Trust & data

Where your feedback data goes: Poby, end to end

A plain-language walkthrough of what happens between a shopper tapping four stars and you reading it in your Shopify admin — which data moves, which data never does, and how deletion works.

· 7 min read

Installing an app on a store means letting it near your customers. That deserves a straight answer to three questions: what does it collect, where does that end up, and what happens when you want it gone.

This post answers all three for Poby, at the level a merchant — or a merchant’s lawyer — actually needs. It describes the surfaces and the data, not our internals; the formal version of the same commitments lives in the Privacy Policy and the Data Processing Agreement.

1. How a response happens

From the buyer’s side, the whole thing is five steps and about ten seconds.

How a Poby response happensFive steps left to right: the shopper completes checkout; the thank-you page renders the Poby block from settings already synced to it; the shopper taps star ratings; the response is submitted over an encrypted, session-verified connection; the merchant reads it in the Poby dashboard inside Shopify admin.SHOPPER’S BROWSERYOUR ADMIN01Order placedCheckout completesas normal.02Widget rendersPre-synced settings.No blocking call.03Shopper answersStars, issue tags,an optional comment.04SubmittedEncrypted andsession-verified.One per order.05You read itDashboard in yourShopify admin.If anything fails at step 02, the widget renders nothing at all — it can never break your thank-you page.Nothing Poby does sits in the path of the purchase. The order is already complete before the widget appears.
The buyer's path: five steps, roughly ten seconds, entirely after the sale is final.

The important property of that picture is where Poby isn’t: nowhere between the shopper and their order. The widget appears after the purchase is complete, renders from configuration that was synced ahead of time rather than fetched while the page loads, and stays silent if anything is off. A feedback tool should never be able to cost you a sale.

2. What data moves, and what never does

Two streams meet to make one feedback record, and both are narrower than people expect.

What data Poby holds and where it goesTwo inputs combine into one feedback record: what the shopper submits (star ratings, issue tags, attribution answer, optional comment) and the customer name and email read from the Shopify order. The record is encrypted in transit and at rest and surfaces in the merchant's dashboard as aggregates and as individual responses for follow-up. Contact details are never sold, never shared, never used for marketing, and are excluded from CSV export. Deletion is driven by Shopify's GDPR erasure webhook and by shop redaction on uninstall.INPUTSPOBY HOLDSYOU SEEWhat the shopper submits· 1–5 star ratings per stage· “What went wrong?” tags· “How did you hear about us?”· An optional written commentRead from the Shopify order· First name, last name, email· Under the read_orders and  read_customers permissions  you grant at installOne feedback recordEncrypted in transit and at rest.Backups encrypted.Session-token authenticated.Every staff view of a name oremail is written to an audit log.Test and production data arekept separate.Never asked of the shopper:address, phone, payment dataYour dashboard· Trends and rating distribution· Top issues and named sources· Each response, with contact  details, so you can follow upWhat never leaves· Feedback data is never sold· Never used for advertising· Names and emails are excluded  from the CSV exportGetting data out — and getting it deletedCustomer data request (via Shopify)Customer erasure request (via Shopify)You uninstall Poby→ that customer’s records are returned→ those records are deleted automatically→ shop redaction deletes your store’s feedback
Everything Poby holds about a buyer comes from one of two places — what they chose to submit, and the name and email already on the order.

A few points worth pulling out of the diagram.

The widget never asks the shopper for personal details. No name, no email, no address, no payment information is ever typed into it. There is nothing in it to type them into.

The name and email come from the order, and exist for one purpose. You granted read_orders and read_customers at install; Poby uses them to attach a customer to a response so that when someone rates checkout two stars, you know who to email. Shopify classes these as protected customer data, and Poby treats them that way: never used for marketing, never sold, never shared, excluded from CSV export, and every staff access to them written to an audit log. On a guest checkout with no customer account, only the order email is available and no name is stored.

Your dashboard aggregates are built from ratings and comments only — never from names or emails.

3. Deletion is not a support ticket

The part most merchants only think about later. Poby implements Shopify’s mandatory compliance webhooks, so the paths out are automatic rather than something you have to ask us for:

  • A customer data request forwarded by Shopify returns that customer’s records.
  • A customer erasure request deletes them, automatically.
  • Uninstalling triggers Shopify’s shop-redaction webhook, and your store’s feedback records are deleted in response, on Shopify’s redaction schedule.

Feedback records are retained while your store has Poby installed, and go when the store does. There is no shadow copy that outlives the uninstall.

4. Who else touches it

Poby runs on established cloud infrastructure providers who host the service and store data on our behalf, and process it solely to operate Poby. Feedback data is not shared beyond what running the service requires. Where Poby handles personal data about your customers, we act as your processor, and the DPA — part of the terms you accept at install — sets out the categories of data, security measures, sub-processors, breach notification and retention in full.

The short version

The shopper types opinions, not identity. The identity comes from an order you already own. Both are encrypted, access to the sensitive half is logged, none of it is sold, and it all disappears when you uninstall.

If something here is not clear enough for your own privacy review, write to support@getpoby.com — a question about data handling always gets a real answer.

More reading

Comparison

Post-purchase feedback tools compared: form builders, CX platforms, review apps — and where Poby fits

Typeform, Google Forms, SurveyMonkey, Delighted, Hotjar, Judge.me, Fairing, Zigpoll, Poby. Five different jobs get lumped together as “feedback”. Here is which tool does which, and how to pick without buying three.

 Guide

What to ask on your Shopify thank-you page (and what to leave out)

A practical guide to post-purchase survey questions: how many to ask, which ones produce a decision, and the well-meaning questions that quietly waste the best moment you get with a buyer.

 Product

Introducing Poby: experience feedback for the moment right after checkout

Your analytics tell you what happened on the way to the order. Poby asks the one person who knows how it felt — the buyer, on the thank-you page, while it is still fresh.