Privacy Policy

1. What we collect through Shopify’s APIs

When you install the App and grant access, we read:

• Catalog data: products, variants, options, and their costs.
• Inventory data: on-hand quantities and locations.
• Order data: order and line-item records — order IDs, order names or numbers, dates, statuses, quantities, variant and SKU references, and refund events.

We use this strictly to run the App’s features (below). We do not request or store the personal data of your customers — no customer name, email, phone, billing, or shipping address. Where you need customer-level detail, the App links out to the Shopify admin rather than copying that data into the App. This is a Shopify “Protected Customer Data — Level 1” posture: order data without buyer identity.

2. What we collect directly from the merchant

• Account and shop identifiers (such as the shop domain and app-installation records) needed to connect and authenticate the App.
• Support correspondence you send us.
• Automated logs of your use of the App (sync events, errors, and audit records of stock write-backs), used to operate, secure, and debug the service.

3. What we collect from your customers

None. The App sets no cookies or tracking technologies on your customers’ devices, and does not log how buyers browse your store. The App has no storefront or checkout surface.

4. How we use the information

We use the data above only to provide the App’s services:

• Maintain bills of materials and compute how many units you can build;
• Deduct materials as Shopify orders arrive;
• Record production runs and their actual cost;
• Show auditable material cost and margin;
• Track supplier lots and batches, and expiry;
• Sync available stock back to your Shopify products, with each write checked and logged;
• Provide support and keep the service secure and reliable.

We do not use your data for advertising or profiling, we do not use it for any purpose beyond operating the App, and we do not sell it.

5. How long we keep it

We retain the mirrored data described above for as long as the App is installed. When the App is uninstalled, Shopify sends a shop/redact request and we purge the shop’s data approximately 48 hours after uninstall. Support correspondence and minimal billing records may be retained where required for legal, accounting, or security purposes.

6. Where data is stored and processed

App data is stored and processed on servers located in the United States (DigitalOcean), and the App is operated from India. If you or your customers are in the European Economic Area, the United Kingdom, or another region with cross-border-transfer rules, this means data may be transferred outside your region. Where such transfers are subject to applicable data-protection law, we apply appropriate safeguards, such as standard contractual clauses.

7. Data rights and requests

Individuals may have rights to access, correct, erase, or restrict processing of their personal data. Because the App holds no buyer personal data, most buyer requests are satisfied automatically:

• customers/data_request — we hold no customer personal data to return; we acknowledge and log the request.
• customers/redact — we scrub the named order records in our mirror.
• shop/redact — we purge the shop’s data (about 48 hours after uninstall).

You may contact prateek@atlessa.com for any access, correction, or erasure request relating to your own account data, and we will respond within the timeframe required by applicable law.

8. Security

Data is encrypted in transit (TLS) and at rest. Access to Shopify data flows through a single data-access chokepoint with tenant isolation, and stock-affecting writes are logged.

9. Changes to this policy

We may update this policy; we will post the revised version here with a new effective date.

10. Contact

Questions: prateek@atlessa.com.