Holdback privacy policy
Last updated: 4 November 2026
This policy explains what information the Holdback app ("Holdback", "we", "us") collects, why, how long we keep it, who we share it with, and how to ask for it to be deleted.
Holdback is a product of Aprilfourteen Ltd, a company registered in England and Wales (company number 13109333), registered office 2 The Willows, Buntingford, England, SG9 9EN. Website: holdback.co.uk. Contact: support@holdback.co.uk. Registered with the Information Commissioner's Office, reference ZC263564.
1. What Holdback does
Holdback is a Shopify app for hire and rental shops. When a customer hires an item, they pay the hire fee at checkout and their card is saved through Shopify against a deposit, which is the most a late fee, an extension fee or a claim can come to. Later the shop releases the deposit, or keeps from the saved card, with a reason, a late fee at the rate the customer agreed at checkout, or the amount for an item that isn't coming back or is lost where the customer's checkout agreement allows it, never more than the deposit. For damage or a missing part the shop sends a claim, which the customer approves and pays themselves on Shopify's own payment page. An extension fee the customer approves is paid by Shopify payment link, never from the saved card. Holdback emails the customer each time, to the address on the order, when there is one.
2. Who is responsible for the data
- Shops (merchants) who install Holdback. For information about the shop itself, Holdback is the controller.
- The shop's customers. For information about a shop's customers, the shop is the controller and Holdback processes it on the shop's behalf, as its processor, only to provide Holdback to that shop. If you're a customer of a shop that uses Holdback, the shop's own privacy policy applies to you too, and the shop is the first place to go with a request (section 8).
3. What we collect, and why
About shops
| Information | Why |
|---|---|
Shop domain (yourstore.myshopify.com) |
To identify the shop and keep its data separate |
| Shopify access tokens for the shop | To act for the shop in Shopify: create deposit plans, open rentals from orders, take fees and release deposits. Access is limited to the permissions the shop approved at install |
| Shop name and contact email, read from Shopify and kept with the shop's record | To send deposit emails in the shop's name and deadline reminders to the shop |
| The sender and reply-to addresses the shop sets on the Settings page | To send customer emails from and to the right addresses |
| Install and uninstall dates, whether the shop's payment setup can save cards for deposits, and plan status (read from Shopify) | To run the app, warn if it can't, and apply the shop's plan |
| A record of each fault in Holdback affecting the shop: what went wrong, when it was first and last seen, how often, and the shop domain | To notice a fault that is happening to a shop and fix it. It holds no customer name, email or address — the details are redacted before they are written |
Holdback records which of the shop's staff pressed each fee, claim or release button (their name as Shopify gives it, or their email if Shopify gives no name, their Shopify user ID, and whether they are the account owner), so the rental's history and the evidence PDF show who did it. It stores nothing else about the shop's staff.
About a shop's customers
When a customer checks out with a deposit, Shopify sends Holdback the order. From it Holdback stores:
| Information | Why |
|---|---|
| Name (from the billing address) and email address | To show the shop whose each deposit is, and to email the customer when a fee is taken or the deposit released |
| Shopify customer and order references, order number, and the names of the hired items | To link each deposit to its order and customer in the shop's Shopify admin |
| Deposit amount, currency, due-back date and the latest date anything could be taken | To show the shop what's open and when it must be settled |
| What happened to the deposit: amount charged, the shop's reason, dates, and any failure message | To keep an accurate record, tell the customer why, and stop a charge exceeding the agreed deposit |
| References to the saved card's payment mandate on the order (Shopify payment mandate and payment method IDs) | To ask Shopify to take a charge, or to email the customer a link to update their card |
| A one-way, keyed code derived from the card's brand, last digits and expiry, only if the shop asks the customer to update their card | To notice that the card has been updated. It can't be turned back into card details |
| A record of each email sent to the customer (address, subject, whether it was delivered) | To show the shop the customer was told, and to avoid sending twice |
| The words the customer was shown beside Add to cart and agreed to, the version of those words, a fingerprint (SHA-256) of them, and when they ticked to agree or added the item | The shop's record of exactly what the customer agreed to before the hire |
| Handover and return photos, if the shop adds them | Evidence of the item's condition for the shop. Only the picture is kept: camera details such as location are removed when the photo is added. Photos the shop chooses to send with a claim are shown to the customer on their claim page, behind the same signed link as the rest of that page, and attached to the shop's own copy of the claim email |
| Messages the customer writes to the shop (a request to cancel, a disagreement with a claim), and their confirmations (an extension fee they approved, handover photos they say they have seen) | The shop's record of what the customer asked and agreed |
| A claim, if the shop sends one: what happened, each line of the estimate, the photos sent, and its status | To show what the customer was asked to approve and pay, and what became of it |
| The customer's approval of a claim: when they pressed "I approve", the amount they were shown, and the exact words beside the button | The shop's record that the customer approved the claim before paying it |
| Shopify's payment record for a payment the customer made through a payment link (a claim, or a fee sent as a link), kept exactly as the gateway supplied it and never interpreted. It can include the card's brand and last four digits | The shop's record that the customer paid it themselves |
Holdback never receives or stores card numbers, security codes or bank details. Cards are collected and held by Shopify. Holdback only asks Shopify to take an agreed fee from the card the customer saved at checkout.
