ShelfSteady (“we”, “our”, or “us”) provides multi-location inventory replenishment, landed-cost purchase orders, supplier dispatch confirmation, and bill-of-materials software for merchants operating on Shopify and Shopify POS. This Privacy Policy describes what data we process, why we process it, and how merchants and end customers can exercise their privacy rights.

1. Data Accessed Through Shopify APIs

When a merchant installs ShelfSteady on a Shopify store, we request only the minimum Shopify Admin GraphQL scopes required to operate inventory and purchasing workflows:

• Store & Location Metadata: Store domain, store name, business contact email, currency code, and active warehouse/POS location names.
• Products, Variants & Inventory Levels: Physical SKU titles, barcodes, vendors, unit costs (InventoryItem.unitCost), on-hand/available quantities, and inventory transfers.
• Aggregate SKU Order Velocity: Line-item quantities sold per SKU and location over rolling 30-day and 90-day windows to calculate reorder points. ShelfSteady does not store end-consumer names, shipping addresses, phone numbers, or payment card details.
• Supplier & Purchase Order Records: Vendor names, vendor contact emails entered by the merchant, purchase order line items, and uploaded commercial invoices.

2. How We Use & Protect Merchant Data

• We use merchant data exclusively to compute replenishment velocity, manage purchase orders, dispatch supplier confirmation links requested by the merchant, and sync inventory receipts back to Shopify.
• Offline Shopify Admin tokens are encrypted at rest using authenticated AES-GCM before database persistence.
• Uploaded supplier commercial invoices are stored in a private object bucket accessible only via short-lived HMAC-signed URLs.
• We never sell, rent, or share merchant catalog, supplier, cost, or sales velocity data with third parties or advertisers.

3. Mandatory Shopify GDPR, UK GDPR & CPRA Webhooks

ShelfSteady verifies and honors all mandatory Shopify privacy webhooks via HMAC-SHA256 validation:

• customers/data_request & customers/redact: Because ShelfSteady stores only aggregate SKU-level quantity counts and never stores end-customer personal data, customer redaction requests confirm zero stored consumer PII.
• app/uninstalled & shop/redact: Revokes stored Shopify access tokens immediately upon uninstall and permanently purges store records upon shop/redact.

4. Website Analytics

On our public marketing website (shelfsteady.com), we use privacy-preserving edge analytics (Cloudflare Zaraz and Google Analytics 4 with IP anonymization) to measure aggregate page traffic. Analytics tags are strictly disabled inside the embedded Shopify Admin workspace (app.shelfsteady.com) and supplier portal.

5. Contact & Data Requests

For privacy inquiries, data export requests, or deletion requests, contact [email protected] or [email protected].