ctrl-lab reports Privacy Policy
Last updated: 16 October 2026
ctrl-lab reports (the app) helps Shopify merchants report on orders and revenue using custom order attributes, filter results by date, and download CSV reports. This policy describes the information we process when you install or use the app with your Shopify store.
Information the app processes
We receive information through the Shopify access you authorize when installing the app, through Shopify event notifications, and through your use of the app.
- Store and connection information. Your Shopify store domain, related store domains, installation status, authorization scopes, authentication tokens and session information. Depending on the information Shopify supplies for a session, this can include a Shopify user ID, name, email address, language and account role.
- Orders and custom attributes. Order identifiers and order names or numbers, order dates, monetary amounts, tax information, currency, and custom order attribute names and values. The app stores order-level reporting records and grouped report totals. Custom attributes are supplied by the merchant or their store setup and can contain personal information; the app does not automatically remove personal information from those values. Shopify order notifications can also include additional order and customer information.
- Theme information. Information about the store's published theme, including theme identifiers, product templates, relevant theme code, settings and layout content used for theme discovery and the store connection flow.
- Operational information. Store connection status, import progress, sync timestamps, browser user-agent information used when serving the app, and errors encountered while the app runs.
How we use information
We use this information to connect and authenticate your store; import and organize order attributes; calculate order counts and revenue; generate reports and CSV downloads; discover theme information for setup; and diagnose errors. The app's Shopify permissions are read_orders and read_themes.
Reports and exports are available through authenticated Shopify admin sessions for the relevant store. Downloaded CSVs can contain order-level information and custom attribute values. Once downloaded, copies are managed by whoever downloads or receives them.
Services that process information
Shopify supplies store information and authentication services. The app runs on Heroku and stores reporting, connection and theme information in PostgreSQL and MongoDB databases. These hosting and database services process information as part of running the app. App requests and operational errors also pass through the hosting infrastructure.
This policy covers ctrl-lab reports. Shopify, the merchant's store, and any services the merchant separately uses have their own privacy practices.
Storage and deletion
The app stores reporting and connection information beyond the individual request so that reports and the store connection can continue to work. The app does not configure automatic age-based deletion for its reporting, theme or import-progress records.
When the app successfully processes an uninstall notification or a shop deletion notification from Shopify, it deletes that store's saved order-attribute records, grouped reporting records and cached theme information. This does not automatically remove every record: authentication sessions, store installation records and import-progress records can remain.
CSV exports are generated for download rather than saved as separate export files on the app server. Deleting app records does not delete copies already downloaded or the original records held by the Shopify store.
Privacy questions and requests
For questions about the app's use of information, or to request access, correction or deletion, email contact@enesbeganovic.com. Include the Shopify store domain and enough information to identify the records concerned. Avoid sending passwords, access tokens or unnecessary sensitive information.
If you are a customer of a store using the app, contact that store about information associated with your purchase. The store can identify the relevant order and raise a request with us.
We review and handle privacy requests manually, including customer data-request and deletion notifications received from Shopify. These notifications do not currently trigger an automatic customer data export or deletion. A notification acknowledgment alone does not confirm that records have been exported or removed.
About this policy
The date above identifies this version of the policy. Contact us using the privacy contact above with questions about the app's practices or this policy.