Holdback doesn't use customer information for marketing, profiling or advertising, and doesn't sell it.
When you contact us
If you email support@holdback.co.uk we keep the message and our reply so we can help you.
4. Legal basis (UK GDPR)
- Shop information: to perform our contract with the shop (providing the app), and our legitimate interests in running and securing it.
- Customer information: we process it on the shop's instructions as its processor. The shop decides its own legal basis, typically performance of its hire contract with the customer.
5. How long we keep it
- While the shop has Holdback installed, we keep its deposit records so it has a full history of what was agreed, taken and released.
- When a shop uninstalls Holdback, we stop immediately and delete the access tokens. Everything else is kept for 48 hours, in case the shop reinstalls, then permanently deleted — with the partner-commission exceptions described below. If the shop was referred by a partner, we keep only its shop address, the partner that referred it and the dates needed to pay that partner's commission, for no longer than the commission period plus the 35 days it takes to settle the last payout (the commission period is twelve months from the shop's first payment; for a shop that never paid, up to twelve months from the referral, plus the same 35 days). If the shop reinstalls within that time, the referral is attached again. Everything else is deleted as described here. During those 48 hours we email the shop's own address a signed link to download all of its deposit evidence as one PDF (the same records it could see in the app: each charge and claim with its amounts, reasons and dates, the words the customer agreed to and their tick, each claim approval, the photos and the emails sent). The shop should keep that PDF for at least 6 months, because a customer can dispute a card payment up to 120 days after it, and Holdback can't keep the records past the 48 hours: Shopify requires an app to delete a shop's data when it asks (shop/redact). The link stops working when the records are deleted.
- When Shopify tells us a customer's data must be erased (a "customers/redact" request), we remove the customer's name, email, customer reference and card references from every deposit record straight away, delete their photos, and delete the payment receipt kept with any claim. We keep only the order reference, the amounts and the shop's reasons, so the shop can still account for what it charged and a deposit still open can be released. We act on these requests as soon as they arrive, well within the 30 days Shopify allows.
- When Shopify tells us a shop's data must be erased ("shop/redact"), we delete all of that shop's data, including its fault records. One deliberate exception: if the shop was referred by a partner, the partner's own commission records for it are kept. Those are a third party's financial records, and a shop asking us to erase its data cannot erase somebody else's books. They hold the shop domain, the amounts and the dates — no customer data of any kind.
- A customer data request ("customers/data_request") produces a copy of that customer's data for the shop. It is emailed to the shop's contact address. If that isn't possible, it is kept for the shop until Holdback is uninstalled.
- Photos are kept for 180 days after the deposit is settled and any claim on it closed, then deleted. Before that, the shop is emailed the evidence pack that contains them, so its own copy is the one kept for longer; if that email can't be sent, the photos are kept until it can.
- Incoming Shopify notifications (webhooks) are queued only until processed, then deleted.
- Server logs record events by shop domain and internal IDs, not customer names or email addresses, and are kept for 7 days, the retention of Holdback's hosting plan. (This grows to 30 days on a larger plan; this line will be updated then.)
