Privacy Policy

1. Who we are

ReorderFlow ("we", "us", "our") is a Shopify application that helps store owners automate the creation of purchase orders. The app is operated by an individual developer based in Margaret River, Western Australia.

If you have any questions about this policy or how your data is handled, contact us at wajahatpunk@gmail.com.

2. What data we collect and why

2.1 Shopify store data (via Shopify API)

When you install ReorderFlow, we request access to the following Shopify data through the official Shopify API:

• Products and variants — to display your catalogue, read stock levels, and identify which products are below their reorder point.
• Inventory levels — to track current stock quantities and trigger reorder alerts.
• Shop information — your shop name and currency, used to populate purchase orders correctly.

We access only the data necessary to provide the service. We do not access customer data, payment information, order history, or any other Shopify data not listed above.

2.2 Supplier data you enter

You may enter supplier names, email addresses, and contact details into ReorderFlow. This data is:

• Stored securely on our servers and associated only with your shop.
• Used solely to populate purchase orders and send emails to your suppliers at your request.
• Never shared with third parties for marketing or any purpose unrelated to operating the app.

2.3 Purchase order data

Purchase orders you create within ReorderFlow — including product lines, quantities, costs, and status — are stored in our database and associated with your shop. This data is retained for as long as your account is active and deleted upon uninstall as described in section 5.

2.4 Account and billing

Billing is handled entirely by Shopify through their standard app billing system. ReorderFlow never receives or stores your credit card details. Subscription status is communicated to us by Shopify via webhook.

2.5 Usage data

We may collect basic, anonymised usage data (such as the number of purchase orders created) to understand how the app is used and improve it. This data cannot be used to identify individual users.

3. How we use your data

We use the data we collect solely to:

• Provide, operate, and improve the ReorderFlow service.
• Generate purchase orders on your behalf.
• Send purchase order PDFs to your suppliers when you instruct us to.
• Respond to your support requests.
• Comply with legal obligations.

We do not use your data for advertising purposes. We do not build profiles to sell to third parties. We do not use tracking pixels or third-party advertising cookies.

4. Multi-tenant data isolation

ReorderFlow is a multi-tenant application, meaning multiple Shopify stores use the same underlying infrastructure. Each store's data is isolated by a unique shop identifier. Your data is never accessible to other stores using the application. Access controls are enforced at the application and database level to ensure this separation.

5. Data retention and deletion

5.1 On uninstall

When you uninstall ReorderFlow from your Shopify store, we receive an uninstall webhook from Shopify. Within 30 days of receiving this webhook, we permanently delete all data associated with your store, including:

• All purchase orders and their line items.
• All supplier records and contact information.
• All product reorder point settings.
• Any other data stored in connection with your shop ID.

5.2 GDPR mandatory webhooks

ReorderFlow complies with Shopify's mandatory GDPR webhook requirements:

• Customer data request: We respond to Shopify-forwarded customer data requests. Note that ReorderFlow does not store customer personal data — only supplier data entered by you, the merchant.
• Customer data erasure: We process erasure requests for any identifiable data upon receipt.
• Shop data erasure: We permanently delete all shop data within 30 days of receiving a shop erasure request, consistent with the uninstall process above.

5.3 Requesting deletion

You may also request deletion of your data at any time — before or after uninstalling — by emailing wajahatpunk@gmail.com. We will acknowledge your request within 5 business days and complete the deletion within 30 days.

6. Data sharing and third parties

We do not sell your personal data. We share data only in the following circumstances:

• Shopify: The app operates on the Shopify platform. Data flows between ReorderFlow and Shopify as required to provide the service, governed by Shopify's Privacy Policy.
• Infrastructure providers: We use cloud hosting and database services to operate the app. These providers process data on our behalf under data processing agreements and do not use your data independently.
• Legal requirements: We may disclose data if required by law, court order, or to protect the rights and safety of ReorderFlow or others.

7. Security

We take the security of your data seriously. Our measures include:

• All data is transmitted over HTTPS/TLS encryption.
• Data at rest is stored on encrypted infrastructure.
• Access to production systems is restricted to authorised personnel only.
• Shopify API tokens are stored securely and never exposed in client-side code.

No system is completely secure. If you become aware of a security issue, please contact us immediately at wajahatpunk@gmail.com.

8. Cookies

ReorderFlow does not use advertising cookies, tracking pixels, or third-party analytics that identify individual users. The app may use session cookies strictly necessary for authentication within the Shopify admin. These cookies do not track you across other websites.

9. Your rights (GDPR)

If you are located in the European Economic Area or the United Kingdom, you have the following rights regarding your personal data:

• Right of access: You can request a copy of the personal data we hold about you.
• Right to rectification: You can ask us to correct inaccurate data.
• Right to erasure: You can request that we delete your data (see section 5.3).
• Right to restriction: You can ask us to restrict how we use your data.
• Right to data portability: You can request your data in a structured, machine-readable format.
• Right to object: You can object to certain processing of your data.

To exercise any of these rights, contact us at wajahatpunk@gmail.com. We will respond within 30 days.

10. Children's privacy

ReorderFlow is a business tool intended for use by adults operating Shopify stores. We do not knowingly collect data from individuals under 18 years of age.

11. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "last updated" date at the top of this page and, where appropriate, notify active users via the Shopify admin. Continued use of the app after changes take effect constitutes acceptance of the updated policy.

12. Contact

For any privacy-related questions, data requests, or concerns, contact us at:

ReorderFlow Privacy
wajahatpunk@gmail.com
Margaret River, Western Australia, Australia