Last revised: 2026-08-31
Zendra is a memberships and subscriptions app for Shopify stores, operated by Kestrel Commerce, LLC, a Delaware limited liability company doing business as Zendra (“Zendra,” “we,” “us,” or “our”). This policy explains what personal information we handle, why, who we share it with, and what you can do about it.
It covers our website at zendra.com and the Zendra app installed in a Shopify store. Cookies and similar technologies on our website are described in more detail in our Cookie Policy.
The short version
- If you’re a merchant, we hold your store and account details so we can run Zendra for you and bill you through Shopify.
- If you’re a shopper who joined a membership, we hold your details on the merchant’s behalf, not our own. The merchant decides what happens to your data, so requests about it start with them.
- We don’t sell personal information for money. Our website runs advertising cookies, which some U.S. state laws treat as “sharing” — the Cookie Policy explains how to opt out.
- Uninstall the app and we delete your data, keeping only what the law requires us to keep.
Two different roles, and why it matters
Zendra sits between a merchant and their customers, so we handle personal information in two distinct capacities. Which one applies changes who’s in charge of your data and who you should ask about it.
We’re the controller for information about merchants and website visitors — the person who installs Zendra, the people who use it in the Shopify admin, and anyone browsing zendra.com or contacting support. We decide why and how that information is used, and this policy governs it.
We’re a processor — a service provider, in U.S. state law terms — for information about a merchant’s own customers. The merchant instructs us; we act on those instructions. If you’re a shopper who bought or joined a membership, the store you bought from is the controller of your data, and their privacy notice is the one that governs it. We’ve described what we hold anyway, because you’re entitled to know.
What we collect
Merchant and account information
When you install Zendra, Shopify provides us with information about your store: the store name and domain, your contact email address, phone number, country, currency, timezone, and plan. We also record your app settings, your membership plan configurations, your email template content, and your support history with us.
We do not receive or store your payment card details. Billing runs through Shopify’s app billing system, and Shopify holds the payment method.
Your customers’ information
To run memberships and subscriptions, we process information about the merchant’s customers, received from Shopify or generated by the app. This includes customer name and email address, Shopify customer and order identifiers, order details relevant to the membership, membership records (plan, status, start and renewal dates, billing history), billing and shipping addresses where a member manages them through the customer portal, and payment method metadata such as card brand and last four digits or a PayPal email address — never a full card number.
If a merchant enables the Discord integration, we also process the Discord account identifier of members who choose to connect, so we can assign and remove roles.
We use this information only to deliver the service the merchant has configured. We don’t use a merchant’s customer data to market to those customers, we don’t combine it across merchants for our own purposes, and we don’t sell it.
Website visitors
When you visit zendra.com we collect standard technical information — IP address, browser and device type, pages viewed, referring site, and dates and times — through analytics and advertising tools. If you fill in a form, start a chat, or subscribe to our newsletter, we collect what you give us: usually your name, email address, and whatever you tell us.
Our Cookie Policy lists every cookie by name, says who sets it and how long it lasts, and explains how to turn the non-essential ones off.
Product usage
We record how merchants use the app — features opened, actions taken, errors encountered — so we can find what’s broken and decide what to build. This is tied to a store rather than to an individual shopper.
Why we’re allowed to use it
If the GDPR or UK GDPR applies to you, these are the legal bases we rely on as controller:
- Performance of a contract: providing the app, billing, support, and service communications.
- Legitimate interests: keeping the service secure, preventing fraud and abuse, understanding product usage, and telling existing merchants about relevant changes. We balance these against your interests, and you can object.
- Consent: marketing email to people who aren’t customers, and non-essential cookies. You can withdraw consent at any time.
- Legal obligation: tax and accounting records, and responding to lawful requests.
Where we act as processor for a merchant’s customer data, the merchant is responsible for having a legal basis, and our Data Processing Addendum governs our handling.
Who we share it with
We use third-party companies to run Zendra. They only get what they need for the job we’ve hired them to do, they’re bound by contract to protect it, and they can’t use it for their own purposes. Our main categories of sub-processor are cloud hosting and infrastructure, product analytics, email delivery, customer support and messaging, and website analytics and advertising.
The current list of sub-processors, naming each company and what it does, is available on request at support@zendra.com and forms part of our Data Processing Addendum. We’ll tell merchants before we add a new one that processes their customers’ data.
