Data Deletion Request Policy

1. Two relationships, two paths

LNC processes two broad categories of personal information:

1. Merchant account information — data about the business account holder, its users, billing, and support communications. LNC is generally the controller / business for this information.
2. Merchant store data — data about the merchant's own end customers, orders, products, fulfillment, and webhook events, ingested from connected commerce platforms (such as Shopify). LNC is generally a service provider / processor for this information; the merchant is the controller.

Where personal information is processed on behalf of a merchant, the merchant generally controls deletion. Where you are the merchant's end customer, please contact the merchant first.

2. How merchants request deletion

A merchant can request deletion by emailing [Privacy Email] from a verified account address, with the subject “Data Deletion Request”. A self-serve deletion request form will be added to this page in a future release.

Please include the merchant's business name and account email, the scope of deletion (entire account, specific store connection, specific end-customer records, specific date range, etc.), and the reason for the request (helpful but not required).

We will acknowledge your request within seven (7) business days and complete it within the time frame required by applicable law — typically thirty (30) days under PIPEDA and forty-five (45) days under CCPA (which may be extended once).

3. How end customers should request deletion

If you are an end customer of a merchant that uses LNC, your data relationship is with that merchant. Please contact the merchant first. The merchant is the controller of your personal information and is responsible for handling your request.

If the merchant directs LNC to delete your information, or if applicable law requires us to act directly, we will cooperate. You can also contact [Privacy Email] and we will route your request to the appropriate merchant.

4. Shopify uninstall and platform deletion requests

When a merchant disconnects or uninstalls LNC from Shopify, Shopify may send privacy-related platform requests. Where the relevant backend workflow is available, LNC handles these requests as follows:

• shop/redact — Shopify instructs LNC to redact shop-level personal information after the relevant retention window. LNC will redact or delete the information in accordance with Shopify's Protected Customer Data requirements when the workflow is active.
• customers/redact — Shopify instructs LNC to redact specific customer personal information when the workflow is active.
• customers/data_request — Shopify forwards customer data access requests; LNC provides the merchant (or Shopify) with the relevant data LNC holds about that customer.

Deletion may take additional time to propagate through backups and read replicas. Backups are rotated on a defined schedule and overwritten in the ordinary course.

5. Identity verification

To protect against fraudulent deletion requests, we will take reasonable steps to verify the identity of the requester before acting. We will not use information provided for verification for any other purpose.

6. Exceptions and retention

We may retain certain information after a deletion request to the extent necessary to:

• comply with legal, tax, accounting, audit, or regulatory obligations (typical retention: up to seven (7) years for financial records);
• detect, investigate, prevent, or respond to security incidents, fraud, or abuse;
• enforce our agreements or defend legal claims;
• support contractual obligations to a merchant where you are that merchant's end customer; or
• retain information in encrypted, rotating backups for a limited period until those backups are cycled out.

7. Confirmation and appeal

We will confirm in writing when deletion has been completed, and will explain any information that has been retained under an exception. If you disagree with our response, you may reply to the confirmation email, contact [Privacy Email], or file a complaint with the Office of the Privacy Commissioner of Canada or your applicable state authority.

Submit a request

We're finalizing the deletion request intake form. In the interim, please email [Privacy Email] from a verified account address with the subject “Data Deletion Request”. We'll acknowledge within seven business days.

General contact information is available on the Legal Notices page.