Privacy Policy

Effective Date: July 24, 2026

Last Updated: July 24, 2026

This Privacy Policy explains how Back-in-Stock ("we," "us," or "our") collects, uses, stores, and protects merchant and customer data when you use our Shopify app. We are committed to transparency and compliance with privacy laws including GDPR, CCPA, and applicable data protection regulations.

1. Information We Collect

1.1 Merchant Data

When you install Back-in-Stock on your Shopify store, we collect and store:

• Store Information: Your shop domain (e.g., yourstore.myshopify.com), shop name
• Authentication Credentials: Shopify OAuth access tokens (encrypted) to communicate with your store's API
• Product Data: Product IDs, titles, variant IDs, variant titles, product images, and inventory levels for products you select in the app
• Subscription & Billing: Your subscription level (Free/Premium/Trial), Shopify subscription IDs, billing status, and invoice information
• App Configuration: Email template customizations, sender email address, delivery timing preferences (delay minutes, business hours settings), and minimum stock threshold settings
• Audit Logs: Installation/uninstallation events and configuration changes for security and troubleshooting

1.2 Customer Data

When your store's customers subscribe to back-in-stock notifications via the storefront widget, we collect:

• Email Address: The customer's email address provided when subscribing to restock alerts
• Product Interest: Shopify product ID, variant ID, product title, variant title for the item they want to be notified about
• Subscription Metadata: Timestamp of subscription, locale/language preference (if available)
• Notification Status: Whether notification has been sent and when
• Notification Engagement: Whether the product link in the notification email was clicked, and when — a single timestamp. No IP address, device, or browser information is recorded.

1.3 Technical Data

• Webhook Data: Inventory level updates, product updates from Shopify webhooks
• Email Queue Data: Email delivery attempts, success/failure status, error logs
• OAuth State Data: Short-lived tokens used to secure the installation flow, valid for 10 minutes (see section 4.2)

1.4 Data We Do NOT Collect

• ✗ Payment card information (processed by Shopify only)
• ✗ Customer passwords or authentication credentials
• ✗ Customer shipping addresses or phone numbers
• ✗ Customer purchase history or order details
• ✗ Customer browsing behavior, cross-site tracking, or third-party analytics (the only engagement signal we record is whether our own notification email's product link was clicked)

2. How We Use Your Data

2.1 Primary Purpose: Back-in-Stock Notifications

• Restock Alerts: Send automated email notifications to customers when out-of-stock products become available again
• Inventory Monitoring: Track inventory levels via Shopify webhooks to detect when products are restocked
• Email Delivery: Queue and send emails using your configured email template and sender address

2.2 App Functionality & Support

• Authentication: Verify your store's identity and maintain secure API access
• Subscription Management: Track your Free/Premium subscription status and billing
• Personalization: Store your email template and delivery preferences to customize notifications
• Support & Troubleshooting: Use audit logs to diagnose issues or respond to support requests
• Measure whether restock alerts are effective, by recording when the product link in a notification email is clicked (legitimate interest — see Section 12)

2.3 Legal Compliance

• Respond to GDPR data requests (data access, deletion)
• Comply with Shopify's app policies and data protection requirements
• Maintain audit trails for security and compliance purposes

3. Data Sharing & Third Parties

3.1 Third-Party Services We Use

We share data with the following third-party services to provide app functionality:

Note: We use reputable third-party infrastructure providers with appropriate security certifications. We do not sell, rent, or share your data with third parties for marketing purposes.

3.2 We Do NOT Share Data With

• ✗ Advertising networks or data brokers
• ✗ Social media platforms
• ✗ Analytics or tracking services beyond operational needs
• ✗ Any third party without your explicit consent (except as required by law)

4. Data Retention & Deletion

4.1 How deletion works

Data is deleted in two ways: automatically after 90 days, and immediately when certain events occur.

Scheduled deletion. A purge runs every 24 hours and permanently deletes:

• notification emails delivered more than 90 days ago, and emails that failed to send and were abandoned more than 90 days ago;
• subscriptions whose alert was already sent more than 90 days ago;
• audit records older than 90 days;
• expired installation tokens.

Customers still waiting for an alert are never deleted by this purge, however long they have been waiting — a product can stay out of stock for a long time, and we will not silently drop a request someone made.

Event-driven deletion. Data is also erased immediately when:

• A customer unsubscribes — their subscription record is deleted immediately.
• Shopify sends customers/redact — all subscriptions and queued emails for that customer's address are deleted.
• You uninstall the app — your shop's access token is removed when the app/uninstalled webhook is received.
• Shopify sends shop/redact, approximately 48 hours after uninstall — the remainder of your shop's data is deleted, including subscriber records, audit records and invoices.

4.2 Retention summary

• Customer subscriptions — alert already sent: 90 days. The record is kept until then, marked as notified rather than deleted, so the same person is not emailed twice for the same variant.
• Customer subscriptions — still waiting: kept until the alert is sent, the customer unsubscribes, or you uninstall. Never purged on age.
• Email delivery records: 90 days after delivery or abandonment. These include the rendered email body and any delivery error, so failures can be diagnosed and retried.
• Audit records: 90 days, or sooner if your shop's data is deleted.
• OAuth state tokens: valid for 10 minutes, then rejected, and removed by the next purge.

