Privacy Policy

Sonic Highway, operated by Electric Mud Creative LLC · Last updated October 24, 2026

Sonic Highway is a Shopify app that lets a merchant list and sell physical media (vinyl, CDs, and related products) that we source and have shipped directly to their customer. This policy describes what the app does with personal data. It is separate from the privacy policy of our marketing website, which covers website visitors.

Our role

For data about a merchant's own customers, the merchant is the controller and Sonic Highway is a processor: we act on the merchant's instructions, to fulfill orders their customers have already placed and, if the merchant's staff use our optional assistant, or people the merchant gives assistant access in its merchant portal (who may be outside contractors) do, to answer their questions about the store. For data about the merchant themselves (their store, contact and billing details, and the people they give portal access), we are the controller.

What we receive, and why

Payments. Card payments are processed by Stripe, our payment processor. When you save a card, Stripe holds the card number; we never see or store it. We keep only the card's brand, type, last four digits and expiry date, Stripe's reference numbers for it, and the billing name and address. We keep payment records (amounts, dates and order numbers) for as long as we keep your wallet records. If you remove a card, we remove it at Stripe and stop using it. We keep its brand, last four digits and expiry on your payment history so past payments stay readable, and delete them when you uninstall Sonic Highway. If you uninstall Sonic Highway, every saved card is removed the same way.

Your customers pay you through your own Shopify checkout; we never see their card details. Stripe only handles what you pay us. Subscription charges are handled by Shopify's Billing API.

What we do not do

• We do not sell or share personal data for value, and we do not use it for advertising.
• We do not market to a merchant's customers, and we do not build profiles of them: we do not keep a store's customers' names or contact details for this.
• We do not make automated decisions that have legal or similarly significant effects on a person. Routing decisions are about stock and fulfillment partner availability, not about the customer.
• We do not use customer data for any purpose other than fulfilling the order it belongs to, counting the store's repeat customers as described under Customer insights below, and, when the merchant's own staff, or people the merchant gives assistant access in its merchant portal, ask the assistant about that order, answering them.
• We do not use what we hold about the people a merchant gives portal access for anything but letting them use the portal: we do not market to them, profile them or share their details.

The merchant portal

A merchant can give people access to a web portal at app.sonichighway.io, where they see the store's orders with us and, as the store chooses for each person, its notifications, support requests, billing contact and other sections, without a Shopify login. These people may work for the store or be outside contractors. For each of them we keep their email address, the one-time sign-in links we email them, and their sessions, which a secure, HTTP-only cookie named __Host-sh_portal identifies. A session ends after 7 days without use and after 30 days in any case; a store owner who signs in to the portal with Shopify gets a session of 24 hours. A person's access to a store lapses after 30 days unused. We keep which notifications each person has read, so marking one read changes nobody else's view, and a record of each change made in the portal, which names the person who made it. All of it is deleted with the rest of the store's data on shop/redact.

A store's owner can also use Sonic Highway in a browser tab, outside Shopify's admin, after signing in with Shopify, which confirms they own the store. There the app shows the same store information it shows inside Shopify's admin, reads it from Shopify with the access the store gave the app at install, and records each sign-in and each change made there. On an order's page in the browser tab, the app shows the customer's name, shipping address and phone, read from Shopify with the store's access at the moment the page is shown. We do not store them for this, and they are shown only to the store's owner.

A person with access to more than one store can sign in once, with an emailed link or with Sign in with Shopify, and see the stores they can open. That sign-in uses a cookie named __Host-sh_session, which holds a random value and nothing else. A Sign in with Shopify also sets a second cookie, __Host-sh_strict, which holds another random value and nothing else and which your browser sends only from our own pages.

For each sign-in we keep when it started and was last used, how it was made, and the browser's family and system (for example "Chrome on macOS"), never the full browser string and never an IP address. A person can see their own sign-ins and end any of them. We delete a sign-in's record a week after it ends.

