Security and Data Protection

Last updated: 6 November 2026

StoreROI is run by WS Digitals (owner: Waheedullah Sediqi). This page describes how we protect the data that stores, Google, Meta and Shopify share with StoreROI, and what we do if something goes wrong. It adds to our Privacy Policy.

What data we handle

  • StoreROI only reads reports. From Shopify it reads daily store totals (net sales, total sales, orders and sessions). It never requests, shows or stores a single customer's name, email, phone number or address.
  • We store the access keys that Shopify, Google and Meta issue, your account email and password (hashed), and your project settings. Nothing else is stored.

Retention

  • Report figures are kept only in server memory, for about 10 minutes, then discarded.
  • A store's access keys are deleted when it disconnects, uninstalls StoreROI, or when Shopify asks us to remove a store's data.
  • Accounts and their data are deleted within 30 days of a deletion request.
  • Records of failed logins are kept only as long as needed to block password guessing.

Encryption

  • All traffic to and from StoreROI uses HTTPS (TLS).
  • Access keys are encrypted with AES-256-GCM before they are stored.
  • Our database provider (Supabase) encrypts all stored data at rest, including backups.

Test and live data

Development and testing use a separate database and Shopify development stores with made-up data. Live store data is never copied into test systems.

Access

  • Only the owner of WS Digitals has access to the servers and database. There is no other staff with access.
  • All admin accounts (hosting, database, Shopify, Google and Meta) use strong, unique passwords and two-step verification.
  • The app logs each time a store's reports are read, with the account and store, as well as logins and errors. Server logs are kept for a limited time and then deleted.

Preventing data loss

  • We keep as little data as possible, so there is little that can be lost or leaked.
  • The database runs on a managed service with redundant storage.
  • Access keys can be issued again by reconnecting the account, so no store data depends on a single copy.

If there is a security incident

  1. We stop the problem: block access, rotate affected keys and secrets, and fix the cause.
  2. We find out which accounts and data were affected, using our logs.
  3. We tell affected users and, where the GDPR requires it, the data protection authority within 72 hours. We tell Shopify, Google or Meta when their data is affected, as their terms require.
  4. We write down what happened and what we changed so it cannot happen again.

Report a problem

To report a security issue, email contact@wsdigitals.com. We reply within 2 working days.