Privacy Policy

1. Service overview and our role

The Service is a Shopify app that helps Shopify store owners (“merchants”) receive and approve wholesale buyer applications and manage wholesale pricing groups. For customer (buyer) personal data arising in a merchant’s store, the merchant is the data controller and the Operator acts as a processor on the merchant’s behalf.

2. Personal data we collect

a. From merchants (stores)

• Store domain and store notification email address
• Shopify access credentials (OAuth access token) — used to provide the Service

b. From wholesale applicants (via the merchant’s storefront form)

• Company name, contact name
• Email address, phone number (optional)
• Business type, expected purchase volume, sales channel (optional)

c. Data accessed via the Shopify Admin API

• Company, customer, product, and price information to the extent needed for approval. The Service accesses only the minimum scope required and does not separately store it long-term.

3. Purposes of collection and use

• Receiving wholesale applications and notifying the merchant
• Processing approvals/rejections and creating or linking wholesale companies and pricing groups
• Sending approval, rejection, and notice emails
• Operating the Service, handling errors, and preventing abuse

4. Retention and use period

• Wholesale application data: deleted without delay when the merchant deletes it, or when Shopify’s data-erasure request (shop/redact, typically 48 hours after the app is removed) is received.
• When an individual customer’s deletion request (customers/redact) is received via Shopify, that customer’s application records are deleted.
• Authentication tokens (sessions): retained while the app is installed, and deleted when the app is removed.

5. Processing on our behalf and third parties

To provide the Service smoothly, the Operator entrusts personal-data processing to the sub-processors below. We do not provide personal data to third parties for marketing purposes.

• Shopify Inc. — commerce platform, app authentication and data integration
• Supabase, Inc. — database (storing application data, settings, sessions)
• Vercel Inc. — application hosting and server execution
• MailerSend — sending notification emails

6. International transfers

The sub-processors above may operate servers overseas (e.g., in the United States), so personal data may be transferred and processed abroad in the course of using the Service. The data transferred is the information described in sections 2 and 3, for the purpose of providing the Service described in section 3.

7. Your rights

Data subjects (buyers) may request access to, correction of, deletion of, or suspension of processing of their personal data. Requests for data the Service processes are generally handled through the relevant Shopify store’s merchant, or via Shopify’s customer data request/erasure procedures. You may also contact us directly at the address below.

8. Deletion procedures and methods

Personal data whose retention period has elapsed or whose processing purpose has been achieved is deleted without delay. Electronic files are permanently deleted in a manner that cannot be recovered.

9. Security measures

• Encryption in transit (HTTPS) and encrypted storage of authentication tokens
• Data accessed only with server-side privileges, isolated per store
• HMAC signature verification of incoming webhooks
• Least-privilege access and secure management of administrator credentials

10. Use of cookies and similar technologies

The Service uses only the minimal cookies needed to identify the store in the embedded app (e.g., a store-identification session cookie). We do not use advertising or tracking cookies.

11. Privacy officer and contact

• Operator: 김경범
• Email: rlarudqja542@gmail.com

12. Changes to this policy

This policy may be revised in accordance with legal or service changes; revisions will be announced on this page.