Privacy Policy

Last updated: August 28, 2026

Replenly ("the app", "we", "us") is a Shopify app that helps merchants manage replenishment, purchase orders, receiving, ingredients, and physical stocktakes. It is operated by an individual developer. This policy explains what data the app processes, why, and how it's protected.

What data we process

When a merchant installs Replenly, we process:

• Your store's domain and basic shop information, including the store's contact email address, which we store so we can send you inventory summaries you opt into (such as the weekly low-stock email, configurable in the app's settings).
• Your product and variant catalog: titles, SKUs, costs, and inventory levels.
• Supplier records you create in the app (supplier name, contact details, lead times, etc.).
• Purchase orders you create, edit, or send through the app.
• Stocktake records, including the selected Shopify location, product snapshots, expected quantities, physical counts, and variance/apply history you create in the app.
• Ingredient, recipe, and ingredient-stock records you create in the app when you use those workflows.
• Aggregate order line-item data - variant ID, quantity, order date, and a pseudonymous order line identifier (the Shopify order ID and line item ID, with no customer data attached) - used to calculate sales velocity, generate reorder suggestions, and prevent double-counting a line item if its webhook is redelivered.
• Authentication and session data for the staff account that installs and uses the app (name, email, and Shopify user ID), stored so the embedded app can maintain your team's login session.

We do not deliberately collect, store, or retain your customers' names, emails, phone numbers, shipping/billing addresses, or payment details. Shopify webhook and API payloads can contain customer fields. We may transiently receive and process those payloads to authenticate and handle the Shopify request, but Replenly does not extract or persist those customer fields in its operational records. The order and order-line identifiers we retain exist only to compute how quickly a product sells and to deduplicate repeated webhook deliveries; they are never linked to who bought the item.

Why we process it

Every piece of data listed above is used to operate the app's replenishment, reorder suggestions, purchase-order, ingredient, and stocktake workflows. We do not use your data for advertising, we do not sell it or share it for advertising or independent commercial purposes, and we do not build profiles of your shoppers. We disclose data to service providers acting on our behalf as described below.

Storage and security

Data is stored in a managed PostgreSQL database. It's encrypted in transit (TLS) and at rest, and access is restricted to the systems that run the app. We don't grant broad third-party access to your shop data.

Service providers

We rely on Shopify for the platform integration and on a small number of infrastructure and delivery providers to run the app. The infrastructure and delivery providers act on our behalf and are bound by their own security and confidentiality obligations:

• Shopify - provides the commerce platform and the authentication, Admin API, and webhook services through which the app operates. Shopify also independently controls data held in its platform under Shopify's own terms and privacy policy.
• Fly.io - hosts the application servers that run the app's web and background-job processes.
• Supabase - hosts the PostgreSQL database described above, where your shop's data is stored.
• Resend - we use Resend as our transactional email delivery provider for supplier purchase orders, weekly low-stock summaries, and compliance/data-request reports. The destination email address and message contents, including any purchase-order PDF attachment and applicable order-derived operational data, are disclosed to Resend solely to deliver the email. Provider-side delivery records and retained message data are governed by Resend's terms and privacy practices and are not covered by the shop-uninstall deletion described below, which applies only to data stored in our own database.
• Tigris - provides encrypted off-site object storage where we keep the database backups described below, plus the minimal redaction metadata (hashed identifiers only - never raw order IDs or customer data) needed to make sure deleted data stays deleted if a backup is ever restored.
• Sentry (Functional Software, Inc.) - provides application error monitoring and diagnostics. Replenly sends only minimized, redacted technical error and diagnostic telemetry to the EU/Germany region for this Replenly Sentry organization. The server-side integration disables default PII and request-data collection, and the organization is configured not to store IP addresses. In the authenticated embedded app, we also use privacy-first Sentry Session Replay to diagnose frontend errors: normal sessions are not sampled, while sessions containing an error may be sampled. All text and input values are masked, media is blocked, and HTTP request/response bodies, raw keystrokes, and raw user identities are not collected. Replays may contain only redacted UI structure, limited technical interaction/timing metadata, and sanitized exception stack-frame metadata needed to diagnose the error; source lines, local variables, URL origins/query strings, and arbitrary frame properties are not collected. We do not deliberately attach merchant or staff identity.