Alongside our sub-processors, we may disclose personal information:
- To Shopify, which is the platform Zendra runs on and the source of most of the data we hold.
- To Discord, but only where a merchant has enabled that integration and a member has chosen to connect their account.
- When the law requires it, or to respond to a valid legal request. We assess requests rather than waving them through, we push back on ones that look overbroad, and we’ll tell you unless we’re legally prevented from doing so.
- To protect our rights, our merchants, or someone’s safety, where we reasonably need to.
- In connection with a merger, acquisition, or sale of assets. If that happens, your information may transfer to the buyer, and we’ll notify merchants before it does.
We do not sell personal information for money. Our website runs advertising cookies, and under the California Consumer Privacy Act and several similar state laws that can count as a “sale” or as “sharing for cross-context behavioral advertising” even though no money changes hands. The Cookie Policy explains how to opt out, and we honor the Global Privacy Control signal where the law recognizes it. We never share a merchant’s customer data for advertising.
Where your information goes
We’re based in the United States and our infrastructure and service providers are primarily located there, so personal information from outside the U.S. is transferred to and processed in the U.S.
For transfers out of the European Economic Area, the United Kingdom, or Switzerland, we rely on the European Commission’s Standard Contractual Clauses, with the UK Addendum or International Data Transfer Agreement where the UK GDPR applies. Copies are available on request.
How long we keep it
We keep merchant account and configuration data for as long as Zendra is installed. After you uninstall, we retain it for a limited period so you can reinstall without rebuilding your setup, then delete or anonymize it. We also act on the data deletion requests Shopify sends us on a merchant’s behalf, within the timeframes Shopify’s requirements set.
A merchant’s customer data is retained according to the merchant’s instructions and deleted when they tell us to or when they uninstall. Support conversations, billing records, and anything we’re required to keep for tax, accounting, or legal reasons are held for as long as that purpose lasts. Backups persist for a limited period before being overwritten.
If you want your data deleted sooner than any of this, email support@zendra.com and we’ll take care of it.
How we protect it
We encrypt data in transit and at rest, restrict internal access to people who need it for their work, authenticate merchants through Shopify rather than holding passwords of our own, and review our security practices as the product changes.
No service can promise perfect security, and we’d rather say that than imply otherwise. If a breach affects your personal information, we’ll notify you and the relevant authorities as the law requires.
Your rights
Depending on where you live, you may have the right to know what personal information we hold about you and get a copy; to correct it; to have it deleted; to receive it in a portable format; to object to or restrict how we use it; to withdraw consent; to opt out of targeted advertising, sale, or sharing; and not to be discriminated against for exercising any of these.
Merchants and website visitors: email support@zendra.com and tell us what you’d like. We’ll verify who you are before acting, which usually means confirming you control the email address on the account. We respond within 30 days, or 45 where U.S. state law allows and the request is complex, and we’ll tell you if we need longer. It’s free unless a request is excessive or repetitive.
Shoppers and members: contact the store you bought from. They control your data and we act on their instructions, so they’re the ones who can decide the outcome. If you’re not sure who to reach or you’re getting nowhere, write to us and we’ll help you find the right route — but we can’t override a merchant’s decision about their own customers’ data.
Authorized agents may submit requests on your behalf where the law allows, with proof that you’ve authorized them.
If you’re in the EEA, the UK, or Switzerland and you’re unhappy with how we’ve handled a request, you can complain to your local data protection authority. We’d appreciate the chance to sort it out first.
Marketing email
We may email merchants about product changes, and we may email subscribers who asked to hear from us. Every marketing email has an unsubscribe link that works, and unsubscribing doesn’t affect the service emails you need to receive, like billing notices or security alerts.
Children
Zendra is a business tool and isn’t directed at children. We don’t knowingly collect personal information from anyone under 16. If you believe a child has given us information, email support@zendra.com and we’ll delete it.
Changes to this policy
We’ll update this page when our practices change and revise the date at the top. For changes that materially affect how we handle your personal information, we’ll notify merchants by email or in the app before they take effect.
Contact us
Questions, requests, and complaints all go to the same place, and a person reads them. Email support@zendra.com, or write to us:
Kestrel Commerce, LLC d/b/a Zendra
1111B S Governors Ave, Suite 3239
Dover, DE 19904
United States