Is it safe to connect a chargeback app to your Shopify store? A UK merchant's checklist

You are one click from installing a chargeback app that will read your orders, your customers' names and addresses, your tracking records and your payment dispute data. Most Shopify apps ask for access like this and most are fine. Pausing before you say yes to any chargeback app is still the right instinct, because the data involved is your customers' personal information, and under UK law you are the one who answers for it.

A chargeback app is reasonably safe to connect when it passes five checks: it asks only for the permissions its job needs, Shopify has reviewed its access to customer data, it will sign or publish a UK GDPR-style data processing agreement, it is open about who else handles your data, including any AI provider, and it lets you leave and have your data deleted. No vendor can be called safe in general, so the useful question is whether this one is safe enough for your store, and you can answer it in about 30 minutes.

This guide is for you if:

• You run a UK Shopify store, you are considering a chargeback app, and you want to know what you are agreeing to before you install.
• You are a sole trader or small limited company, you have no data protection lawyer, and you want a practical checklist rather than legal theory.
• You already use a chargeback app and want to check what it holds, who else sees it and how you would leave.

Last updated: 22 October 2026. Written by the ChargeFix team. Reviewed against sources on 22 October 2026. General information, not legal advice. For a specific legal question, speak to a qualified adviser or the ICO.

Disclosure. ChargeFix is a chargeback app, so I have an interest. I will show what our own documents say and, more usefully, what they leave out. Every claim about another vendor comes from its public pages, and where I could not find an answer I say so instead of guessing.

The 30-second answer (TL;DR)

• Check five things: permissions, Shopify's review, the data contract, who else handles the data, and the exit.
• Shopify requires apps that read customer names, addresses, phone numbers or emails to meet extra rules, and requires approval before an app can read or write dispute evidence. That helps, but it does not vouch for any single vendor.
• Under UK GDPR you are normally the controller and the chargeback app is your processor. Your contract with it must cover documented instructions, security, sub-processors, deletion or return of data, and audits.
• Ask which AI provider writes the letters, where data is hosted, how long it is kept and what happens when you leave. Some vendors, including us, do not publish every answer.
• Read the fee and exit terms too. A safe app can still be an expensive one to leave.

Do this today (10 minutes):

1. Open the chargeback app's Shopify App Store page and note every permission it lists on the install screen.
2. Find its privacy policy and data processing agreement. If you cannot find one, write that down.
3. Search its terms for the words "delete", "terminate" and "fee" and read what they say about leaving.

If any of those three steps comes up empty, ask the vendor before you install.

From install to exit

Stage	What happens to your data	What to check
Install	You approve access	Does it ask for more than it needs?
Dispute opens	The app reads order, address and tracking data	What does it store, and what does it only read?
Letter drafted	Case details may go to an AI provider	Which provider, and is the data used for training?
Evidence filed	The response goes to Shopify and the bank	Who can see it, and can you edit it first?
Leaving	Access should stop	Is your data deleted, and when?
After	Records may remain	Any fee or notice period for leaving?

What can a chargeback app see when you connect it?

Everything a chargeback app can see is controlled by the permissions you approve at install, which Shopify calls access scopes. Shopify publishes the list, and it is worth knowing the ones that matter for disputes.

Access scope	What it covers, in plain words	Shopify approval needed
read_shopify_payments_disputes	The dispute itself: amount, reason, status, due date	Not labelled
read and write dispute evidences	Reading and saving the evidence on a dispute	Yes, apps must request access from Shopify
read and write dispute file uploads	Attaching files to a dispute	Yes
read_orders	Orders, fulfilments and transactions. Limited to the last 60 days unless the app also holds the read_all_orders scope	Not labelled for 60 days; approval for older orders
read_customers	Customer records	Not labelled
read_shopify_payments_payouts	Payouts and balance transactions	Not labelled

You can see why a chargeback app needs most of these. It must read the dispute, the order behind it and the delivery records, and it must be able to write evidence back to the dispute. What it should not need is anything about your products, prices or discount codes, and it should never need to charge your customers.

For ChargeFix, the support page says it requests read access to orders and Shopify Payments account data, and read and update access to disputes and their evidence. It says it does not change products, prices or customers, and never charges customers. It also sees only Shopify Payments disputes and the last 60 days of orders. Its privacy policy says you approve specific Shopify access at install but does not list the scope names, so read the install screen to confirm.