None of these providers is given access to your data beyond what's necessary for the purposes described above. Sentry is limited to the diagnostic telemetry described above, is not initialized on the public marketing, terms, or privacy pages, and is not used to process your shop records.

Data retention

• We retain order-derived operational records - the Shopify order and line-item identifiers, variant IDs, quantities, and dates, with no customer names, emails, or addresses attached - for as long as they are useful for reorder forecasting. Aggregate sales records older than 90 days are automatically deleted on a nightly schedule. Before deletion, they are folded into anonymous monthly per-product totals (units sold and revenue by calendar month, with no order identifiers or customer data), which we retain to support seasonal reorder forecasting; these totals are deleted with the rest of your shop's data if you uninstall.
• Expired online staff sessions and sessions whose refresh tokens have expired are removed during the nightly retention cleanup. Valid offline sessions are retained while the installation remains active so the app can continue its Shopify integration, and all sessions are removed during shop redaction.
• Completed compliance-request metadata, including keyed redaction handles, is retained for up to 90 days for operational evidence and then removed. Raw order IDs are cleared as soon as a request is completed. The separate minimal hashed redaction fences needed to prevent replay remain retained.
• If you uninstall Replenly, all of your shop's data - products, suppliers, purchase orders, stocktakes, ingredient records, and sales aggregates - is deleted from our live systems when Shopify sends its mandatory shop/redact webhook, which Shopify normally issues about 48 hours after an app is uninstalled. When the delivery can be correlated safely to that uninstall generation, we begin the deletion promptly and drive it to completion (retried automatically until it succeeds). If Shopify's event clock is missing or invalid, we record the authenticated delivery for safe operator resolution rather than risk deleting a replacement installation. Backup copies are normally pruned after 30 days (see Backups below), and we retain only minimal redaction metadata - hashed identifiers, never the data itself - as necessary to prevent deleted data from being restored.
• You can request earlier deletion at any time by emailing vkundar@gmail.com.

Backups

We keep off-site database backups for disaster recovery and target pruning them after 30 days. Automated pruning runs nightly; if a provider or configuration failure prevents cleanup, older copies may remain until pruning succeeds and the failure is recorded for operator follow-up. Because of this, data you delete - including data removed by an uninstall or a redaction request - may persist in a backup beyond that target period. The supported restore process keeps deletion/redaction state separately from ordinary backups and reapplies that state after restoring, which is designed to prevent a restored backup from reactivating data that was already deleted or redacted. This protection depends on the deletion state having been durably recorded and on the supported restore process being used.

Shopify GDPR compliance webhooks

Replenly implements Shopify's three mandatory webhooks:

• customers/data_request - we hold no customer personal data, but we do retain the order-derived operational records described above for the specific orders named in the request. We compile those records (order/line-item IDs, variant IDs, quantities, and dates - never any customer identifier) and provide them to you, the merchant, so you can respond to your customer.
• customers/redact - we delete the order-derived operational records we hold for the orders named in the request, and keep only a hashed marker of the affected order IDs so those records can't be re-created by a late webhook delivery or a backup restore. (Raw-material stock levels already consumed by those orders are physical inventory data, not personal data, and are not altered.)
• shop/redact - triggers a purge of all data associated with the shop from our live systems, with backup copies expiring within 30 days as described above.

Billing

Subscription billing is handled entirely by Shopify's billing system. We never see or store your payment card details.

Changes to this policy

If this policy changes, we'll update the date at the top of this page. Continued use of the app after a change means you accept the updated policy.