Privacy policy

Draft, last updated 8 October 2026. [Replace the bracketed details and have this reviewed before publishing.]

This policy explains what information SupplierFlow (“we”, “us”), operated by [COMPANY LEGAL NAME], [REGISTERED ADDRESS], collects when a merchant installs the SupplierFlow app, and how we use it.

Who this applies to

SupplierFlow is used by merchants (store owners and their staff). We do not collect information about a store's customers: the app does not request access to orders or customers.

Information we collect

• Store details from Shopify: the store's domain, the permissions granted to the app, an access token for the Shopify Admin API, and the store's plan and billing status with SupplierFlow.
• Product data you sync: the supplier data you connect (for example product codes, titles, descriptions, prices, stock levels and image links) and the identifiers of the products SupplierFlow creates or updates in your store, together with a history of the changes each sync made.
• Supplier connection settings: what you enter to connect a supplier, such as file or feed URLs, FTP, email (IMAP) or API credentials, and files you upload.
• Notification settings: the email address and Slack, Discord or webhook URLs you add.
• Technical logs: IP addresses and request logs our servers keep for security, rate limiting and troubleshooting.

How we use it

Only to provide the service you install: fetching your suppliers' data, applying your mapping and pricing rules, creating and updating products in your store, sending the notifications you configure, billing through Shopify, and keeping the service secure. We do not sell personal information or use it for advertising.

How we protect it

Store access tokens, supplier credentials, proxy credentials and notification webhook URLs are encrypted at rest (AES-256-GCM). All traffic is sent over TLS. Access to production systems is limited to SupplierFlow's owner.

Who we share it with

• Shopify, to read and write your store's products and to bill your plan.
• Our hosting provider, Oracle Cloud Infrastructure (United States, Chicago region), which stores the data on our behalf.
• Your suppliers' systems, which SupplierFlow contacts with the connection details you provide.
• Email delivery: Thynkdone, which runs our mail server, when you turn on email notifications or email us.
• Marketplace connectors: if you install a connector built by a third-party developer, its settings (including any credentials you enter for it) are sent to that developer's service so it can fetch your supplier data. Each connector shows who built it before you install it.

How long we keep it

While the app is installed. When you uninstall SupplierFlow, Shopify notifies us 48 hours later and we then delete your store's data, including supplier credentials, uploaded files and sync history. Backups are kept for up to 14 days before they are overwritten.

Your rights

You can ask to see, correct, export or delete the information we hold about your store or you, and you can object to its use. Email support@supplierflow.store and we will respond within 30 days. If you are in the EU/UK you may also complain to your data protection authority.

Changes

We will post any changes on this page and, for significant changes, notify merchants in the app.

Contact

[COMPANY LEGAL NAME], [REGISTERED ADDRESS] — support@supplierflow.store