Data retention and anonymising
Customer records hold personal data — a name, an email, a phone number, addresses. Yessort does not keep it indefinitely, and it can remove it on request.
What anonymising does
It blanks the personal data: name, email, phone, and the addresses. The record is marked as anonymised.
The record itself stays, and so do the orders. That is deliberate. The orders are accounting records — they were real transactions with real money and real tax, and deleting them would leave your books unable to explain themselves. What is removed is the personal data identifying who placed them.
So after anonymising you still know an order happened, what was on it and what it was worth. You no longer know who bought it.
It is idempotent — anonymising an already-anonymised customer does nothing further.
The retention horizon
Every customer carries a date after which their personal data should not be kept.
It is set when the record is created, and pushed back whenever they order again. So the clock runs from a customer's last activity rather than from when they first appeared, and an active customer is never anonymised out from under you.
The default window is 84 months — seven years — which matches the period accounting records are typically kept for. It is configurable for the installation as a whole, not per customer.
The automatic pass
A job runs regularly and anonymises customers whose retention date has passed and who have not already been anonymised.
Nothing needs doing to make this happen, and there is no queue to work. It is a background process, and its effect is that old personal data stops being held without anyone having to remember.
Requests from a channel
Where a customer asks a connected store to remove their data, the store passes the request on and Yessort acts on it — anonymising without anyone in your team needing to act.
One behaviour worth knowing: a removal request is matched by email, and every live customer record in that organisation with that address is anonymised. Because email is not unique — guest checkouts repeat one freely — a single request can affect several records. That is correct: they are the same person, and honouring the request for only one of them would not be honouring it.
Requests for a copy of the data are handled by an export.
Doing it on request
An operator can anonymise a customer directly from their record, for a request that arrives another way — by email, or over the phone.
See anonymise a customer.
What this is not
Not deletion. The record remains, anonymised. If your obligation is genuine erasure of the row rather than of the personal data within it, this does not do that.
Not advice. What your organisation must do, and when, is a question for whoever advises you on data protection. This page describes what the software does.