Privacy Policy

Last updated: October 21, 2026

SupplyKit is a Shopify app that helps a merchant decide what stock to reorder, create purchase orders for their suppliers, and receive the stock into Shopify. This policy explains what data the app processes, why, and how it is protected.

SupplyKit stores no customer (buyer) personal data. It requests read_products, read_inventory, write_inventory (to receive purchase-order stock and, on Pro, update cost per item), read_locations and read_orders. Orders are read only for each line's product variant and quantity (plus whether the order was cancelled or a test), to count how many of each product sold. It never reads a customer's name, email, phone or address, and it stores nothing per order — only a total of units sold per product variant.

1. What We Process

1.1 Merchant / Store Data

The store's myshopify.com domain, an expiring Shopify access token, the subscription plan tier, and install status — the data needed to run the app for the store and bill it through Shopify. The store's name, contact email, currency and address are read to fill in purchase orders. On Micro and Pro, the store's contact email and time zone are also read to send the weekly "needs ordering" email (on by default, can be turned off in Settings); the contact email is not stored for this. Shopify's session data for a signed-in staff member may include that staff member's name, email address, and admin language, as provided by Shopify.

1.2 Catalog, Inventory and Sales Totals

Product and variant titles, SKUs, barcodes, vendors, cost per item, stock levels per location, and the store's locations, refreshed while the app is in use; older copies are deleted after each refresh. From orders, only a total of units sold per variant over the last 30 or 56 days.

1.3 Suppliers and Purchase Orders

What the merchant enters: supplier names and business contact details (contact name, email, phone, address), supplier SKUs, prices, pack sizes and minimum orders, and purchase orders with their items, costs, dates and notes, plus records of stock received. Purchase-order settings: a link to the merchant's logo (an image in the store's Shopify Files), a deliver-to address and payment and delivery terms. CSV files uploaded to import suppliers (a Stocky export or a supplier price list) are read in memory to create those suppliers and supplier items, and the file itself is not kept.

1.4 Store Owner's Email

The email address on the store owner's Shopify account (as set in Shopify — not the store's public contact email), the store's admin language, and whether it is a Shopify development store. It is used only to email the store owner: account alerts, a one-time welcome note on upgrading to a paid plan, and a one-time note after uninstalling asking what we could improve.

1.5 Support Messages

If you message us from inside the app (including a free setup or customization request), we store your messages, your shop domain, the reply-to email address and name you provide or that Shopify lists for your store, and your admin language — used only to answer you and to email you when we reply.

1.6 Error Reports

If a page of the app in your Shopify admin hits a technical error, your browser sends us the error message and stack trace, the page address (without its query string), the browser type, and your shop domain, so we can find and fix the bug. Our support service on our DigitalOcean server stores the report and, through Mailgun, emails an alert with the error text and stack trace, page address and shop domain to our team's mailbox, which Google hosts. When Shopify's shop/redact request arrives, your shop domain in the stored reports is replaced with an anonymous identifier and the page address and browser type are removed. That does not cover the alert emails: we keep them while we need them to fix the bug and delete them on request.

We process the minimum data needed to provide the app's value and use it only for the purposes described here, including customer support (in-app support messages and free setup and customization help). We do not sell data, and we do not use it for advertising or automated decision-making.

2. How We Collect It

From Shopify, when a merchant installs the app and grants access, and through the Admin API for the store's products, inventory, locations and orders.
From the merchant, when staff add suppliers, import price lists, and create or receive purchase orders in the embedded admin.
From the merchant, when they message us from inside the app (including a free setup or customization request).
From the merchant's browser, when a page of the app hits a technical error (section 1.6).

3. How We Protect It

All traffic is served over TLS 1.2+.
Data is stored on a DigitalOcean server; production access is SSH-key-only and limited to the operator, and the host runs standard hardening. Development and production data are kept separate.
Access tokens are stored server-side only and are never exposed to the browser.
Because SupplyKit holds no buyer personal data, there is no customer name, address, or payment information at rest to expose.
We maintain a security incident-response process and will notify affected merchants of a confirmed data breach within 72 hours.

4. How Long We Keep It

Suppliers, purchase orders and settings are kept while the app is installed. Catalog and sales snapshots are replaced on each refresh.
When a merchant uninstalls, access tokens are deleted immediately and the store's data held by the app is deleted in response to Shopify's shop-redaction request, except technical error reports and their alert emails (see section 1.6), in all cases within 30 days of uninstall.
The store owner's email, admin language and development-store flag are deleted when Shopify sends the shop data erasure request, about 48 hours after uninstall.
Support messages are deleted together with your store data when Shopify sends its store-deletion (shop/redact) request, or sooner on request. Backup copies of support messages age out within 30 days.

5. Who We Share It With

We use a small number of sub-processors, only as needed to run the service:

DigitalOcean — server and database hosting (United States).
Shopify — the platform the app runs on.
Mailgun — delivers the purchase-order emails a merchant chooses to send to their supplier (from support@nerdlabs.us, with the merchant as reply-to), and, as our email provider, our emails to the store owner (using the store owner's email), the weekly "needs ordering" email (to the store's contact email) and our replies to your support messages (to the reply-to address you give us).
Google — hosts our team's mailbox, which receives error alerts.

We do not share data with anyone else, and we never sell it.

6. Data Subject Rights (Shopify Privacy Webhooks / GDPR)

SupplyKit implements Shopify's mandatory privacy webhooks in full. Because the app stores no customer personal data:

A customer data request returns no customer records, because SupplyKit holds none.
A customer redaction has no customer data to remove.
A shop redaction deletes all of the store's data held by the app (suppliers, purchase orders, receipts, catalog and sales snapshots, settings, plan and install records, and sessions) and the store owner's email. Technical error reports and their alert emails are handled as described in section 1.6 instead.

These support the merchant's obligations under the GDPR, the CCPA/CPRA, and similar laws. Merchants agree to SupplyKit's terms and this policy when they install the app.

7. Changes

We will update this page when our practices change and revise the date at the top.

8. Contact Us

If you have questions about this Privacy Policy or how we handle your data, contact us at:

NerdLabs (operated by Joren Winge)
Email: support@nerdlabs.us
Website: nerdlabs.us