Privacy Policy

Shopify App · Last updated July 2026

Shopify App (“the App”, “we”) helps Shopify merchants audit their supplier invoices — comparing prices, detecting overcharges, duplicate orders, missing refunds and commission mismatches. This policy explains what data we process and how we protect it.

Data we collect

Shop information — your myshopify.com domain and an offline access token (stored encrypted), used to authenticate and call the Shopify API on your behalf.
Shopify orders — order number, name, totals and financial/fulfillment status, mirrored so invoice lines can be matched to real orders. We do not collect customer names, emails, phone numbers or addresses.
Shopify products — title, image, price and variants, snapshotted so you can still recognise a product after deleting it from your catalog.
Invoices you upload — the invoice files and the line items parsed from them (order numbers, product names, prices, shipping, country, dates).
Derived analytics — per-product price statistics and the alerts we generate.

We do not collect payment card data, and we do not sell your data.

How we use it

To parse and analyse your supplier invoices and surface discrepancies.
To match invoice lines to your Shopify orders and products.
To operate billing (subscription status) and provide support.

Data sharing

We access Shopify APIs using the permissions you grant on install. We use infrastructure providers (hosting, database) solely to run the App. We do not share your data with third parties for advertising.

Retention & deletion

When you uninstall the App, your access token is cleared and your shop record is deactivated.
We honour Shopify’s mandatory privacy webhooks: customers/redact (remove a customer’s stored data), shop/redact (permanently delete all shop data, ~48h after uninstall), and customers/data_request.
You can request deletion of your data at any time via the contact below.

Security

Data is isolated per shop, access is authenticated via Shopify session tokens, and all API traffic is encrypted in transit (HTTPS). The Shopify access token is encrypted at rest. Webhooks are verified via HMAC.

Contact

Questions or data requests: support@suppliertrust.app.