To have a specific record erased sooner, use the unsubscribe link in any notification email, or contact [email protected].

5. Data Security

We implement industry-standard security measures to protect your data:

5.1 Technical Safeguards

• Encryption in Transit: Outside local development, HTTP requests are redirected to HTTPS, and outbound email is sent over TLS
• Authentication: OAuth 2.0 and Shopify session tokens for API access. Every endpoint requires an authenticated caller by default; only the specific routes that must work before sign-in are anonymous
• Signature Verification: HMAC verification on incoming Shopify webhooks, and App Proxy signature verification on public storefront endpoints. Both fail closed — a request whose signature cannot be verified is rejected, never trusted
• Shop Isolation: Data access is scoped to the authenticated shop, so one merchant cannot read another merchant's subscribers or notifications
• Abuse Resistance: Storefront endpoints are rate limited per verified shop, and input sizes are bounded
• Credential Handling: Secrets are supplied by environment or secure configuration, never hardcoded, and secret values are excluded from logs. Shopify access tokens expire and are refreshed

Note on encryption at rest: the application does not perform column-level encryption of stored data. Any encryption at rest is provided by the underlying database hosting layer.

5.2 Operational Safeguards

• Regular security audits and updates
• Secure credential management (no hardcoded keys)
• Monitoring and logging of security events
• Incident response procedures

5.3 Limitations

While we implement strong security measures, no system is 100% secure. We cannot guarantee absolute security but commit to:

• Promptly notify you of any data breach affecting your data (within 72 hours)
• Cooperate with investigations and regulatory requirements
• Continuously improve our security posture

6. Your Rights (GDPR & CCPA)

6.1 Merchant Rights

As a merchant, you have the right to:

• Access: Request a copy of all data we store about your shop
• Rectification: Update incorrect data via the app's Settings page
• Deletion: Delete all your shop's data by uninstalling the app
• Portability: Export your data in a machine-readable format (JSON/CSV)
• Objection: Object to data processing by discontinuing use of the app

6.2 End Customer Rights (GDPR)

Customers who have subscribed to restock notifications have the right to:

• Access: Request what data we hold about them
• Deletion: Request deletion of their subscription data
• Unsubscribe: Stop receiving notifications (one-click unsubscribe in emails)

6.3 How to Exercise Your Rights

For Merchants: Contact us at [email protected] with your shop domain.

For Customers: Contact your merchant directly, or email us at [email protected].

GDPR Automated Compliance: We automatically respond to Shopify's GDPR webhooks (customers/data_request, customers/redact, shop/redact) to fulfill data access and deletion requests within required timeframes.

7. Children's Privacy

Back-in-Stock is not intended for use by individuals under the age of 16. We do not knowingly collect personal information from children. If you believe we have inadvertently collected data from a child, please contact us immediately at [email protected].

8. International Data Transfers

Your data may be transferred to and processed in countries outside of your jurisdiction, including the United States and European Union. We ensure appropriate safeguards are in place:

• Standard Contractual Clauses (SCCs) with third-party processors
• Compliance with GDPR Article 46 transfer mechanisms
• Adequacy decisions where applicable

9. Cookies & Tracking

Back-in-Stock uses minimal cookies and tracking:

• Session Tokens: Shopify App Bridge session tokens for embedded app authentication (expires when you close the browser)
• No Third-Party Cookies: We do not use advertising cookies or third-party tracking pixels
• Storefront Widget: Our widget script does not set cookies or track customer behavior

Restock notification emails contain a product link that passes through our server, so we can record that the alert was acted on before redirecting to the store. This mechanism uses no cookies, no tracking pixels, and no device identifiers; it stores a single timestamp.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect:

• Changes in app functionality
• New legal or regulatory requirements
• Improvements to our security practices

Notification: We will notify you of material changes via email to your shop's billing email address or through an in-app notification at least 30 days before the changes take effect.

Effective Date: The "Last Updated" date at the top of this policy indicates when changes were last made.

11. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

12. Legal Basis for Processing (GDPR)

Under GDPR, we process data based on the following legal grounds:

• Contractual Necessity: Processing merchant and customer data is necessary to provide the back-in-stock notification service
• Legitimate Interests: Improving app functionality, preventing fraud, ensuring security, and measuring the effectiveness of requested restock alerts
• Legal Obligation: Compliance with Shopify policies, tax laws, and data protection regulations
• Consent: Customers explicitly consent by providing their email for restock notifications

13. Data Protection Officer

For EU/UK merchants and customers, you may contact our Data Protection Officer (DPO) at:

Email: [email protected]

Summary

What we collect: Shop info, customer emails, product subscriptions, notification click timestamps
Why: To send automated restock notifications
How long: Until you uninstall the app or customer data is deleted via GDPR request
Your rights: Access, delete, export your data anytime
Security: Encrypted storage, HTTPS, HMAC verification, regular audits

Return to App Open Shop Shop Open Shop