Privacy
Last updated
WaitRoom runs queues for product drops on Shopify stores. It is installed by a merchant and processes data on their behalf: the merchant is the data controller, WaitRoom is the processor. This page describes what is actually processed, which is deliberately less than the app is technically permitted to read.
What is processed
| Data | Where it comes from | Why |
|---|---|---|
| Queue identity | Derived on our server from IP subnet, browser user agent and language, then HMAC'd with a secret | Holds one place per person, and stops one script claiming hundreds of slots. One-way — it identifies a place in a queue, not a person, and cannot be reversed. |
| Email address | Typed in by the shopper, in the waiting room | To tell them the drop opened, or that their turn has come. Never read from their Shopify account. |
| Queue activity | Generated by using the queue | The merchant's funnel: joined, released, checked out, abandoned. |
| Shopify customer record | Shopify Admin API | Only to evaluate eligibility rules the merchant configured, or to order a loyalty-priority queue. Never written to our database. |
What is read from a Shopify customer record
Only when a merchant has configured eligibility rules or chosen priority queueing, and only for shoppers who are signed in. A store using neither never causes a customer record to be read at all.
idcreatedAtnumberOfOrdersamountSpenttagsverifiedEmaildefaultAddress.countryCodeV2
Names, phone numbers, email addresses and full postal addresses are not requested. The record is held in memory for minutes and never written to disk. A test in the codebase fails if a name, phone or email field is added back to that query.
How long it is kept
These periods are enforced by a job that runs hourly. The figures below are read from the same constants that job deletes by, so the published policy and the enforced one are the same numbers.
| Data | Kept for | Then |
|---|---|---|
| Email addresses given in the waiting room | 90 days after the drop ends | Deleted |
| Queue entries (position, status, timings) | 180 days after the drop ends | Customer link removed; anonymous counts kept for your analytics |
| Shopify customer records used for eligibility rules | Never stored — cached in memory for minutes only | Discarded |
| Stock history | 365 days | Deleted |
Aggregate counts — how many joined, how many bought — survive indefinitely. They identify nobody and are the merchant's own trading record.
Who else processes it
Infrastructure providers only. There are no advertising, analytics or data-broker recipients, and nothing is sold or shared for marketing.
| Provider | What for |
|---|---|
| Shopify | The store, its customer records and the checkout |
| Railway | Runs the application |
| Neon | PostgreSQL database (encrypted at rest) |
| Upstash | Redis, holding live queue state (encrypted at rest) |
| Resend | Sends the notification emails a shopper asked for |
| Cloudflare Turnstile | The optional anti-bot challenge, when a merchant enables it |
Everything is HTTPS-only in transit and encrypted at rest.
Erasure and access
Shoppers should contact the store they queued at — the merchant is the controller, and Shopify's own privacy request flow reaches us. WaitRoom implements Shopify's three mandatory compliance webhooks (customers/data_request, customers/redact, shop/redact), so a request raised through the merchant is actioned automatically.
Uninstalling the app stops all processing. Merchants can also see exactly what has been read for their store, and when, inside the app under Data & privacy.
Contact
Privacy questions: [email protected].