When a store's owner signs in with Shopify, we keep Shopify's confirmation that they own the store for 24 hours, and we record the owner's Shopify-verified email address and Shopify user id for that store, so we can tell when a store changes owner.

We keep a log of sign-ins, refused sign-ins, sign-outs and owner confirmations, without email addresses: sign-in events for one year and store events for 180 days, then we delete them. When Shopify asks us to erase a store's data, its part of the log goes with it.

If a merchant gives someone order detail in its merchant portal, that person can see each order's stage, packages, ship dates, the state it ships to and its carrier tracking numbers, never the customer's name, street address, phone or notes, and we record each order they open, keeping that record for 90 days. People a store invites to its merchant portal and gives Catalog Change can have our app create draft products in the store, using the store's own access; a draft is not for sale until the store's staff make it active in Shopify.

If the merchant gives a person assistant access in the portal, that person can ask the assistant about the sections the store lets them see, and only those. In the app and the portal a conversation is shown only to the person who asked it, and questions asked while signed in as the store owner only in an owner sign-in. When a customer asks the store for their data, every conversation that looked up that customer's orders is included in what we send the store, whoever asked it, portal users included, and our team reads those conversations to compile it.

Customer insights

So a store can see how many of its customers come back, each order we route for it carries a pseudonymous customer key: a keyed hash of the store and the customer's Shopify customer id, which cannot be turned back into the id without our secret key and differs from store to store, so it cannot link a customer across stores. We do not store the customer id, name, email, phone or address for this. Beside it we keep what the customer paid for the items we fulfilled on that order. From these the app shows the store counts and averages: unique, new and returning customers, how often customers order again, and what repeat customers buy. Where the store's owner or staff are allowed to see customer details, the app may show the names of up to ten top repeat customers, read from Shopify at that moment and not stored. The app also shows the store a list of its customers, each with how many orders they placed, when they first and last ordered, what they spent and what they bought, and a page for each customer with their orders. Where the store's owner or staff are allowed to see customer details, the app may show the names of the store's customers on its customer pages, read from Shopify at that moment and not stored. A customers/redact request removes the customer's key from every one of their orders at that store, and shop/redact deletes them with the rest of the store's data.

How long we keep it

Customer personal data exists in our systems only while an order is actively being processed. Once an order reaches a final state, the stored order payload containing the customer's name, address, email and phone is erased automatically, typically within a minute, by a background job that runs independently of any deletion request or uninstall.

What remains afterwards is the routing record needed to reconcile the order, settle our fulfillment partner's invoice and support the merchant: the Shopify order id and name, destination, totals, costs, fulfillment partner status and tracking. It also retains the shipping name, address and phone that were transmitted to our fulfillment partner for that order, because that record is the only account of what we asked them to ship and where, and the merchant needs it to answer their own customer. We keep it while the merchant's account is open and delete it on a shop/redact request or on the merchant's written request.

Assistant conversations are kept for 30 days, ratings and comments on them included, then deleted automatically. Their text is erased when the app is uninstalled, and a customers/redact request deletes every conversation that looked up that customer's orders, whole, as set out under Requests from customers below.

Removing a person's portal access to a store, or disabling their portal sign-in, deletes the questions they asked in the portal there at once. When access lapses after 30 days unused, the questions asked with it are deleted within a day of it lapsing, since none is kept longer than 30 days. Questions asked while signed in as the store owner are kept for 30 days like staff questions. A daily count of each portal user's questions is kept for two days to apply their limit, then deleted.

Who else processes it

These are our sub-processors. Each receives only what it needs for its part of the job.

When a person the merchant gives assistant access in its merchant portal asks it a question, we send our AI provider that question and up to three of their earlier questions from the same conversation, and only details from the sections the store lets that person see: for orders, the order numbers, dates, totals, statuses, item counts and destination state or province; for one order, where the store gives that person order detail, its packages and their contents, whether a package has tracking, and its pre-order release dates; for notifications, the store's notifications as that person sees them; for support, the support request references, types and statuses, and the items they are about; for Insights, order counts and store-level sales summaries; and for Catalog, catalog details. We never send the store's billing contact, a tracking number, or that person's own email or name, and never cost or profit.