Do the same with any app. If the install screen asks for something that has no obvious link to disputes, such as marketing or inventory access, ask why before you approve.

What does Shopify check before a chargeback app can read customer data?

Quite a lot, and that is the first layer of protection. Shopify's rules for protected customer data split access into levels. Level 1 covers customer data without names, addresses, phone numbers or emails. Level 2 covers data that includes those fields. A chargeback app needs level 2, because disputes involve names, addresses and emails, and public apps need Shopify's approval for it.

Shopify says it approves access only to the minimum data an app needs to do its job. App developers must also meet rules that include:

• processing only the minimum personal data needed;
• telling merchants what data they process and why;
• having privacy and data protection agreements with merchants;
• applying retention periods so data is not kept longer than needed;
• encrypting data at rest and in transit.

Level 2 adds more: encrypted backups, separate test and production data, limits on staff access, an access log for protected customer data, and a security incident response policy. Shopify may also run data protection reviews, particularly for apps with many installs, many customer records, more approved fields or long retention periods.

Take this as reassurance, with limits. These rules reduce risk and they are checked before approval. They do not tell you how a particular vendor handles your data day to day, which is why the rest of this guide exists. A Shopify-approved chargeback app can still keep data longer than you would like, use an AI provider you would rather avoid, or make leaving expensive.

Who is responsible for your customers' data under UK GDPR?

You are, in most cases, and this is the part that surprises merchants. Under UK GDPR you decide why and how your customers' data is used, which makes you the controller. A chargeback app that processes it on your behalf is a processor. Using a processor does not move the responsibility. It adds a duty to have the right contract in place.

The ICO says that contract must include certain terms. Here they are in plain English, with what to look for in a vendor's data processing agreement.

Contract term (UK GDPR Article 28)	What it means for you	What to look for
Documented instructions	The app processes data only as you instruct	A clear statement that it acts on your instructions
Confidentiality	Staff are bound to keep it confidential	A confidentiality commitment
Security	Appropriate technical and organisational measures	Encryption, access control, logging
Sub-processors	You must authorise others it uses, and it stays liable	A named list and a way to be told about changes
Data subject rights	It helps you answer requests from individuals	A process for access and deletion requests
Breach and assessment help	It helps you meet breach and risk-assessment duties	A notification promise and a time limit
End of contract	At your choice, it deletes or returns the data	A deletion clause that applies when you leave
Audits	It provides information and allows inspections	A right to evidence of compliance

Now compare that with what I could find publicly. ChargeFix's data processing agreement names ChargeFix as processor and the merchant as controller, lists its sub-processors, commits to notify affected merchants without undue delay and within 72 hours of a breach, provides information to show compliance on reasonable request, and relies on Standard Contractual Clauses for transfers outside the region of origin. Data is deleted when Shopify's shop-removal notice arrives after you remove the app.

For Chargeflow, I read the terms of service, last updated 4 May 2026. They require personal data not to be processed for longer than needed for the stated purposes, and say the merchant should revoke access when the service ends. I found no clause on deletion or return of data after termination in those terms. I did not find or read a separate data processing agreement, and one may well exist, so treat that as a question to ask, not a finding. I have not read the equivalent documents for other vendors.

Where do your customers' details actually go?

A chargeback app rarely works alone. It uses hosting, a database, sometimes a delivery lookup service and, increasingly, an AI provider. Each is a sub-processor, and you are entitled to know who they are.

Question	ChargeFix, per its privacy policy and DPA	Chargeflow, per its public pages
What is stored?	Case ID, amount, reason, status, dates and shop settings. Customer names, emails, addresses and letters are read from Shopify only while you review a case	Unclear from the pages I read
Sub-processors	Shopify, Supabase for the database, an unnamed cloud host, OpenAI or Anthropic for drafting, EasyPost optionally for delivery lookups	Not listed in the pages I read
Hosting region	Not stated	Primary hosting is AWS us-east-1, with regional hosting such as EU available on request for enterprise customers
AI and training	Business API terms, and customer content is not used to train the models. Providers may keep requests for a limited period to detect abuse	Not stated in what I read
Retention	No fixed periods stated. Kept while installed, then deleted on Shopify's shop-removal notice	Unclear from the pages read

Two things about the table. First, the gaps in ChargeFix's own documents are real: it does not name which AI provider it uses, where it hosts data, or how long it keeps server logs. I would rather say so than have you discover it. Second, the Chargeflow column mostly says "unclear", which means I could not answer, not that the answers are bad. Ask each vendor directly.

