Privacy policy

Effective 9 November 2026. Counterkeep is provided by Elektraset, s.r.o. Contact: help@elektraset.com. Website: elektraset.com.

Data and purpose

We process store identifiers, access tokens, subscription state, pickup order identifiers, customer names and email addresses, pickup locations, line items, ready dates, deadlines, staff notes and notification/resolution history to provide the merchant’s pickup workflow. We do not sell data or use it for advertising. We request only recent order and merchant-managed fulfillment access. Do not put unnecessary personal data in notes.

Roles and instructions

The merchant determines the purposes of customer data processing and is responsible for lawful pickup policies and messages. Elektraset processes that data on the merchant’s instructions to operate Counterkeep. Access is limited to Elektraset personnel who need it to provide support and operate the app.

Security and hosting

Customer contact data, order payloads and notes are encrypted at rest using AES-256-GCM with an app-specific key. Lookups use keyed hashes. Connections use HTTPS. The hosting subprocessor is the Elektraset app host, operated in the European Union. Shopify supplies the commerce platform; Amazon Web Services (Amazon Simple Email Service, eu-north-1) processes reminder email addresses and content to send transactional messages. AWS may process operational information under its applicable service terms. We do not use tracking pixels or claim message read receipts.

Retention and deletion

Order data and audit history are retained while installed and removed within 24 hours after a valid uninstall, shop/redact or relevant customers/redact webhook is received; normal processing is immediate. Shopify’s standard access window is 60 days of orders. Operational logs contain hashed recipient identifiers and provider IDs, not message bodies or addresses, and are retained for up to 30 days. Deidentified store-level usage and billing counters, containing no customer records, are retained to measure activation and paid usage. Encrypted host backups, if any, expire within 30 days and are not restored for ordinary use after deletion.

Rights and requests

Customers should contact their merchant for access, correction or deletion. Merchants can export audit data and request assistance at help@elektraset.com. We process Shopify customer data-request and deletion webhooks. A data request is recorded for the merchant to export the matching order and audit records. We will notify affected merchants of a personal data breach without undue delay.

Changes

Material changes will be described here with a new effective date. Contact us before using the service if your requirements need a separate agreement.

Canonical policy: https://counterkeep.apps.elektraset.com/privacy