AfterAsk

Privacy Policy

Last updated: September 12, 2026

Came here from a survey on a store's Thank you or Order status page? AfterAsk is the survey app that store uses. Your answers go to that store; AfterAsk stores them on the store's behalf. It has no fields for your name, email address, shipping/billing address, or Shopify customer ID, so please don't type those into an answer. The section “What we collect from shoppers” below lists exactly what is kept.

This Privacy Policy explains how AfterAsk (“AfterAsk”, “we”, “us”) collects, uses, and protects data when a Shopify merchant installs the AfterAsk app on their store.

Who we are

AfterAsk is developed and operated by MicroForge. You can contact us at support@microforgehq.com with any privacy question or request.

What we collect from shoppers

AfterAsk shows post-purchase surveys on the Thank you and Order status pages and stores the following data tied to an order:

  • the survey answer text and the date/time it was submitted
  • the order ID (GraphQL and legacy numeric ID) and order number
  • the order confirmation number and checkout token (used to verify the answer belongs to that order)
  • the order amount and currency code
  • the checkout country code
  • whether it was the shopper's first order with the store
  • the order's source (for example online store or point of sale) and whether it came through the checkout
  • the order's creation date/time
  • the product ID(s) and product tags in the order
  • order tags
  • which survey questions or message blocks were shown; for ones that were not shown, an internal reason code (for example, no matching rule or a plan limit) and how long the display check took, used for uptime/performance monitoring
  • the shopper's language/locale

To protect the service against abuse (for example, automated spam), we also process the shopper's IP address to rate-limit requests. We do not store the IP address itself: we store only a one-way, salted cryptographic hash of it that cannot practically be reversed to recover the address, kept for at most a few hours (see “How long we keep data” below).

We do not store the shopper's name, email address, shipping/billing address, or Shopify customer ID. Our database has no fields for these — even if they are present in data Shopify's webhooks or Admin API send us, we discard them rather than saving them.

Our role: processor for merchants, controller for our own account data

When a merchant installs AfterAsk, the merchant is the data controller for the survey responses and order data collected through their store, and AfterAsk acts as a data processor on the merchant's behalf. For data about the merchant's own account (shop domain, contact email, plan, and billing status), AfterAsk is the data controller.

What we collect from merchants

When a merchant installs AfterAsk, we receive their shop domain, shop contact email, timezone, locale, and subscription/plan status from Shopify, so we can operate the app and bill through Shopify App Pricing.

Why we process this data

As a processor, we process shopper data (survey responses and the related order data listed above) only to carry out what the merchant installed AfterAsk for — showing surveys and conditional content, verifying that a response belongs to the order it claims, and reporting results back to the merchant. The legal basis for this processing is the merchant's instructions, under our contract with the merchant.

As a controller, we process the merchant's own account data (shop domain, contact email, plan, and billing status) to operate the App, provide support, and bill through Shopify App Pricing. The legal basis for this processing is the performance of our contract with the merchant and our legitimate interest in operating and securing the App.

How long we keep data

Retention is enforced by an automated job that runs at least once a day, so actual deletion can lag up to 24 hours after a period below ends:

  • Orders with at least one survey response: kept for 90 days on the Free plan or 730 days (24 months) on the Pro plan, counted from the date of the most recent response on that order. If any response on the order is newer than that cutoff, the whole order (and its earlier responses) is kept.
  • If a merchant's Pro subscription ends, previously collected responses stay on the Pro retention period for 30 more days before the 90-day Free limit starts applying.
  • Orders where a survey or message block was shown but never answered: kept for 90 days (Free) or 730 days (Pro), counted from when the order record was created.
  • Orders where nothing was shown and nothing was answered: 60 days, counted from when the order record was created.
  • Unconfirmed/pending order records (no matching webhook received yet): 24 hours.
  • Display attempt logs (used for uptime/performance monitoring): 30 days.
  • Webhook delivery records and completed background job records: 7 days.
  • Rate-limiting counters (the hashed value described above, not the shopper's IP address): typically a few hours (2 minutes to 2 hours depending on the counter).

A merchant can set a shorter retention period for their own store in Settings. When they do, the shorter period applies instead of the plan limits above. Retention cannot be extended beyond the plan limit.

Deleting data

  • A merchant can search by order number in the app's Settings > Customer data screen to view, export (JSON), or delete a specific shopper's survey response at any time.
  • When a merchant uninstalls AfterAsk, we delete the store's record and all data tied to it 48 hours after uninstall (unless the merchant reinstalls before then). One exception: webhook delivery records, which include the store's domain and are used to detect duplicate deliveries, are not tied to the store record and are deleted independently, up to 7 days after they are received (see “How long we keep data” above).
  • When Shopify sends us a customers/redact request, we delete the order and survey response rows tied to that customer for that store.
  • When Shopify sends us a customers/data_request request, we compile the affected order and survey response data within 30 days of the request. The request's status is tracked in the app's Settings > Customer data screen. We do not currently email this file automatically; email support@microforgehq.com if you need a copy of it sent to you.
  • When Shopify sends us a shop/redact request, we delete all data belonging to that store.

Sub-processors

We use the following service providers to operate AfterAsk. Each only receives the data it needs to perform its function:

  • Shopify — the platform AfterAsk is built on; source of order, shop, and webhook data.
  • Fly.io — hosts the AfterAsk application (region: United States, Virginia).
  • Neon — hosts our Postgres database (region: AWS us-east-1, United States, Virginia).

All of the sub-processors above are located in the United States. Where we process personal data originating in the European Economic Area, the United Kingdom, or Switzerland, we rely on the Standard Contractual Clauses (and, for UK transfers, the UK International Data Transfer Addendum) as the legal basis for transferring that data to the United States.

Security

We rely on our hosting provider (Fly.io) and database provider (Neon) to encrypt data in transit (HTTPS/TLS) and at rest. Access to production data is limited to the people who operate AfterAsk. If we become aware of a security breach affecting a merchant's data, we will notify the affected merchant without undue delay, consistent with our legal obligations.

Cookies and tracking

AfterAsk does not use advertising or analytics cookies, and does not track shoppers across sites or stores. The merchant-facing admin screens authenticate primarily through Shopify session tokens, along with any cookies required by the Shopify app framework for you to log in. On the Thank you and Order status pages, AfterAsk does not set cookies for shoppers; the data it processes there is the order-scoped data (and the hashed rate-limiting value) described above.

Your rights

Depending on where you live, you may have rights under the GDPR (access, rectification, erasure, restriction, portability, and objection) or the CCPA (know, delete, and opt out of sale or sharing — note that AfterAsk does not sell or share personal data for cross-context behavioral advertising, and does not discriminate against anyone who exercises these rights). Shoppers should contact the store they purchased from first, since the store is the data controller; the store can also use AfterAsk's built-in Customer data tools, or Shopify's own customer privacy request process, to fulfill these requests. You can also contact us directly at support@microforgehq.com.

If you are in the EEA, UK, or Switzerland, you also have the right to lodge a complaint with your local data protection supervisory authority. We do not use shopper data for automated decision-making or profiling that produces legal or similarly significant effects on shoppers. Personal data we process is stored in the United States (see “Sub-processors” above).

Changes to this policy

We may update this Privacy Policy from time to time. We will update the “Last updated” date above when we do.

Contact

Questions about this policy or a data request? Email support@microforgehq.com.