Trust Center
Published policies
The written policies that govern how we secure our systems and handle your data. Each is version-controlled and reviewed annually.
Policy library
-
The master policy describing Freshly Commerce's security program, its scope across our three Shopify apps and vendors, who owns it, and how it is governed and reviewed.
-
How we classify merchant and customer data, where each class may live, how long we keep it, and how deletion requests and Shopify redaction webhooks are honored.
-
Our role as processor of merchant customer data, how Shopify's mandatory privacy webhooks drive data subject requests, international transfer posture, and DPA availability.
-
Governance
Vendor & Third-Party Risk Management Policy
How we evaluate vendors before they touch merchant data, review them annually, and keep the public subprocessor list in sync with the internal register.
-
Operations
Incident Response Plan
How security incidents are declared, contained, and resolved, and our commitment to notify affected merchants within 72 hours of confirming a breach of their data.
Need a policy that isn't listed? Internal policies aren't published here, but we can walk your team through them. Email security@freshlycommerce.com.