The assistant can only read: it cannot change an order, a setting or anything else in the store. Every request we send requires Anthropic to run it in the United States. Under Anthropic's commercial terms, Anthropic does not use the data it receives to train its models and deletes it within 30 days, except where it must keep it longer to enforce its usage policy or to comply with the law.

A current list of sub-processors is maintained in the Data Processing Addendum at app.sonichighway.io/dpa. We will give merchants notice before adding a new one.

How it is protected

• All traffic to and from the app is encrypted in transit (HTTPS enforced).
• Data at rest is held in our host's managed Postgres, which provides encryption at rest and in transit and automated backups. Backup encryption is inherited from that managed storage layer.
• Merchant data is isolated by store. Every read and write is scoped to the merchant's store through one shared module rather than at each call site, and fulfillment partner credentials are resolved per store so one merchant's account cannot be used for another's. A deployment serving a single merchant is isolated at the infrastructure level as well; our multi-tenant deployment holds merchants together in one Postgres, with that scoping applied to every access.
• Fulfillment partner account passwords are stored as host-level secrets, outside the database. The Shopify access tokens the app needs to act for a store are stored in our database, encrypted at rest by our hosting provider, and are never shown in the app. Portal sign-in links and sessions are stored only as one-way hashes.
• Every action that transmits customer data to a fulfillment partner or to the assistant's provider is written to an append-only audit log recording the shop, the orders, the action and its outcome.
• Access to production systems is limited to named personnel with individual accounts and multi-factor authentication. There are no shared logins.

We hold no SOC 2 or ISO 27001 certification. We would rather say so than imply otherwise.

Requests from customers

A merchant's customer should contact the merchant, who is the controller of their data. We support Shopify's mandatory privacy webhooks:

• customers/data_request: we record the request and the orders it names automatically. Our team then compiles what we hold about those orders, including routing records, order history, support requests and any assistant conversations that looked them up, whoever asked them, on the merchant's staff or in the merchant portal, and sends it to the merchant. Our record of the request names those orders, so a customers/redact request for any of them erases it, and once our team has dealt with the request it is deleted 90 days after the request arrived.
• customers/redact: we automatically erase what we hold about the orders the request names: the routing record, the stored order, its history and tracking, support requests about it, its notices, its audit log entries, our record of any data request naming it, and every assistant conversation that looked one of those orders up, whole: every question and answer in it, whoever asked, on the merchant's staff or in the merchant portal. Any of the store's assistant conversations with a question still being answered when we act on the request is erased too, because what that question has already read cannot be known. An assistant question that names the customer, in a conversation that never looked up their orders, cannot be matched to them; it is deleted by the 30-day retention. The request does not erase the store's wallet ledger, which records each order's charges and refunds by order number, a fulfillment partner's confirmation that a cancellation went through and the audit entries filed under it, or our team's operational alerts, which can name an order; those are deleted with the rest of the store's data on shop/redact. What was already sent to the assistant's provider cannot be recalled, and is deleted under the provider's terms described above.
• shop/redact: Shopify sends this 48 hours after a merchant uninstalls, and we then erase the shop's remaining personal data automatically.

In practice most customer data has already been erased by the automatic retention described above before such a request arrives.

International transfers

Our hosting, our fulfillment partner and the assistant's provider, Anthropic, are in the United States, and every assistant request is run there. Where personal data originates in the UK or EEA, transfers are made under the appropriate safeguards set out in our Data Processing Addendum, which incorporates the Standard Contractual Clauses.

Changes

If we change how the app handles personal data, we will update this page and change the date at the top. Material changes affecting merchants will also be notified in-app or by email.

Contact

Electric Mud Creative LLC, operating as Sonic Highway.
Privacy enquiries: privacy@sonichighway.io
Security reports: security@sonichighway.io

Questions about this document: privacy@sonichighway.io.

Merchant Terms of Service · Privacy Policy · Data Processing Addendum