EventSmith privacy policy
Last updated November 4, 2026.
EventSmith is a Shopify app by Lareys. It runs JavaScript that you write when something happens in your store, or when your own systems send it an event. This policy covers the data EventSmith handles for stores that install it. For anything about your data, write to hello@lareys.dev.
You decide what your hooks do. EventSmith processes your store's data on your behalf and only to run the hooks you set up. We never sell it, never use it for advertising, and never send you marketing. TheEventSmith terms hold our data processing agreement with your store, and theincident response policy says what we do if your data is ever at risk.
What EventSmith stores
| What | Why |
|---|---|
| Your store's address and the access token Shopify gives the app | To read and change your store through Shopify's Admin API when a hook asks it to. |
| Your store's email address, or the notification address you set in Settings | To email you when a run fails, when access a hook needs is removed, and as your plan's runs run out. |
| Your hooks: their names, descriptions, triggers, code and every saved version | To run them, and to show which version each run used. |
| The secrets you add in Settings, such as API keys | To hand them to your code. Each value is encrypted, and it is hidden in every log by name. |
| Runs: the event that started each run, what your code did and what came back | To show you every run in Logs, to retry a failed run and to replay one. An event from Shopify can contain customer details, such as an order's name, email, phone number and address. A custom event keeps the body and headers your system posted, which include the address it posted from. |
Test runs are not stored. EventSmith asks Shopify only for the access it needs to start your hooks, and asks you to approve more access when a hook's code needs it.
Where it goes
- Cloudflare runs EventSmith and stores its data, and sends its emails from noreply@eventsmith.lareys.dev. See Cloudflare's privacy policy.
- The services your own code calls. When a hook sends data to an address or an email address you chose, it goes there because your code sent it, and that service's own terms apply.
Cloudflare may process data outside your country, under its own safeguards for international transfers.
How long we keep it
- Runs: kept for your plan's log retention, 7 days on Free, 30 on Pro and 90 on Agency, then deleted.
- If your store's runs reach 8 GB, the oldest finished runs are deleted first to make room for new ones.
- Hooks, versions and secrets: kept while EventSmith is installed, until you delete them.
- When you uninstall EventSmith, every hook stops at once. Shopify asks us to delete your store's data 48 hours later, and we then delete everything: hooks, versions, secrets, settings and runs.
Your customers' requests
When a customer asks your store to delete their data, Shopify tells EventSmith, and we delete the stored runs that name that customer. When a customer asks what data you hold about them, we email your notification address a link to each stored run that names them, or tell you there are none.
Who can see it
Everyone on your store's staff who can open EventSmith sees its hooks, settings and logs. At Lareys, we look at a store's data only to answer a support request you send us or to keep the app running, and Cloudflare's account audit log records every action taken in the systems that hold it.
Your choices
You can delete a hook, a secret or your whole store's data at any time by deleting it in the app or uninstalling EventSmith. You can also ask us for a copy of what we hold, to correct it, or to delete it sooner. Write to hello@lareys.dev from your store's email address, and we'll reply within 30 days. If you think we've handled your data wrongly, you can complain to the data protection authority where you live.
Changes
If this policy changes, the new version appears on this page with a new date.