Privacy

1. What never happens

• We request products, inventory and locations, not orders or customers. No shopper name, email, phone number or postal address reaches us.
• We never send store data for advertising, profiling or enrichment, or sell it.
• Supplier emails include only shop name and address, ordered lines, quantities, agreed costs, terms, expected date and your note. They exclude sale prices, stock levels and other suppliers' costs.
• Labels show product title, variant, price and barcode, never costs.

2. Information we handle

2.1 Purchasing and inventory

We store suppliers and contact details, product links, orders, receipts, cost history, stocktakes, reorder thresholds, label templates and settings. We use them to run purchasing and stock control under our contract. Our hosting providers keep these records until you delete them or post-uninstall deletion applies.

We read Shopify products, variants, barcodes, prices, inventory costs, levels, locations and collections to build orders and labels and calculate stock variance. The catalogue cache lasts 10 minutes; levels are read live. We write received or counted quantities and selected receipt costs to Shopify as your processor. Deleting Shelfward data never reverses those writes.

2.2 Staff and supplier emails

We store staff identifiers, display names, cost-viewing permission and who acted on records to audit writes and restrict cost access, under our legitimate interest. Our hosting providers keep them with the related records until deletion.

Cloudflare sends suppliers purchase-order emails and PDFs under our contract, with your shop address as reply-to. We record the recipient on the order timeline until shop-data deletion. Suppliers need no sign-in.

2.3 Stocky imports

We read uploaded files once to restore purchasing history under our contract, then discard them. Imported orders never write Shopify inventory. Our hosting providers keep imported rows, filenames, counts, skipped-row reasons, column names and value shapes until shop-data deletion. Value-shape records never contain the original cell value.

2.4 Website delivery

Our hosting providers receive your IP address to deliver pages. This site sends no usage analytics and sets no analytics cookies.

2.5 Shopify access and storage

You sign in through Shopify, not a separate Shelfward account. Shopify handles subscription billing; we never see card numbers. Our hosting providers store shop data nearest where your store first uses the app, which can be outside your country or the United States. Requests use TLS. We encrypt access tokens with a key held outside the database and verify Shopify webhook signatures. The hosting provider's transfer terms cover EU, UK and Swiss data with standard contractual clauses or the EU-U.S. Data Privacy Framework. Database recovery history keeps deleted data for 30 more days.

On uninstall, sessions end but data stays. Shopify sends redaction about 48 hours later; we wait another 48 hours, then delete unless you reinstalled. A fail-safe deletes after 30 days if redaction never arrives, configurable from 1 to 365 days in Settings. Export a CSV ZIP or delete all shop rows after typed confirmation. Cost history exports are included on Plus or without an active subscription; cost columns require Shopify cost-viewing permission.

2.6 Support email

We use your email and message to answer requests, under our legitimate interest. We keep them for 12 months after the thread closes.

3. Providers and locations

We use these providers:

• Shopify — the platform the app runs inside, the store's own product and inventory data, and billing for the app subscription (global).
• Hosting and security providers — hosting and storage (global; a shop's data is stored in the location nearest where the store first uses the app).

Only the listed providers receive data from us.

4. Your rights

Where data-protection law applies, including the EU and UK, you can ask to see, correct, delete, restrict or export your data. You can object to our use of it. You can complain to your local supervisory authority.

Email support@shelfward.app to exercise these rights. We answer within 1 month. Shopper requests return no shopper data because we hold none.

5. Children

Shelfward is for Shopify merchants, not children. We do not knowingly request children's personal information.

6. Changes

We tell you in the app before a change affects how we use data.

7. Contact

Email support@shelfward.app or write to WaveApp LLC, 30 N Gould St Ste N, Sheridan, WY 82801, USA.