Privacy policy

The personal data Repose processes on behalf of a merchant, why, where it goes and how long it is kept.

Last updated 2026-09-17T00:00:00.000Z.

Repose is operated by Ruckus Repose. Contact: chris@ruckusrepose.com. This is the same policy the app serves from its own address; the two are kept identical.

What Repose is

Repose is a Shopify app for recovery and wellness venues. It sells and redeems timed access to a physical space — sessions, visit passes and memberships — and tracks how many people are booked into the venue at once. It is installed by a merchant onto their Shopify store and is used both by the venue’s staff, in the Shopify admin, and by the venue’s customers, through a booking widget on the merchant’s storefront.

This policy describes the personal data Repose processes on behalf of the merchant, why, where it goes and how long it is kept. For the merchant’s own customers, the merchant is the data controller and Repose is a processor acting on their instructions.

The personal data Repose processes

Customer identity. Repose stores the Shopify customer ID against every booking, credit ledger entry, membership, hold and processed order. The customer ID is the only identifier written to Repose’s database.

Names and email addresses are read from the Shopify Admin API at the moment a staff member opens a page that needs them — the day’s booking list, the desk’s customer search — so that staff see a person rather than an ID. They are not written to Repose’s database. Repose requests only the name and email fields, and does not request phone numbers or addresses.

Waiver acceptances. Where the venue requires a waiver, Repose records that a customer accepted it: the customer ID, the version, the time, a hash of the exact wording they were shown, and the IP address the acceptance came from. The wording hash exists so that a customer asking “what did I agree to?” gets the text they actually saw rather than today’s text.

Abuse prevention. When an anonymous visitor holds a time slot while paying, Repose stores a salted SHA-256 hash of their IP address to rate-limit that path. The raw address is never stored for this purpose.

Order data. Repose receives orders/paid and refunds/create webhooks from Shopify and reads the line items, products, customer ID and paid date to decide what access an order granted or a refund withdrew. It ignores orders containing none of its products, and it does not read payment details or addresses.

Merchant staff. Repose stores the Shopify session for the installing user — name, email and the API access token — which is what keeps them signed in to the embedded admin.

Why

Repose processes this data for two purposes only, which are the two reasons declared to Shopify: store management and app functionality. In plain terms: to let a venue’s staff run the desk, and to let the app work out who is allowed to book what.

Repose does not use personal data for analytics, personalization, marketing or advertising. It does not sell personal data or share it with anyone for their own purposes. It does not profile customers, and the only automated decision it makes is whether a given person may book a given time, based on the credits, membership and waiver the merchant’s own rules define.

Where the data goes

Repose runs on Google Cloud Run and stores data in a Neon PostgreSQL database, both in Australia (australia-southeast1) with the database in ap-southeast-2. Its subprocessors are:

Repose sends no customer email today. When customer notifications are enabled, the email provider will be added to this list before the feature ships.

How long it is kept

• Unconverted slot holds are deleted 30 days after they resolve.
• Bookings, credit ledger entries, memberships and processed orders are kept for as long as the merchant has Repose installed, because they are the record of access the customer bought and the venue’s own history.
• On a customer redaction request (customers/redact from Shopify), Repose replaces the customer ID on bookings, ledger entries, holds, processed orders and usage records with an irreversible token, deletes waiver acceptances and memberships outright, and scrubs any earlier data-request snapshot that held contact details. Rows that represent money are anonymised rather than deleted, so that a charge already made cannot repeat or be reversed into a free place.
• On uninstall, Shopify sends shop/redact 48 hours later and Repose purges every row it holds for that shop.
• On a customer data request (customers/data_request), Repose assembles everything it holds about that customer — bookings, credits, waiver acceptances with the wording they were shown, memberships, holds and processed orders — for the merchant to forward.

Security

Data is encrypted in transit and at rest, and backups are encrypted. Credentials are held in Google Secret Manager and never in source control or environment listings. Test and production run as separate Shopify apps, separate services and separate database branches, so no test ever touches production data. Access to production data is limited to Ruckus Repose’s sole operator, protected by two-factor authentication and a password manager, and access is logged.

Your rights

A merchant’s customer should contact the venue they booked with. Merchants can reach Ruckus Repose at chris@ruckusrepose.com for any request about access, correction, export or erasure, and Repose will act on Shopify’s mandatory privacy webhooks automatically in any case.

Changes

Material changes to this policy will be notified to installed merchants before they take effect.