PRIVACY NOTICE

Data boundaries for mapping evidence.

Last updated October 25, 2026. This notice describes the current development implementation.

Data the app uses

The app stores Shopify shop and server-side session data, granted scopes, merchant-approved Shopify and Printful mapping facts, provider store identity and scopes, encrypted provider OAuth tokens, catalog observations, findings, check jobs, schedule settings, and limited webhook delivery metadata. Shopify sessions can contain staff-session fields supplied by Shopify.

The app requests Shopify product-read access. It does not request customer, order, checkout, or payment data. Customer privacy callbacks retain delivery metadata only; customer payloads are not retained. A separate keyed erasure authority prevents an old primary backup from restoring an erased tenant.

Connected provider access

Printful access is used only after the merchant completes its OAuth flow and selects an authorized provider store. Tokens are encrypted at rest by the application key. Checks read supported provider facts and do not download artwork bodies or write provider or Shopify records.

Retention and deletion

After a successful check, completed runs and resolved or out-of-scope findings older than the active plan window are removed. The current implementation uses 30, 90, or 180 day windows. Older records can remain until a later successful check performs cleanup. Current mappings and open findings remain while installed.

Manually disconnecting Printful clears the encrypted provider access and refresh credentials, selected provider store, stored provider scopes, and token expiry from the app database. It disables automatic scheduling, deactivates mappings, marks open findings out of scope, and cancels queued or running jobs. Saved mappings, reports, and findings are not all erased by disconnect; they remain subject to the retention rules above. Disconnect does not by itself prove provider-side revocation or that an already executing provider request stopped immediately.

Uninstall and Shopify shop-redaction handling erase app-owned shop records, sessions, mappings, encrypted provider credentials, findings, jobs, and retained observations. Keyed lifecycle receipts can remain for up to 35 days to reject delayed or duplicate callbacks without keeping a plain shop domain, token, mapping, or provider payload. Exported files remain under the merchant’s control.

Contact and release status

New Tech is operated by Justin Walker in New York, United States.

The app is hosted on DigitalOcean, and its SQLite database is stored on the same host. Support messages are sent through the sender’s email provider and received in the owner’s Microsoft Outlook mailbox. Mailbox and sender copies are separate from the app database, and uninstalling the app or deleting app records does not automatically remove them. This notice does not state a provider-specific email retention period.

Encrypted owner recovery copies are kept separately from the live database. Their creation schedule, retention period, and deletion timing are not guaranteed here. Uninstalling the app or deleting app records does not automatically remove these copies.

Email justinwalker4233@outlook.com for app data questions or requests for access, correction, deletion, or restriction of app-held data.