What Alva stores about your customers
- Customer email and name — copied from the Shopify order when the purchase is confirmed as paid.
- Order references — Shopify order ID, order number, and the line items that mapped to digital files or license keys.
- Download usage logs — each download page visit or download button click writes a row with IP address, user agent and timestamp. Powers fraud limits and the Export download activity CSV.
- License-key assignments — the specific key value issued to each customer, stored in Alva's license key records.
- Email logs — which delivery emails Alva sent (subject, recipient, send timestamp).
Alva does not store payment details, shipping addresses, or anything Shopify doesn't pass through the order webhook.
Where the data lives
Customer rows, purchase records, license keys, download logs, and email logs sit in Alva's secure database. Uploaded product files sit in Alva's cloud file storage. Outbound delivery emails are sent through Alva's email delivery provider. Alva's current list of sub-processors and international-transfer safeguards is available on request; see the privacy policy for the full detail.
Customer data-export request (Article 15)
Shopify fires a customers/data_request webhook to Alva when a merchant submits a request through the Shopify admin. Alva is registered for that event with Shopify and acknowledges every notification, but the export itself is generated manually rather than auto-emailed. Forward the customer email and order ID to digitaldownloads@alvaapps.com and we'll return the matching rows within 30 days.
For most cases the data is already reachable: the order detail page shows the customer email, license keys, and download log; Orders → Export download activity exports your whole shop's download visits and clicks, which you can filter on the Customer Email column in your spreadsheet (see Export your data to Google Sheets). Combined with Shopify's own customer export, that typically satisfies an Article 15 request without involving Alva support.
Customer data-delete request (Article 17)
Right-to-erasure runs through Shopify's automated customer-deletion signal, which Shopify sends 60 days after the controller marks a customer for redaction — a standard delay window covering open chargebacks and refund flows. Alva is registered for that event with Shopify and on receipt we redact the matching customer profile, purchase records, license key assignments, download logs, and email logs for that customer email.
What gets deleted: personal identifiers, download-log rows, and email-log rows. What stays: aggregate counters and the underlying product files you uploaded — those are your data, not the customer's. To trigger a redact outside Shopify's flow, email support with the customer email and order numbers.
Shop-data delete request (uninstall)
Shopify's shop-deletion signal and a full uninstall both wipe everything tied to the shop. Mechanics, what survives, and how to back up first are covered in What happens if I uninstall Alva Digital Downloads.
Frequently asked questions
Does Alva have a Data Processing Agreement (DPA)?
Yes. Email digitaldownloads@alvaapps.com and we'll send a signed DPA naming Alva Apps as processor and your shop as controller. The DPA references the subprocessors listed in the privacy policy and Standard Contractual Clauses for international transfers.
How long does Alva keep customer data after an order ships?
Customer email, order metadata, license-key assignments, and download-usage logs are retained for the lifetime of your installation. They are deleted only when you uninstall the app or when you submit a redact request for that customer. There is no automatic time-based purge.
Where is the data physically stored?
Order records and download logs are held in Alva's secure database. Uploaded product files sit in Alva's cloud file storage. Outbound emails are sent through Alva's email delivery provider. The current sub-processor list and international-transfer safeguards are available on request; see the privacy policy at /privacy-policy.html.
See also
Was this helpful?
Last updated 2026-10-29