AppVerix Stock Sync: Privacy Policy

Last updated: 19 October 2026

AppVerix Stock Sync (“the app”) is a Shopify app published by AppVerix (“we”, “us”). This policy explains what the app collects when a merchant installs it, why, where it is kept and how to have it deleted.

The app does not store personal data of a store’s customers. Feeds are merchant records. For any customer data that stays in Shopify, the merchant is the controller and we are the processor.

1. What we collect and why

From the merchant’s store, through Shopify’s API:

  • Shop domain: to identify the store and open the app in Shopify Admin. Stored.
  • An access token from Shopify: so the app can stay installed and update inventory, prices and product status. Stored in the login session until you uninstall.
  • Your feeds: name, source type, HTTPS URLs, Google Sheet links, FTP/SFTP host, username, password, remote path, uploaded file text, column mapping, markup, schedule, out-of-stock handling and location id. Stored.
  • Sync logs: timestamps, counts, skipped SKUs, error messages and a capped preview of planned changes (SKU, quantities, prices). Stored.
  • Shop settings: the admin language, shop currency, time zone and which setup steps you ticked. Stored.
  • The store contact email (shop { email }) is read only to send an optional welcome or cancellation message through Resend when that key is configured. It is not stored in our database.
  • Billing state from Shopify (plan active, trial or none, which plan). Stored as a cache; Shopify is the source of truth.
  • Compliance log: the topic and a short summary Shopify sent on a privacy webhook. No names or emails.

2. What we do not collect

The app does not ask for access to orders or customers, and it receives no order webhooks. It does not store customer names, emails, addresses, payment details or order contents. It does not set advertising cookies or use analytics pixels.

The embedded reconnect page may keep a retry counter in sessionStorage in the merchant’s browser. That note holds no personal data and is never sent to us.

3. Who processes data for us

Where data leaves the EEA/UK, we rely on the provider’s Standard Contractual Clauses or other approved transfer mechanisms.

  • Cloudflare (cloudflare.com): hosting for the app and its D1 database. Sees everything in section 1. Globally distributed.
  • Shopify: the platform the app runs on, which also handles billing. See Shopify’s privacy policy.
  • Resend (resend.com): optional merchant emails, only if we have configured an API key. Sees the store contact email and the message body.

4. How long we keep it

  • Feeds, uploaded files and logs: while the app is installed.
  • When you uninstall: we delete the login session right away. Shopify sends a shop/redact request about 48 hours later and we then delete the store’s feeds, logs, settings and compliance records.
  • A customer deletion request (customers/redact): we hold no customer personal data to delete; we log that it arrived.
  • Server logs: up to 7 days, without personal data.

5. Your rights and data requests

The app supports Shopify’s three privacy webhooks: customers/data_request (we reply that we hold no personal data of that customer), customers/redact (nothing to delete; logged) and shop/redact (we delete all data of the store).

Merchants can also write to support@appverix.com for a copy of their data or to have it deleted. We answer within 30 days. A store’s customers should contact the store first. If you are in the EEA/UK you may complain to your local data protection authority. In Brazil the LGPD applies; contact us at the same address.

6. Security

  • All traffic uses HTTPS (TLS).
  • The database runs on Cloudflare D1, which encrypts data at rest.
  • Webhooks from Shopify are verified by their HMAC signature; unsigned requests are rejected.
  • The app checks a Shopify session token on every admin request and uses no third-party cookies.
  • FTP passwords are never written to the sync log or returned to the browser after save.
  • Access to production infrastructure is restricted and protected by two-factor authentication.
  • If a breach affects your data we tell you without undue delay, and within 72 hours where the law requires it.

7. Data processing agreement and security

For the personal data of a store’s customers, the merchant is the controller and we are the processor. The AppVerix Data Processing Addendum sets out our commitments (purposes, subprocessors, security, deletion, breach notification), and our security and incident response policy describes how we protect and handle data.

8. Changes and contact

If we change this policy in a way that matters, we update the date at the top and tell merchants in the app or by email. Contact: support@appverix.com