PRIVACY NOTICE

Data boundaries for mapping evidence.

Last updated September 5, 2026. This notice describes the current development implementation.

Data the app uses

The app stores Shopify shop and server-side session data, granted scopes, merchant-approved Shopify and Printful mapping facts, provider store identity and scopes, encrypted provider OAuth tokens, catalog observations, findings, check jobs, schedule settings, and limited webhook delivery metadata. Shopify sessions can contain staff-session fields supplied by Shopify.

The app requests Shopify product-read access. It does not request customer, order, checkout, or payment data. Customer privacy callbacks retain delivery metadata only; customer payloads are not retained. A separate keyed erasure authority prevents an old primary backup from restoring an erased tenant.

Connected provider access

Printful access is used only after the merchant completes its OAuth flow and selects an authorized provider store. Tokens are encrypted at rest by the application key. Checks read supported provider facts and do not download artwork bodies or write provider or Shopify records.

Retention and deletion

After a successful check, completed runs and resolved or out-of-scope findings older than the active plan window are removed. The current implementation uses 30, 90, or 180 day windows. Older records can remain until a later successful check performs cleanup. Current mappings and open findings remain while installed.

Uninstall and Shopify shop-redaction handling erase app-owned shop records, sessions, mappings, encrypted provider credentials, findings, jobs, and retained observations. Keyed lifecycle receipts can remain for up to 35 days to reject delayed or duplicate callbacks without keeping a plain shop domain, token, mapping, or provider payload. Exported files remain under the merchant’s control.

Contact and release status

No public privacy contact is configured in this development build. Production release requires a valid contact.