Hosting outside the UK is not a problem in itself, but it means your customers' data may be transferred internationally, and you should ask what safeguards apply. Many chargeback apps are US-based and quote prices in dollars. Ask where the data sits and which transfer mechanism covers it.

What about the AI that writes the letters?

Most chargeback apps now use a large language model to draft the response letter. That raises two separate concerns, and they need different checks.

Privacy. The case details go to an AI provider so it can write the letter. Ask which provider, whether it keeps the data, and whether customer content is used to train its models. ChargeFix's privacy policy says it uses business API services, that customer content is not used to train the models, and that providers may keep requests for a limited period to detect abuse. It names OpenAI or Anthropic without saying which. For any vendor, "no training" should be a written commitment, not a marketing line.

Accuracy. This is the concern I would worry about more as a merchant. An AI draft can sound confident while stating something your records do not support, and a response that says something untrue about a delivery or a customer is a problem with the bank and potentially with your account. Test it. In your first batch, check every factual claim in a draft against your own records. A good tool leaves out what it cannot support. ChargeFix's public page says its letters omit claims the records cannot support, and I would still check.

Some merchants in Chargeflow's one-star App Store reviews describe AI responses as generic. These are individual claims I cannot verify, but they are a reminder that a letter can be safe for your data and still weak as evidence.

How does the money side work?

Safety is not only data. It is also what the app can do with money.

• Can it charge your customers? It should not need to. ChargeFix's help page says it never charges customers.
• How do you pay it? ChargeFix bills through your Shopify invoice, so no separate card is needed. Chargeflow's terms say fees are charged to your payment gateway, that enrolment can involve a temporary authorised payment, and that a deposit held as a reserve fund can be increased with volume.
• What happens if you stop paying? Chargeflow's terms say services stop after seven days' notice of late payment, with interest at the lesser of 1.5% a month or the legal maximum, plus collection costs.
• What does leaving cost? Chargeflow's terms charge 8% of the chargeback value if a store is disconnected after a dispute was opened, and require 30 days' notice to end the agreement outside a commitment or trial period.

I include the last two to make a point, not to single out one vendor. An app can be perfectly safe with your data and still be costly to leave. Read the exit terms alongside the privacy terms. Our guide to switching away from Chargeflow covers one example in detail.

What happens to your data when you uninstall?

This is the check most merchants skip, and it matters most. You are entitled under UK GDPR to have your processor delete or return your data at the end of the contract, if you choose.

Question	ChargeFix, per its own pages
Does access stop at once?	Yes. Access stops immediately after uninstalling, and any connected Stripe key is removed
Is your data deleted?	Yes, through Shopify's standard shop-removal request, which Shopify sends shortly after uninstall. That deletes sessions, settings, billing records and dispute details
What stays?	The letter and evidence remain in Shopify on the dispute. ChargeFix does not keep customer names, emails or addresses
Customer data requests	Answered with a note that ChargeFix stores no customer personal data

For other vendors, ask four questions before you install: how and when is my data deleted, will you confirm it in writing, can I export my dispute history first, and is there any fee or notice period for leaving?

One practical tip. After uninstalling any app, open Shopify admin, go to Apps and confirm it has gone, and remove any API keys or tokens you gave it elsewhere, such as a payment key. Uninstalling stops access, but a key you pasted elsewhere stays valid until you revoke it.

What are the red flags and green flags?

Use this as a quick scan. None of these is proof, but several in a row should make you pause.

Red flags	Green flags
No data processing agreement you can read	A public processor contract that names its role
Vague about AI providers and training	Named providers or a clear written "no training" commitment
Asks for access unrelated to disputes	Access that matches the job, explained on a support page
No answer on deletion after you leave	A described deletion process tied to Shopify's removal notice
Exit fees or long notice periods buried in terms	Cancel under subscription at any time
Cannot say where data is hosted	A stated region or a clear answer when you ask
Files responses without letting you review	Manual default, with automation opt-in and limits
Support you cannot reach	A support email with a stated reply time

On the last row: ChargeFix's help page says it aims to reply within one business day. Test any vendor's support before you rely on it by asking one of the questions in this guide and noting how fast and how clearly it answers.

How do you check a chargeback app in 30 minutes?

