Skip to content

GDPR data requests and erasure

Read time: 5 minutes. Last updated: June 20, 2026 Who it's for: Merchants who receive a buyer's data-access or deletion (erasure) request and need to know how QuotWay handles it, what's exported, and what's deleted.

When a buyer exercises their data rights under GDPR or a similar law, QuotWay supports the request through Shopify's privacy framework. This article explains how a data-access request produces an export of the buyer's quote data, the timeline QuotWay works to, and exactly what is removed when a buyer is erased.

How does a buyer data request work?

Buyer data requests flow through Shopify. When a buyer asks for a copy of their data, Shopify notifies the apps connected to your store, and QuotWay responds for the QuotWay data tied to that buyer.

QuotWay produces an export of the buyer's quote data - the quotes they requested, the proposals and counter-offers exchanged, messages, and the contact details captured on those quotes. The export is the source of truth for what QuotWay holds about that buyer; your Shopify-side customer, order, and product data is handled by Shopify itself, separately.

QuotWay's policy is to fulfil a data request within 30 days of receiving it, which keeps you inside the response windows GDPR and comparable laws expect.

What does the export look like?

The export is delivered as JSONL - JSON Lines, where each line is one self-contained JSON record. This format is easy to read, easy to hand to a buyer, and easy for tooling to process line by line.

A typical line describes one quote and the data attached to it. The shape below uses fictional, redacted sample data:

{"type":"quote","quote_id":"Q-1042","status":"FULLY_ACCEPTED","created_at":"2026-05-12T09:14:00Z","contact_name":"Sample Buyer","contact_email":"buyer@example.com","line_items":[{"title":"Sample Product","quantity":50,"buyer_price":"42.00"}],"messages":2,"attachments":1}

Each record stays scoped to the requesting buyer, so the export contains only that buyer's data and nothing about other customers.

What gets deleted when a buyer is erased?

An erasure (sometimes called a redaction) request removes the buyer's personal data from the quotes QuotWay holds. When QuotWay processes a buyer-erasure request, the buyer's personal information on their quotes is redacted - the contact name, email, and other personal details that identify them.

The quote records themselves can remain in a redacted state so your aggregate history and reporting stay intact, but they no longer carry the personal data that pointed to a real individual. After erasure, you can't email or contact that buyer through the quote, because the contact details are gone.

Erasure is permanent. Once a buyer's personal data is redacted, QuotWay can't recover it. If you need a copy first, run the data-access export described above before requesting erasure.

This is distinct from uninstalling the app or deleting your whole store's data - for that, see Data retention and uninstall.

What's the difference between a data request and erasure?

  • A data request is read-only: it produces the JSONL export of the buyer's data and changes nothing.
  • An erasure is destructive: it redacts the buyer's personal data on their quotes and can't be undone.

Both are fulfilled under QuotWay's 30-day policy, and both are scoped to the individual buyer the request names.

Related articles

Still need a hand? The team is happy to help.

Contact supportInstall Free on Shopify