Privacy Policy

## What data we collect

When you install the App, we access the following data from your Shopify store through the Shopify Admin API (scopes: read_products, read_inventory, read_orders):

• Store information: Your store's myshopify.com domain name and email address.
• Product data: Product titles, SKUs, prices, variant information, and the cost value stored in Shopify's cost-per-item field — read once to seed your starting cost baselines.
• Order data: CostLedger does not request or store customer names, email addresses, postal addresses, phone numbers, or payment information. It processes limited Shopify order and line-item data — including dates, quantities, prices, totals, currency, and financial status — to calculate revenue, COGS, and margin reports.
• Inventory levels: Available quantities per variant, used to value on-hand inventory at its true cost basis.
• Cost data you enter: The cost batches you record or import — supplier name, quantity, unit cost, and received date. This is your own business data, entered by you, and forms the cost ledger.
• Account and configuration data: The data needed to operate the App — your shop domain, Shopify access credentials and granted scopes, plan, shop contact email, timezone, currency, alert preferences, and any Slack incoming-webhook URL you choose to provide.
• Shopify PO PDFs you upload: Plus merchants can upload a completed Shopify Purchase Order PDF. CostLedger processes the file to extract purchase-order and receipt fields and show a reviewable preview. Raw PDF bytes are not retained after the request.

We do not collect customer personal information, payment details, or any data about your store's buyers.

## How we use your data

We use the data described above solely to:

• Maintain a time-stamped cost ledger and per-variant cost timeline.
• Calculate a quantity-weighted moving-average cost basis from your received batches.
• Attribute cost of goods sold to each sold unit using the cost basis as of its sale date, so later cost changes never rewrite earlier margins.
• Produce per-SKU and store-wide gross-margin reports over 30- and 60-day periods.
• Send email and Slack alerts when a new batch squeezes margin past a threshold you configure.
• Record CostLedger batches from Shopify PO PDF data you approve, and retain an auditable receipt history.

## Data storage and security

Your data is stored in a secured PostgreSQL database hosted on Railway (US-based infrastructure). We store:

• Your store's domain and encrypted access credentials (required for API access).
• Synced product, variant, inventory, and order line-item data used for cost and margin calculations.
• The cost batches and ledger history you record — retained as your audit trail for as long as the App is installed.
• For an approved Shopify PO import, the receipt metadata needed for duplicate prevention and audit. This can include the original filename, SHA-256 file hash, preview fingerprint, purchase-order number, supplier, reference, currency, receipt date, line counts, totals, result status, linked ledger entries, and any reversal record. CostLedger does not retain the raw PDF file.

Raw Shopify order and line-item data is deleted on a daily schedule once it is more than 90 days old. Non-customer margin snapshots are retained for 25 months to support historical comparisons. The merchant's cost ledger and Shopify PO receipt and reversal history are retained while the App is installed because they form the merchant's accounting and audit record.

We use industry-standard security practices including encrypted connections (HTTPS/TLS), secure credential storage, and HMAC signature verification on all Shopify communications.

## Shopify remains read-only

CostLedger does not change purchase orders, products, inventory, product costs, orders, checkout, or storefront data in Shopify. Manual, CSV, and Shopify PO imports record entries only in CostLedger.

## Data sharing

We do not sell your data. We disclose data only to service providers that help us operate CostLedger, or when required by law:

• Railway hosts the CostLedger application and PostgreSQL database in US-based infrastructure.
• Resend processes the configured recipient email address and alert content when you enable email alerts.
• Slack processes alert content sent through the incoming-webhook URL you configure when you enable Slack alerts.
• Shopify processes app and store data as the commerce platform through which CostLedger is installed and accessed.

These providers receive only the information needed to deliver their services. We may also disclose information when legally required or to protect the security and rights of merchants, CostLedger, or others.

## Data retention

We retain your data for as long as the App is installed on your store, except raw order and line-item data (deleted daily once more than 90 days old) and margin snapshots (retained 25 months). When you uninstall the App, all associated data — including your cost ledger, PO receipt history, and synced store data — is automatically and permanently deleted from our systems. Export your ledger to CSV before uninstalling if you wish to keep a copy.

## Your rights

Under the EU General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and other applicable data protection laws, you have the right to:

• Access your data: Request a copy of all data we hold about your store.
• Delete your data: Uninstalling the App automatically deletes all data. Contact us for immediate manual deletion.
• Revoke access: Uninstalling the App immediately revokes our access to your Shopify store data.
• Data portability: Export your cost ledger and margin reports in CSV format (available on the Plus plan, or contact us).
• Opt out of sale: We do not sell your personal information.

We handle all mandatory Shopify GDPR webhooks: customer data requests, customer data erasure, and shop data erasure. Since we store no customer PII, customer data requests return empty results.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

## International data transfers

Your data is stored on servers in the United States (Railway infrastructure). If you are located outside the United States, your data is transferred to and processed in the US.

## Cookies and tracking

The App uses a single temporary cookie during the initial authorization process to prevent cross-site request forgery (CSRF). This cookie is deleted immediately after authorization completes. We do not use cookies for tracking or any third-party analytics.

## Changes to this policy

We may update this privacy policy from time to time. If we make material changes, we will notify you through the App or via email.

## Contact us

If you have questions about this privacy policy or how we handle your data, please contact us at:

Email: [email protected]