Data Trust Decision-Support Brief Business Type: Shopify apparel brand Purpose: Operational review of sensitive information handling (non-legal compliance perspective) 1. Input Acknowledgment + Data Trust Score Inputs Reviewed Business model: Shopify apparel brand Information collected: Customer names Shipping addresses Purchase history Current storage tools: Shopify Klaviyo Google Sheets Known goals: CCPA basics Secure payment handling Data Trust Scoring Method Score range: 1–10 Higher scores indicate stronger operational visibility, access control, and retention clarity. Area Current Assessment Score Visibility The business knows what data it collects and the main platforms involved, but may not have a complete map of where data flows between systems. 6/10 Access Control Shopify and Klaviyo generally provide account permissions, but Google Sheets introduces higher risk if access is broad, unmanaged, or shared. 5/10 Retention Clarity No retention rules, deletion schedules, or backup handling process were provided. 3/10 Overall Data Trust Score: 5/10 Operational interpretation: The business has a recognizable technology stack and awareness of privacy goals, but its current maturity appears limited by unclear ownership, spreadsheet handling practices, and missing lifecycle rules for customer information. 2. Plain-Language Policy Draft How We Handle Your Information We collect information that helps us provide and improve our products and services. When you place an order, we may collect: Your name so we know who placed the order. Your shipping address so we can deliver your purchase. Information about your purchases so we can manage orders, provide support, and improve our products. We use trusted service providers to help operate our business, including platforms that support online shopping, customer communication, and business operations. We do not collect more information than we need to provide our services. We take steps to protect customer information by limiting access, using secure services, and reviewing how information is stored and managed. We may keep certain information for operational purposes, such as maintaining order records, supporting customers, and improving our services. You may have choices regarding your information depending on where you live and applicable privacy requirements. If you have questions about your information, you can contact us through our customer support channels. 3. Vendor Risk Checklist Shopify Review Questions Data Storage and Access Where is customer information stored within Shopify? Which team members currently have access to customer information? Are employee permissions reviewed regularly? Can access be limited based on job responsibilities? Data Deletion What happens when the business requests customer data deletion? Does deletion remove data from active systems only, or also backups? How long does deletion normally take? Are deleted records recoverable? Backups and Recovery How are customer records backed up? Are backups encrypted? How long are backups retained? Can deleted customer data remain in backups? Klaviyo Review Questions Data Usage What customer information is stored in Klaviyo? Which marketing features use customer purchase history? Are customer segments automatically created using personal information? Data Deletion How can customer profiles be permanently deleted? Does deletion remove historical campaign data? Are deleted profiles removed from analytics systems? Are suppression lists retained after deletion? Backups How long are customer records retained in backups? Are backups included in deletion requests? Who can access stored customer data internally? Google Sheets Review Questions Access Control Who currently has access to customer spreadsheets? Are any spreadsheets shared through public links? Are former employees or contractors removed from access? Is two-factor authentication required for accounts? Data Retention Why is customer data stored in Google Sheets? Is each spreadsheet necessary? Who owns responsibility for deleting outdated files? Are old exports archived or permanently removed? Backups Are spreadsheet copies stored elsewhere? Are downloaded customer files tracked? Are backup copies included in deletion procedures? 4. Missing Link Quality Gate Three critical missing pieces of context a qualified professional would need: 1. Complete Data Flow Map Missing information: Where customer data moves after purchase Connected apps, plugins, analytics tools, payment processors, and marketing platforms Why it matters: A business cannot fully evaluate risk without knowing every location where customer information exists. 2. Internal Access Structure Missing information: Number of employees with access Roles requiring access Whether contractors or agencies handle customer data Why it matters: Many operational failures come from excessive access rather than the storage platform itself. 3. Data Lifecycle Rules Missing information: How long customer information is kept When records are deleted Who approves deletion How backups and exports are handled Why it matters: Secure collection is only one part of responsible data handling; information management after collection is equally important. 5. Next Actions Plan (This Week) Action 1: Create a Customer Data Inventory Owner: Operations team Complete: List every system containing customer information. Record what data exists in each system. Identify the person responsible for each system. Expected outcome: A basic map of where customer information lives. Action 2: Lock Down Access Owner: Business owner / administrator Complete: Review Shopify user permissions. Review Klaviyo account access. Remove unnecessary Google Sheets sharing. Enable stronger account security controls where available. Expected outcome: Reduced risk from accidental or unauthorized access. Action 3: Establish Basic Retention Rules Owner: Operations team Complete: Decide which customer records are operationally necessary. Define review dates for stored spreadsheets and exports. Create a simple deletion workflow for unnecessary copies. Expected outcome: A repeatable process instead of ad-hoc data storage. Overall operational recommendation: The business is at an early-to-mid maturity stage. The fastest improvement path is not adding more tools; it is gaining visibility into data locations, reducing unnecessary access, and creating clear ownership for customer information handling.