Data and Privacy FAQ

Common privacy, security, and data-handling questions. If yours isn't here, email support@regiostech.com.

How does Regios handle customer information?

By default, no personal data about your customers will be stored in our database. For example, if you use the "Specific customers" eligibility option, which allows you to select a finite list of specific individuals for a discount, as long you have "Settings > Use compact format enabled" (default), our app will only store Shopify IDs rather than other personally identifiable information (PII).

When you use our order analysis features (such as seeing why a discount did or didn't apply to an order), the following customer and order information may be stored in our database:

• Shopify ID, ex. gid://shopify/Customer/123456789.
• The number of orders the customer has placed.
• List of tags, ex. ["gold", "vip"]
• The values of metafields that your discount configuration depends on. For example, a "VIP tier" discount might require us to store the value of the customer's custom.vip_tier_name metafield.
• Order details needed for the analysis: the order's Shopify ID, order name (number), date and revenue amount.

We do not store your customers' names, emails or addresses.

What do you store about my staff?

• Staff members: When a staff member or collaborator opens Regios Discounts, we store their first and last name and their Shopify user ID. We use them only to show who changed each discount in the Timeline and on the Logs page. We don't store their email address. Staff names are deleted along with the rest of your store's data.

Server location and data retention

• Location: United States.
• Retention: Deleted discounts are soft-deleted to enable backups/restore. With Compact Format enabled (on by default), the discount config holds no PII besides the Shopify customer ID.
• On uninstall: Store info is deleted within a few hours. Discount configs are retained as backups so they can be restored if you reinstall.
• Third-party access: None.

What permissions does your app require?

• Required: read_cart_transforms, read_customers, read_discounts, read_locales, read_products, read_reports, read_shipping, read_themes, write_cart_transforms, write_discounts, read_publications, and write_publications.
• Optional scopes include read_locations, read_markets, read_companies, read_orders, read_marketing_events, and write_app_proxy.

read_reports lets the app show your discounts' sales and order numbers on the Analytics page, using the same reports data as Shopify Analytics.

We do not request or hold scopes that would let our app edit customer records or product records.

Can the Regios app edit customers?

No.

Can the Regios app edit products?

No.

How do you handle security vulnerabilities and security questionnaires?

We watch for security advisories that affect our stack and keep our software on patched, supported versions. Because details like server software versions, hosting arrangements and network configuration could help an attacker, we do not share them with third parties, including in agency or vendor security questionnaires. We cannot answer questions that ask for those details.

What we can tell you:

• PHP: Regios Discounts does not use PHP anywhere in our code or infrastructure, so PHP vulnerabilities do not affect the app.
• Compromise checks: After recent widely reported security advisories, we checked for signs of compromise and found none.
• Merchant action: You do not need to do anything in response to these advisories. You do not need to reinstall the app or rotate any credentials.
• Your data: What the app stores and the Shopify permissions it uses are described on this page.

If you have a security concern about the app, email support@regiostech.com.

Information security certifications

None currently (no ISO 27001 / SOC 2 Type II).

Updated on: 30/10/2026