Privacy Policy

Restock ("the app", "we", "us") is a Shopify application that lets merchants offer back-in-stock alerts, price-drop alerts, preorders, and demand analytics. This policy explains what data the app collects, why, and how it is protected.

1. Information we collect

When a merchant installs Restock, we receive and store:

• Store domain, store name, and the Shopify access token needed to operate the app.
• Product and inventory data (IDs, titles, prices, stock levels) used to detect restocks and price changes.
• Order data, used only to attribute conversions and process preorders.

When a shopper subscribes to a notification through the merchant's storefront, we collect:

• Email address (required) and phone number (optional, only if SMS or WhatsApp is chosen).
• The product/variant they are interested in and their per-channel consent flags.

2. How we use information

Shopper contact details are used solely to deliver the notifications the shopper explicitly requested (back-in-stock, price-drop, or preorder updates) and to provide the merchant with aggregate analytics about demand and conversions. We process only the minimum personal data needed to provide this functionality, and we limit our use of that data to those purposes. We do not sell personal data, we do not share it with third parties for their own marketing, and we do not use it for advertising or any purpose unrelated to the requested notifications. We do not use personal data for automated decision-making that produces legal or similarly significant effects on shoppers.

3. Sub-processors

To deliver notifications we share the minimum necessary data with:

• Resend — email delivery.
• Twilio — SMS delivery (only if the merchant enables SMS).
• Meta / WhatsApp — WhatsApp delivery (only if the merchant enables WhatsApp).

4. Data storage and security

Data is stored in a PostgreSQL database on dedicated infrastructure. We apply the following safeguards:

• All data is encrypted in transit (TLS/HTTPS) and encrypted at rest, including database backups.
• Shopify access tokens are stored per shop and never exposed to shoppers or third parties.
• Production data is kept separate from test and development data.
• Staff access to personal data is restricted on a least-privilege, need-to-know basis, protected by strong authentication, and access to personal data is logged.
• We maintain a data-loss-prevention approach and a documented security incident response policy, and will notify affected merchants of any breach as required by law.

5. Data retention

We keep personal data only as long as it is needed for the purposes above. Subscriber records are retained while a merchant uses the app and a shopper remains subscribed. When a merchant uninstalls Restock, processing stops immediately. Shop and customer data are deleted in response to Shopify's mandatory compliance webhooks (see below) and within 48 hours of an uninstall-driven shop redaction request. Unsubscribed shoppers' contact details are purged on an ongoing basis.

6. GDPR & shopper rights

Restock implements Shopify's mandatory privacy webhooks at /api/webhooks:

• customers/data_request — returns the data we hold for a given shopper.
• customers/redact — deletes a shopper's personal data.
• shop/redact — deletes all data for a store 48 hours after uninstall.

Shoppers may also unsubscribe at any time using the link included in every message, which removes their data from future sends. To exercise any data right, contact the merchant or email us at the address below.

7. Consent

Shoppers opt in per channel when they subscribe. Email, SMS, and WhatsApp each require explicit consent, and consent is recorded with each subscriber. We respect and apply shoppers' consent decisions, including withdrawal of consent and opt-out requests, and we honor any merchant- or shopper-level decision to opt out of data sharing. Because we do not sell personal data, there is nothing to opt out of in that respect.

8. Data protection agreement with merchants

We act as a data processor on behalf of the merchant (the data controller). Our agreement with merchants — which incorporates this Privacy Policy and our Terms of Service — sets out the personal data we process, the purposes for processing, and our data-protection obligations. We process personal data only on the merchant's documented instructions and in accordance with applicable law, including the GDPR and CCPA.

9. Changes to this policy

We may update this policy as the app evolves. Material changes will be reflected here with an updated "Last updated" date.

10. Contact

Questions about this policy or your data: restock@webb9.com