A timetable beats good intentions. This plan assumes you start on Monday 26 October 2026 and install on Monday 2 November.

Date	Task	Time
Mon 26 Oct	Read the App Store listing, install screen access list and privacy policy	10 minutes
Tue 27 Oct	Find the processor contract and terms; search for "delete", "terminate" and "fee"	10 minutes
Wed 28 Oct	Send the vendor the email below	5 minutes
Fri 30 Oct	Read the reply. Decide whether the answers are clear enough	5 minutes
Mon 2 Nov	Install in Manual mode and check that the access matches what you read	10 minutes
Tue 3 Nov	Run one old dispute through it and check every claim in the draft	20 minutes
Fri 6 Nov	Check what the app stored and confirm the cancel button works	10 minutes

Here is an email to send before you install. Change the brackets and send it as written.

Subject: Data protection questions before I install your app

Hello,

I run a UK Shopify store and I am considering your chargeback app. Before I install, please could you confirm in writing:

1. Do you offer a DPA that names you as my processor, and where can I read it?
2. Which Shopify permissions do you request, and what does each one do?
3. What customer data do you store, and what do you only read while I review a case?
4. Which sub-processors do you use, including any AI provider, and are they named?
5. Is customer content used to train any AI model?
6. Where is data hosted, and what safeguards apply to transfers outside the UK?
7. How long do you keep data, and how and when is it deleted when I leave?
8. Is there any fee, deposit or notice period for cancelling?

Thank you,
[Your name]
[Store URL]

And a one-line scorecard for each vendor you check.

App: [name]  |  DPA public: [yes/no]  |  Access matches the job: [yes/no]  |  AI provider named: [yes/no]  |  Training excluded in writing: [yes/no]  |  Deletion described: [yes/no]  |  Exit fee or notice: [none/what]  |  Reply speed: [x]

If the answers come back clear, that is a good sign. If a vendor dodges questions 5, 7 or 8, that is also a sign.

What does this look like for three UK merchants?

These examples are made up to show the decision. They are not real merchants.

A sole trader selling prints. She has about 400 customers a year and one or two disputes a month. A chargeback app is probably not worth the risk and effort. Shopify's own default response, plus a written checklist, may be enough. If she does install one, the free trial of a tool she has checked is the sensible route.

A limited company with two staff. It has a few thousand orders a year and regular disputes. It should treat the chargeback app as a processor and keep a short record of the checks it ran, the reply it received and the date, since it is accountable for those decisions. It should also decide who in the company can switch on automatic filing and who can see the app's dashboard.

An agency managing five clients' stores. The agency is a processor for its clients, and the chargeback app becomes a sub-processor. That means the agency needs its clients' authorisation, a contract that passes the same obligations down, and a clear list of which client store the chargeback app is installed on. This is the case where cutting corners is most expensive.

What if something goes wrong?

If you think an app has mishandled data, act in this order. First, remove it and revoke any keys you gave it. Second, ask the vendor in writing what happened and what data was involved. Third, if personal data may have been exposed, UK GDPR may require you to report to the ICO and to affected individuals, depending on the risk, so check the ICO's guidance on personal data breaches promptly rather than waiting. Fourth, keep a record of what you found and what you did.

A processor's contract should oblige it to help you with breach notification, and the ICO lists that as a required term. ChargeFix's data processing agreement commits to notifying affected merchants without undue delay and within 72 hours. Whatever the vendor promises, know where to find the ICO's breach guidance before you need it.

What is different for UK merchants?

• UK GDPR and the ICO. You, as controller, answer to the ICO for how your customers' data is handled, even when a processor does the work.
• US-based vendors. Many chargeback apps are US companies hosting data in the US and billing in dollars. Ask about international transfer safeguards and the currency of fees.
• Sole traders and small companies. You may not have a data protection officer, but you still need a processor contract. A public DPA saves you drafting one.
• Customers' expectations. Your privacy notice should say that you use service providers to handle disputes. Check yours does.
• Shopify's rules. Shopify's protected customer data rules apply to public apps worldwide, so they help UK merchants too.

What I could not verify: whether Chargeflow has a separate DPA, any vendor's real-world security practices beyond what they publish, and how Shopify's data protection reviews work for any named app. I have not audited any vendor, and a published policy is a promise, not proof.

What are the common mistakes when connecting a chargeback app?