- Backups: the database keeps 7 days of point-in-time history, plus snapshots taken by hand. Separately, an encrypted copy of the whole database is made every night and kept for 30 days in Cloudflare R2, in the EU. Encrypted before it leaves Holdback with a key only Holdback holds, so Cloudflare can't read it. A shop or customer deleted from Holdback drops out of these copies as they age out, within 30 days.
6. Who we share it with
We don't sell or rent personal information. We share it only with the services needed to run Holdback:
| Service | What it does for Holdback | Data it handles | Where |
|---|---|---|---|
| Shopify | The platform Holdback runs in. Source of order and customer data, and processes every payment | All of the above | Shopify's infrastructure |
| Railway | Hosts the Holdback application | All data Holdback processes, in transit and in memory | EU West (Amsterdam) |
| Neon | Hosts Holdback's database | All data Holdback stores | AWS London (eu-west-2) |
| Resend | Sends Holdback's emails | Customer name and email address, and the content of each email (amount, reason, order number, item, any photos attached to a claim); the shop's contact address for reminders | Ireland (eu-west-1); Resend is US-incorporated |
| Cloudflare (R2) | Stores Holdback's nightly off-site backup | An encrypted copy of the whole database, kept 30 days; Cloudflare can't read it | European Union; Cloudflare is US-incorporated |
Each processor is bound by a data processing agreement. Where a service processes data outside the UK, the transfer is protected by the UK International Data Transfer Addendum or an equivalent safeguard.
We may disclose information if the law requires it, or to protect our rights or the safety of others.
7. How we protect it
- All connections use HTTPS/TLS. The database is encrypted at rest, and backups are encrypted.
- Access tokens and secrets are held only in the hosting provider's encrypted configuration, never in code or logs.
- Only named Holdback staff can access production systems, through accounts with two-factor authentication. Access is logged.
- Test and development data is kept separate from production.
- We have an incident response process. If a breach affects your data, we tell the shops concerned without undue delay so they can meet their own obligations, and we notify the ICO where required.
8. Your rights, and how to request deletion
Under UK GDPR you can ask for a copy of your data, its correction or deletion, to restrict or object to its processing, and to move it elsewhere.
- If you're a shop's customer: contact the shop you hired from. Shopify passes data and deletion requests to Holdback automatically, and we act on them straight away. You can also email support@holdback.co.uk with the shop's name and your email address. We'll confirm the request with the shop and act on it, normally within 30 days.
- If you're a shop: email support@holdback.co.uk from your store's contact address for a copy of your data or its deletion. Uninstalling Holdback deletes all of your shop's data 48 hours later.
If you're unhappy with how we've handled your information, you can complain to the UK Information Commissioner's Office at ico.org.uk. We'd appreciate the chance to put it right first.
9. Cookies and what we store in your browser
Holdback runs inside the Shopify admin and uses only what Shopify's own sign-in requires. It doesn't use advertising or analytics cookies. Holdback's notice on a shop's product pages sets no cookies.
It does store one thing in your browser, and only on a shop that offers per-booking deposits: a single flag
(april-deposit-booking) recording that you added a booking to your cart, so that if you later change the quantity the
deposit follows it. It holds no identifier, nothing about you and nothing about what you bought, it is never sent
anywhere, and the cart simply doesn't re-check itself if your browser blocks it. It is there to make the thing you asked
for work, so it needs no consent under the Privacy and Electronic Communications Regulations. You can clear it like any
other site data.
The one exception is a partner's referral link (app.holdback.co.uk/r/...). Following it sets a cookie,
april_ref, holding only that partner's code, for 60 days. If you then install Holdback, Holdback reads it once to credit
the partner who recommended it. It doesn't identify you, and it changes nothing about what you pay.
Holdback's own public pages (the homepage and the help centre at app.holdback.co.uk) use Cloudflare Web Analytics, which counts visits without cookies and without storing anything in your browser, so it needs no consent. It isn't on the Holdback app in the Shopify admin, on a customer's deposit or claim page, or on a shop's storefront.
10. Children
Holdback is a business tool for shops and isn't directed at children.
11. Changes
If we change this policy in a way that affects how we use personal information, we'll update the date above and let installed shops know in the app or by email before the change takes effect.
12. Contact
Holdback is a product of Aprilfourteen Ltd, 2 The Willows, Buntingford, England, SG9 9EN. Email: support@holdback.co.uk.