Privacy Policy

1. Scope and roles

This policy describes how Production Inbox handles information when a Shopify merchant installs or uses the app. The merchant controls the store and its order data; the Production Inbox operator processes that data to provide the service.

The current build is a private development build and does not accept public installations until the security, hosting, and release gates are complete.

2. Information processed

• Shop and merchant-session information supplied by Shopify, including the shop domain, access and refresh tokens, granted scopes, locale, and authenticated merchant-user profile fields such as name or email when Shopify provides them.
• Production facts from open orders: Shopify order and line-item identifiers, order display name, product title, SKU, variant, image URL, remaining quantity, update time, and custom line-item attributes used to make the product.
• Merchant-confirmed production rules, workflow status, synchronization cursors, bounded queue state, webhook identifiers, and operational timestamps.
• Customer privacy-request order identifiers supplied by Shopify, used only to locate, export, or delete app-owned production records.

3. Information deliberately excluded

Production Inbox does not request customer names, customer email addresses, customer phone numbers, billing addresses, or shipping addresses through its order queries. A buyer may still place personal information inside a customization value; those values are treated as store production data and should be limited by the merchant to what is necessary for fulfillment.

The first release does not send production data to paid AI services, advertising networks, or analytics profiles, and does not use customer data for advertising.

4. Why information is used

• Authenticate the merchant through Shopify and maintain the authorized app session.
• Build a searchable, tenant-isolated make list and preserve merchant-confirmed production workflow.
• Process bounded order updates, recover safe retries, and surface failures without logging raw order payloads.
• Respond to Shopify privacy webhooks, export applicable app-owned records, and delete applicable records.
• Protect the service, enforce limits, investigate operational failures, and comply with legal obligations.

5. Sharing and subprocessors

Information is shared only with Shopify and the infrastructure providers required to host the app, database, and scheduled worker. Production Inbox does not sell personal information. A final hosting provider and public subprocessor list will be fixed before release; the app cannot pass its deployment gate until that infrastructure is selected and reviewed.

Information may be disclosed when required by law, to protect users or the service, or as part of a business transfer subject to appropriate confidentiality and notice obligations.

6. Retention and deletion

• Successful background jobs are pruned after 7 days; successful webhook idempotency receipts after 30 days; caches at their individual expiry time.
• Completed customer-data export requests are pruned after 30 days. The downloadable response is marked private and no-store.
• Production items and merchant rules remain while the app is installed so the merchant can use the workflow. Matching order records are deleted when Shopify sends a verified customer-redaction request.
• Uninstall immediately pauses synchronization and removes sessions, queue work, and cache. Tenant business data is deleted when the verified Shopify shop-redaction event is processed.
• After shop deletion, only a secret-keyed, non-plain-text shop hash, event type, result, and time are retained as compliance evidence, and those receipts are pruned after 3 years.

7. Security

The app uses Shopify session tokens, tenant-scoped database queries, minimal read_orders access, webhook authentication provided by Shopify's official framework, bounded queues, version-checked writes, and per-shop synchronization controls. OAuth state, access and refresh tokens, and merchant name/email session fields are protected with application-level AES-256-GCM encryption before database storage. Public release additionally requires HTTPS, encrypted persistent storage, protected secrets, and a passing production dependency audit.

No security method is perfect. Merchants should not place unnecessary sensitive information in product customization fields and should report suspected unauthorized access promptly.

8. Requests and contact

Merchants can uninstall the app through Shopify and can contact the operator about access, correction, deletion, or privacy questions. Requests relating to a buyer's store order should normally be directed to the Shopify merchant, who controls that store data.

Shopify's mandatory privacy webhooks are supported for customer data requests, customer redaction, and shop redaction.

9. Changes

This policy may be updated when the product, subprocessors, legal requirements, or data practices change. The updated date will be shown above, and material changes will be communicated through an appropriate merchant-facing channel.