1. Approving the install screen without reading it. The install screen tells you what the app can see.
2. Assuming "Shopify-approved" means "right for you". Approval checks the minimum, not your risk tolerance.
3. Not finding the DPA. If you cannot read it, ask for it.
4. Ignoring the AI provider question. Ask who it is and whether training is excluded.
5. Skipping the exit terms. Fees, deposits, notice periods and deletion clauses all matter.
6. Giving the app keys you forget about. Revoke them after you leave.
7. Switching on automatic filing on day one. Run Manual mode and check every claim first.
8. Forgetting your privacy notice. Tell customers you use providers to handle disputes.
9. Treating a policy as proof. Test the vendor with questions and watch how it answers.
10. Never revisiting the decision. Check the chargeback app's terms, scopes and sub-processors again each year.

Frequently asked questions

Is it safe to connect a chargeback app to Shopify?

It can be, if the app passes five checks: permissions that match its job, Shopify's approval for customer data access, a readable DPA, named sub-processors including any AI provider, and a clear deletion and exit process. No app is safe in general, so check this one against your own risk tolerance before you install.

What permissions does a chargeback app need?

It needs to read disputes and the orders behind them, and to write evidence back to the dispute. In Shopify's scope list that means dispute access, dispute evidence access, order access and sometimes customer and payout access. It should not need to change products, prices or customers. If the install screen asks for more, ask the vendor why.

Does Shopify vet chargeback apps?

Partly. Shopify requires public apps to request approval for protected customer data and for dispute evidence scopes, and it may run data protection reviews. Developers must minimise data, encrypt it and keep an access log for sensitive fields. That reduces risk but does not vouch for how any single vendor behaves day to day.

Who is responsible for my customers' data if the app is breached?

Under UK GDPR you are normally the controller and the chargeback app is your processor, so you remain accountable to the ICO and your customers. The processor must help you meet breach duties under your contract. Check the vendor's notification promise and know where to find the ICO's breach guidance before you need it.

Do chargeback apps use AI with my customers' data?

Many do, to draft the response letter. Ask which AI provider is used, whether it keeps requests and whether customer content trains its models. ChargeFix says it uses business API services, does not allow training on customer content and names OpenAI or Anthropic without saying which. Ask every vendor for the same answers in writing.

What happens to my data when I uninstall?

It depends on the vendor. ChargeFix says access stops at once and data is deleted when Shopify's shop-removal notice arrives, while the letter and evidence stay in Shopify on the dispute. For other tools, ask how and when data is deleted, whether you can export first and whether leaving carries any fee or notice period.

Do I need a data processing agreement for a chargeback app?

Yes. UK GDPR requires a contract with any processor covering instructions, security, sub-processors, deletion or return of data and audits. Many vendors publish one. If you cannot find it, email the vendor before installing and keep the reply. A public agreement also saves you drafting your own.

Can a chargeback app charge my customers?

It should not need to. ChargeFix's help page says it never charges customers. Other apps differ, and some collect fees from the merchant's payment gateway, so read the terms on billing, deposits and authorisation holds. If an app asks for any ability to charge or refund customers, ask what it is for.

Is a US-hosted chargeback app a problem for a UK store?

Not automatically, but it means your customers' data may be transferred internationally, so ask which safeguards apply and where data is stored. Some vendors host in the US and offer other regions on request. Ask where yours sits, for which transfer mechanism covers it and for the answer in writing.

Should I use a chargeback app at all?

Only if the disputes justify it. With one or two a month, Shopify's default response and a written checklist may be enough, and that carries no extra data risk. If you do use an app, choose the one that asks for the least, explains its data handling clearly and lets you leave easily.

Start free trial with ChargeFix

ChargeFix is a chargeback app for Shopify Payments disputes. It reads the order, payment-check and delivery records it needs, stores only minimal dispute details, and publishes its privacy policy and DPA so you can read them before you install. Manual review is the default, and a free trial lets you test it on real disputes before you pay anything. Start free trial

Sources

• Access scopes, Shopify developer documentation
• Protected customer data requirements, Shopify developer documentation
• Responding to chargebacks and inquiries, Shopify Help Center
• What needs to be included in the contract, ICO
• Chargeflow terms of service, last updated 4 May 2026
• Chargeflow product information
• Chargeflow one-star reviews, AppNavigator
• ChargeFix privacy policy
• ChargeFix DPA
• ChargeFix support page