GDPR for digital downloads

What Alva stores about your customers

• Customer email and name — copied from the Shopify order when orders/paid fires.
• Order references — Shopify order ID, order number, and the line items that mapped to digital files or license keys.
• Download usage logs — each download attempt writes a row with IP address, user agent, timestamp, and the requested file. Powers fraud limits and the per-customer log export.
• License-key assignments — the specific key value issued to each customer, stored on PurchaseLicenseKey.
• Email logs — which delivery emails Alva sent (subject, recipient, send timestamp).

Alva does not store payment details, shipping addresses, or anything Shopify doesn't pass through the order webhook.

Where the data lives

Customer rows, purchase records, license keys, download logs, and email logs sit in a PostgreSQL database hosted on Heroku. Uploaded product files sit in Cloudflare R2. Outbound delivery emails route through Postmark or MailerToGo depending on plan and custom-domain status. The current subprocessor list and international-transfer mechanism are in Alva's privacy policy — read that alongside this article.

Customer data-export request (Article 15)

Shopify fires a customers/data_request webhook to Alva when a merchant submits a request through the Shopify admin. Alva is registered for that topic (in shopify.app.toml under compliance_topics) and acknowledges every fire, but the export itself is generated manually rather than auto-emailed. Forward the customer email and order ID to digitaldownloads@alvaapps.com and we'll return the matching rows within 30 days.

For most cases the data is already reachable: the order detail page shows the customer email, license keys, and download log; Settings → Download log exports a per-customer CSV. Combined with Shopify's own customer export, that typically satisfies an Article 15 request without involving Alva support.

Customer data-delete request (Article 17)

Right-to-erasure runs through Shopify's customers/redact webhook, which Shopify fires 60 days after the controller marks a customer for redaction — a standard delay window covering open chargebacks and refund flows. Alva is registered for the topic and on receipt we redact the matching Customer, Purchase, PurchaseLicenseKey, DownloadLog, and EmailLog rows for that customer email.

What gets deleted: personal identifiers, download-log rows, and email-log rows. What stays: aggregate counters and the underlying product files you uploaded — those are your data, not the customer's. To trigger a redact outside Shopify's flow, email support with the customer email and order numbers.

Shop-data delete request (uninstall)

The shop/redact topic and a full uninstall both wipe everything tied to the shop. Mechanics, what survives, and how to back up first are covered in What happens if I uninstall Alva Digital Downloads.