• The shop's Turnstile widget configuration and per-item stock counters read from Shopify.

Data we store for shoppers

• A random session identifier kept in the browser's local storage, with a fallback cookie, so a reload keeps the same place in the queue.
• The time the shopper joined, the queue ticket, and the entry credential issued by the queue.
• A short note in local storage that the shopper holds a reservation for a drop and which item it covers. The entry token itself is never stored: the browser asks for it when the item is added to the cart.
• The Shopify customer identifier for a logged-in customer, supplied by the signed Shopify app proxy. Guests have none.
• Whether a claimed item was paid for or cancelled, derived from the order webhook.
• An email address, only when the shopper chooses to sign up for the drop's waitlist from the overflow page. No other shopper data is stored with it.
• Short-lived counters keyed by the session, the customer identifier, or the waitlist email, used to rate-limit joins and signups.

The app does not otherwise store shopper names, email addresses, phone numbers, postal addresses, or payment details. The bot challenge is verified with Cloudflare Turnstile; the challenge token is checked and not retained. Card and payment details are handled by Shopify and its payment providers, never by this app.

Order data we receive

Shopify delivers the complete order object for the orders/paid and orders/cancelled webhooks. The app reads only the order identifier, which event was delivered, and any _dc_token value in the order's line-item properties or note attributes. It discards the rest, including customer name, email, phone number, shipping and billing addresses, line-item details, and payment information. The app stores only the Shopify order identifier and the settlement state it derives from it: whether the order was paid or cancelled, and whether the drop applied, released, or rejected it.

Cookies and local storage

The app uses the dc_session cookie as a fallback and the same session identifier in local storage. It also stores the reservation note described above in local storage. These are used only to keep a queue position stable and are not used for advertising or analytics. The app does not set marketing cookies and does not track shoppers across other sites.

How long we keep data

• Merchant configuration, drop settings, and queue state are kept while the drop is active and while the merchant remains installed. When a drop is archived, its queue state, lobby copy, and waitlist rows are erased 30 days after archiving; the drop record, its item list, its audit history, and a final summary of participants, claims, and settlement totals are kept.
• When the app is uninstalled, the shop's install token is deleted immediately and the remaining shop data is kept for 48 hours so a reinstall can restore the merchant's drops. Shopify then sends a shop redaction request; the app acknowledges it immediately, queues the erasure, and removes the shop's drop configuration, queue state, waitlist rows, Turnstile widget, and every tenant-scoped rate-limit key from its database, coordination storage, and key-value store on its next scheduled sweep, within 15 minutes.
• A shopper's queue session, ticket, and entry credential are removed with the shop's queue state, when the merchant removes the drop, or 30 days after the drop is archived.
• A waitlist email is kept until the shopper asks for its removal, Shopify sends a data redaction request for that address, the archived drop's 30-day cleanup runs, or the shop's data is erased.
• Rate-limit counters expire after at most 61 seconds.
• An order-settlement record is kept with the drop's queue state, and is deleted 30 days after the drop is archived, when the order is listed in a customer redaction request, or when the shop's data is erased.
• Application logs are kept by Cloudflare Workers Logs for seven days. They record operational events such as tenant identifiers, drop identifiers, and error details, not shopper names, email addresses, or payment details.
• Aggregate analytics points are kept by Cloudflare Analytics Engine for three months. They contain a tenant identifier, a drop identifier, an item reference, a random per-instance source, counts, and timestamps, and never a customer identifier or email address.
• The email address in a Shopify compliance delivery is used only for that request and is not stored.

Who data is shared with

The app runs on Cloudflare, which hosts the workers, database, coordination storage, key-value store, and the Turnstile bot challenge. Shopify supplies the shop, customer, and order identifiers described above. If the operator configures an alert destination, such as a Telegram chat or a webhook, the app sends operational alerts there. Alerts contain tenant and drop identifiers and a short description; the alert for an order that carries a token the drop never issued also contains the Shopify order identifier and the affected token identifiers. Alerts never contain a shopper's name, email address, or payment details. Data is not sold or shared for advertising.

Cloudflare and Shopify are large providers that may process data in countries outside the one where the shopper or merchant is located. Their data-processing terms include safeguards for those transfers, such as standard contractual clauses.

What Shopify's customer redaction request removes

When Shopify sends a customers/redact request for a shopper, the app:

• Removes the shopper's customer identifier from queue sessions and issued entry credentials in every drop of the shop, by setting the link to null.
• Deletes the shopper's waitlist rows, the short-lived rate-limit counters keyed by the customer identifier or the email address, and order-settlement records keyed by the order identifiers in the request.

Anonymous queue state is kept so the drop's counts, remaining availability, and in-flight checkouts keep working: issued and converted numbers, waiting positions, and settlement totals do not change. A second delivery of the same request changes nothing. If any part of the erasure fails, the app tells Shopify to retry instead of reporting success.

What a redaction does not remove

• A signed entry token that was already given to a shopper's browser or cart embeds the customer identifier that was current when it was issued. The app keeps no copy and, after redaction, mints no new token with it, but it cannot recall a token already released without invalidating every outstanding token and breaking checkouts in progress. That token stays valid until the drop ends, and the same value can remain in the cart line-item property and in the order data Shopify holds.
• The browser's local storage still holds the session identifier and the reservation note. They contain no customer identifier, and the server no longer links the session to the shopper.
• A redelivered order webhook after a redaction can recreate the anonymous order-idempotency record. It does not restore any customer link.
• Records that Shopify holds, and the merchant's own records, are outside the app's control.

Security

Shopify access and refresh tokens are encrypted at rest with a key held in the app's environment. Webhook deliveries are authenticated with Shopify's HMAC signature over the raw body, and app-proxy and embedded session requests are accepted only with a valid signature. The app enforces tenant isolation, uses parameterized SQL, serves every route over HTTPS, and requests only the Shopify access scopes it needs.

Your rights

Where the GDPR or UK GDPR applies, you may ask for access to your personal data, its correction or erasure, a restriction of processing, an objection to processing, or a portable copy of it. You may also complain to a supervisory authority; in Serbia this is the Commissioner for Information of Public Importance and Personal Data Protection.

Shoppers should contact the store where they used Drop Control Room first, because the merchant is the controller of their data. To request access to, correction of, or deletion of data, contact the store where you used Drop Control Room, or email arsicd@gmail.com. Uninstalling the app causes the shop's data to be erased after the 48-hour reinstall window.

Changes to this policy

We will update this page when the app's data handling changes. The date at the top shows the current version. For a material change we will also notify merchants in the app or by email where the law requires it, before the change takes effect.