Privacy Policy
This policy explains what personal data the CTIOLab Inventory app ("the App") processes, why, how long it is kept, and how it is protected. The App is provided by CTIOLab LLC ("CTIOLab", "we", "us"). It is written for the merchants who install the App ("you") and for their customers.
When a merchant uses the App, the merchant decides what the App is used for and is responsible for its own customers' data (the "controller"). CTIOLab processes that data only on the merchant's behalf and on its instructions (the "processor"). Customers of a store who have questions about their data should contact that store first; we will help the store answer.
1. What the App does
The App is an inventory-management tool that runs inside the Shopify admin. It keeps stock levels in sync with Shopify, creates and receives purchase orders, runs stock counts, prints labels, and forecasts reorder quantities from the store's sales history.
2. Personal data we process
About your store's customers
| Data | Where it comes from | Why |
|---|---|---|
| Order details: order number, date, sales channel, line items, quantities, prices, refunds and cancellations, payment and fulfillment status | Your Shopify orders | Sales history for demand forecasting and reorder planning; the Sales Orders list |
| Customer name on an order | Your Shopify orders | So your staff can recognise an order on the Sales Orders list |
| Ship-to name, address and phone number of an order | The Shopify order you select when creating a drop-ship purchase order | Printed on that drop-ship purchase order so your supplier can ship directly to the customer |
We do not collect customers' email addresses, payment or card details, passwords, browsing behaviour, or any data from your storefront. We do not track customers and do not use customer data for marketing, advertising, profiling or automated decisions about people.
About you and your staff
| Data | Why |
|---|---|
| Staff name, email and Shopify user ID (from the Shopify admin session) | Signing in, admin/staff roles, and recording who created, edited or received a purchase order |
| Store name, domain, currency, timezone and address details you enter (company profile) | Running the App for your store; printing your details on purchase orders |
| Supplier contacts you enter (names, emails, phone numbers, addresses) | Creating and emailing purchase orders |
3. How we use it
Only to provide the App's features described above. We do not sell, rent or share personal data with anyone for their own purposes. We use the minimum data needed: for example, only the ship-to details of orders you actually turn into drop-ship purchase orders are copied into the App.
4. Who else processes it (sub-processors)
| Provider | Purpose | Location |
|---|---|---|
| Shopify | Source of all store data; app installation and billing | Global |
| Vercel Inc. | Hosting the App | United States |
| Supabase Inc. (on Amazon Web Services) | Database and encrypted backups | United States (us-west-1) |
| Resend | Sending purchase-order emails to your suppliers when you choose to email a PO | United States |
Each provider is bound by its own security and data-protection commitments. We will update this list before adding a new provider.
5. How long we keep it
- While the App is installed: order and inventory history is kept so the forecast can use it.
- Customer names and ship-to details are removed from orders and drop-ship purchase orders older than 24 months. The anonymous sales figures (quantities, prices, dates) remain.
- When a customer asks to be erased (Shopify's customer redaction request), that customer's name and ship-to details are removed from the listed orders and purchase orders.
- When you uninstall the App, Shopify notifies us 48 hours later and we delete all of your store's data: products, stock history, purchase orders, sales orders, settings, staff records and uploaded files.
- Technical logs kept by our hosting providers are deleted automatically after a short period (days, not months).
- Database backups are kept for up to 7 days and then overwritten.
6. How we protect it
- All connections use HTTPS/TLS. The database and its backups are encrypted at rest.
- Your Shopify access credentials are additionally encrypted by the App (AES-256-GCM).
- Each store's data is kept apart from every other store's by database row-level security; one store can never see another store's data.
- Inside your store, access follows your Shopify staff accounts, with separate admin and staff roles in the App.
- On our side, only CTIOLab's administrator can access the systems behind the App, using accounts protected by strong passwords and two-factor authentication. Access to customer details is logged.
- Test stores contain only test data; real store data is never copied into test environments.
7. Requests from customers
Customers exercise their privacy rights through the store they bought from. Shopify forwards data and erasure requests to us automatically. For a data request, the App prepares what it holds for that customer, and you can download it from Configuration → Shopify Connection → Customer privacy requests to send on. Erasure requests are carried out automatically. We will also help you answer any other request relating to data the App holds.
8. Security incidents
If we become aware of a security incident affecting your store's personal data, we will notify you without undue delay, and in any case within 72 hours, with what we know about it and what we are doing about it, and we will notify Shopify as required.
9. Changes
If we change this policy in a way that affects how your data is handled, we will update the date above and tell you in the App before the change takes effect.
10. Contact
CTIOLab LLC, PO Box 1402, Carmel-by-the-Sea, CA 93921, USA
Email: support@ctiolab.com