DamageDesk

Privacy Policy

DamageDesk by CNR Consulting Services, Inc.

Effective date: October 13, 2026

CNR Consulting Services, Inc. ("we", "us") operates DamageDesk, a Shopify app that helps merchants collect and review shipping and product damage claims. When a merchant installs DamageDesk, we process personal data on that merchant's behalf as a processor. The merchant is the controller of customer personal data in their store.

Personal data we process

  • Customer name and email address associated with an order or claim
  • Shopify order identifiers and order numbers
  • Claim details (damage type, description, status, line items)
  • Photos and other images uploaded as claim evidence
  • Messages between customers and merchant staff about a claim
  • Staff or API actor identifiers needed for audit and access logs
  • Notification email addresses and webhook endpoints configured by the merchant

Purposes of processing

  • Create, store, and display damage-claim evidence and workflow status
  • Authenticate claim portal access (invite links and email OTP)
  • Notify merchant staff and deliver merchant-configured webhooks
  • Provide merchant Admin, Customer Account, REST API, and MCP tools
  • Comply with Shopify mandatory privacy webhooks and applicable law
  • Maintain access logs for protected customer data

We do not sell personal data. We do not use claim personal data for advertising or for automated decisions with legal or similarly significant effects on individuals.

Retention

Resolved claim personal data (including photos and messages) is retained for the number of days the merchant configures in DamageDesk settings (default 1,825 days / 5 years after the claim is marked resolved), then deleted automatically. Open claims are kept until they are resolved or deleted earlier via Shopify privacy webhooks ( customers/redact, shop/redact) or merchant actions. Access logs of reads of personal data are retained for 365 days.

Subprocessors

We host DamageDesk on Cloudflare (Workers, D1, R2, KV, Queues, Pages, and Email Sending). Data is processed in Cloudflare's infrastructure according to our configuration and Cloudflare's terms.

Security

Data in transit uses HTTPS/TLS. Data at rest is stored in Cloudflare managed services. Claim invite tokens are stored hashed. Media URLs may use short-lived signed links. Access to claim personal data by staff, API keys, and portal sessions is logged.

Merchant agreements

Processing terms between merchants and CNR Consulting Services, Inc. are described in our Data Protection Agreement. Installing or continuing to use DamageDesk constitutes acceptance of that agreement.

Contact

Privacy inquiries: [email protected]
CNR Consulting Services, Inc.

This page is provided for transparency with merchants and customers. It is not legal advice. Contact [email protected] with privacy questions.