Privacy policy

Information we access and store

PO Sync compares native Shopify purchase orders with their linked inventory transfers. Through Shopify, it accesses the shop domain and identifier, development-store status, granted app permissions, purchase-order identifiers, names, supplier names, status and archive state, item titles and inventory identifiers, and ordered quantities. Transfer information includes identifiers, names, status, item quantities, and quantities received, picked, shipped or still processable.

The app stores purchase-order and transfer snapshots, comparison results, preview plans, synchronization operations, timestamps, verification results, monitoring status and recovery records. Supplier names and item titles may contain information entered by the merchant. A separate privacy-request inbox stores the shop domain, webhook topic, delivery identifier, receipt time and application-processing status, without retaining the customer payload.

Shopify authentication supplies staff identity and effective permissions. Online staff sessions are cached in server memory for reuse for at most 60 seconds. Expired entries are removed during subsequent cache activity, rather than necessarily being erased at the instant they expire. Session information can include a staff identifier, name, email, locale and account role. The approving staff identifier is recorded in synchronization history. Offline access and refresh credentials are stored in the application database so read-only monitoring can continue without an open browser.

Shopify supplies subscription entitlement and trial or billing-period information to verify access. PO Sync does not collect payment-card details. The app does not request customer or order-data scopes or query customer profiles or customer orders. Mandatory Shopify privacy notifications may nevertheless contain customer identifiers; the current handlers validate these requests without storing their customer payloads.

If you email us, your address, message and any attachments are handled as support correspondence. Do not send passwords, access tokens, backup keys or unnecessary customer information.

How information is used

We use this information to display mismatches, prepare previews, check permissions and subscription access, apply merchant-approved corrections to eligible DRAFT transfers, verify results, maintain history, investigate uncertain operations and respond to support or privacy requests. Background monitoring is read-only; it does not automatically correct transfers.

Staff-initiated changes require an authorized online Shopify session. Stored offline credentials are not a substitute for staff permission to approve a correction.

Hosting, providers and security

The application is hosted on Render, with a SQLite database on persistent storage. It communicates with Shopify over HTTPS. Database backups are encrypted using AES-256-GCM and retained on the service disk; encrypted copies are also transferred to Microsoft OneDrive. Backups can contain merchant data, staff identifiers and Shopify credentials.

The live application database is not encrypted by the backup encryption mechanism. Access controls, staff authorization, shop isolation and signed-webhook verification help protect data, but no system can eliminate every security risk. Backup deletion and off-disk transfer currently require operator action.

Shopify provides authentication, inventory APIs, app billing and embedded-app services. Render provides hosting, and Microsoft provides OneDrive backup storage. The published contact address uses Gmail for correspondence. These providers process information needed to supply their services. Hosting and network providers may process connection details such as IP addresses and request metadata. The site also loads a font stylesheet from Shopify's CDN.

Current application access logging omits request URLs, headers and bodies. That setting does not control provider-managed logs or remove historical logs. Provider processing and storage locations depend on their services and settings; this policy does not promise storage in a particular country.

Render maintains provider-managed disk snapshots and logs. Snapshot availability and log retention follow Render's service policies, including the workspace plan for logs. OneDrive versions and recycle-bin copies and Gmail messages require separate handling through their available controls. Deleting an application record does not immediately remove all provider-held copies. We cannot use the app to selectively erase provider-managed snapshots or internal provider records, or independently verify erasure from all underlying provider systems.

Retention and deletion limitations

The current app has no scheduled age-based purge of inactive-shop data or synchronization history. Expired previews cannot authorize changes. The background monitor periodically deletes expired previews, but cleanup depends on the monitor running successfully and is not guaranteed at the instant of expiry. History and unresolved operations can remain until an authenticated shop-erasure request is processed or an operator handles deletion.

There is no automatic age-based deletion of encrypted backups. The primary-database deletion handler does not delete backups, OneDrive versions or recycle-bin copies, provider logs, or support messages. Those copies are handled separately by the operator. Support correspondence also has no automatic retention schedule.

Downloaded backups and verification copies can also remain on operator devices. The recovery procedure requires a separate privacy-request record and operator reconciliation before a restored database returns to service. This is a manual procedure, not automatic deletion or an automatic check against an independent erasure ledger.

Minimal privacy-request receipts are retained separately from the shop records deleted by the redaction handler, to track outstanding fulfillment and avoid repeating a delivery. They also appear in later database backups. They have no automatic retention limit or automatic deletion schedule. An encrypted operator ledger in personal OneDrive is separate from those database backups and is used to reconcile requests before restoring data into service.

The operator reviews inactive-shop data, backups, correspondence and privacy records for continued necessity monthly and when handling a request. Retention decisions consider service needs, unresolved operations, recovery risks and applicable obligations. Unneeded records and operator-controlled copies are scheduled for manual removal; review alone does not delete them. We do not promise a fixed maximum retention period for all copies.

For a verified deletion request, we track application records and relevant backup, local, correspondence and provider copies separately. Where provider controls cannot remove a copy immediately, we record the limitation, restrict its operational use, seek provider assistance where needed and track follow-up or expiry. Outstanding work remains open rather than being described as completed deletion. We explain material limitations to the requester. Restored data must be reconciled against the separate ledger before returning to use.

Uninstalling and Shopify privacy requests

When a valid Shopify uninstall notification is processed, the app removes stored and cached sessions and previews and invalidates the monitoring lease. Uninstalling does not immediately erase all history: uncertain synchronization operations and their locks are retained for investigation and recovery.

When a valid Shopify shop-redaction notification is processed, the handler deletes that shop's cached checks, previews, operations, locks, events and monitoring records, removes sessions, and redacts its domain from shared recovery audit details. This describes application-database processing, not automatic deletion of every retained copy.

PO Sync verifies Shopify signatures on privacy notifications. Customer access and customer-redaction notifications are acknowledged without storing customer records, because the app does not collect a customer database. A successful webhook response alone does not establish that backups or external records have been erased.

The receipt handler records authenticated requests durably before application processing. Isaiah Perrelli reviews the support/privacy mailbox and the private receipt inbox daily, records requests and deadlines in the separate ledger, and follows up on outstanding work. A read-only reconciliation tool flags unmatched requests, overdue cases and application processing needing investigation. Interrupted or failed processing remains visible; the app does not automatically repeat uncertain shop erasures. The receipt inbox does not automatically send email alerts or verify completion outside the application.

Access, correction and deletion requests

Email iperrelli202@gmail.com to request access to, correction of, or deletion of information handled by PO Sync, or to ask about this policy. Include your shop domain and a brief description of the request. We may need to verify your authority to act for the shop before providing information or making changes. Do not include credentials.

Corrections to the source purchase order or transfer are made through Shopify or an eligible, explicitly approved synchronization. Deleting app-held records does not delete the original Shopify purchase orders or transfers.

Updates to this policy will be published on this page with a revised review date. Contact Isaiah Perrelli at the address above with questions about an update.