Privacy Policy

Last updated: October 22, 2026

Replenly ("the app", "we", "us") is a Shopify app that helps merchants manage replenishment, purchase orders, receiving, ingredients, and physical stocktakes. It is operated by an individual developer. This policy explains what data the app processes, why, and how it's protected.

What data we process

When a merchant installs Replenly, we process:

• Your store's domain and basic shop information, including the store's contact email address, which we store so we can send you inventory summaries you opt into (such as the weekly low-stock email, configurable in the app's settings).
• If you connect a Slack incoming webhook, low-stock summaries (such as product titles, SKUs, quantities, supplier names and purchase order references) are also sent to the Slack workspace you chose. Slack is not a Replenly processor; you control that destination and can disconnect it in Settings.
• If you create an API key in Settings, anyone who presents that key can read your Replenly data until you revoke it.
• Your product and variant catalog: titles, SKUs, costs, and inventory levels.
• Supplier records you create in the app (supplier name, contact details, lead times, etc.).
• Purchase orders you create, edit, or send through the app, including any supplier returns or credits you record against an order (quantities, a reason and a credit reference).
• Optional ship-to details that you or your staff type on a purchase order, such as a recipient's name, address and phone number when a supplier ships directly to one of your customers or to another site. We store these details on the purchase order and use them only for the purchase-order workflow: they are printed on the order's PDF and included in emails to the supplier. You can change or remove them on a draft or open order in the app. If one of your customers asks you for a copy of these details or for their deletion, email us and we will locate, export or delete them, including copies kept with records of supplier emails, on your instructions within 30 days. They are otherwise deleted with the rest of your shop data.
• Stocktake records, including the selected Shopify location, product snapshots, expected quantities, physical counts, and variance/apply history you create in the app.
• Ingredient, recipe, and ingredient-stock records you create in the app when you use those workflows.
• Aggregate order line-item data: variant ID, quantity, order date, and a pseudonymous order line identifier (the Shopify order ID and line item ID, with no customer data attached). This data is used to calculate sales velocity, generate reorder suggestions, and prevent double-counting a line item if its webhook is redelivered.
• Authentication and session data for the staff account that installs and uses the app (name, email, and Shopify user ID), stored so the embedded app can maintain your team's login session.

We do not extract your customers' names, emails, phone numbers, shipping/billing addresses, or payment details from Shopify order data. Shopify webhook and API payloads can contain customer fields. We may transiently receive and process those payloads to authenticate and handle the Shopify request, but Replenly does not extract or persist those customer fields in its operational records. Replenly stores a customer's contact details only when you or your staff choose to enter them in the app yourselves, such as ship-to details on a purchase order, as described above. The order and order-line identifiers we retain exist only to compute how quickly a product sells and to deduplicate repeated webhook deliveries; they are never linked to who bought the item.

Why we process it

Every piece of data listed above is used to operate the app's replenishment, reorder suggestions, purchase-order, ingredient, and stocktake workflows. We do not use your shop or customer data for advertising, we do not sell it or share it for advertising or independent commercial purposes, and we do not build profiles of your shoppers. We disclose data to service providers acting on our behalf as described below. (See "Advertising attribution on our public marketing pages" and "Analytics on our website and App Store listing" below for the separate, limited measurement of how visitors and merchants find and install Replenly.)

Advertising attribution on our public marketing pages

Visitors to Replenly's public marketing pages (such as replenly.app and its guides) sometimes arrive from an online ad or marketing campaign, carrying attribution parameters in the page URL, for example a Google click identifier (gclid, gbraid, or wbraid) or standard UTM campaign parameters (utm_source, utm_medium, utm_campaign, utm_term, utm_content). When present, we forward those specific parameters, unchanged, onto the link we show for installing Replenly from the Shopify App Store, solely to measure which marketing campaigns lead visitors to the App Store listing and install funnel. Links from our pages to the App Store listing also carry our own campaign tags (for example utm_source=replenly_site) so we can tell which page and button a visitor used. When a visitor follows one of these links, the parameters are sent to Shopify as part of the App Store address.

A click identifier can be linked by the ad provider to a specific ad interaction, so we treat these parameters as potentially personal data. We do not store these attribution parameters in our merchant PostgreSQL database, attach them to a Shop or Session record, use them to profile Shopify customers, or sell them. They are read from the page address only for the purpose described above. replenly.app does not load any Google Ads or Google Analytics script and does not set any advertising cookie.

Analytics on our website and App Store listing

replenly.app is hosted by Cloudflare and uses Cloudflare Web Analytics to count page views and measure page-load performance. For each page view, Cloudflare's script reports the page path, the referring site, browser, operating system and device type, and Cloudflare reports the visitor's country. Cloudflare states that Web Analytics does not use cookies or local storage and does not fingerprint individuals by IP address or browser details. Cloudflare necessarily receives a visitor's IP address when it serves the page and the analytics request; we see only aggregated reports, not individual visitors or IP addresses.

We may also connect a Google Analytics 4 property to Replenly's Shopify App Store listing using Shopify's listing-tracking feature. When it is connected, Shopify sends that property events about visits to the listing, clicks on its install button and completed installs, together with any campaign parameters in the listing address, and Google Analytics on the listing page may use cookies or similar identifiers. Shopify documents that the install event includes the installing store's Shopify shop ID, shop name and shop URL. Google processes this data as our analytics provider. We use it only to measure how merchants find and install Replenly, not to profile your customers.

Shopify independently operates the Shopify App Store, including its own analytics and tracking on the listing page, under Shopify's own privacy policy and those of its analytics providers.

Storage and security

Data is stored in a managed PostgreSQL database. It's encrypted in transit (TLS) and at rest, and access is restricted to the systems that run the app. We don't grant broad third-party access to your shop data.

Service providers

We rely on Shopify for the platform integration and on a small number of infrastructure and delivery providers to run the app. The infrastructure and delivery providers act on our behalf and are bound by their own security and confidentiality obligations:

• Shopify: provides the commerce platform and the authentication, Admin API, and webhook services through which the app operates. Shopify also independently controls data held in its platform under Shopify's own terms and privacy policy.
• Fly.io: hosts the application servers that run the app's web and background-job processes.
• Supabase: hosts the PostgreSQL database described above, where your shop's data is stored.
• Resend: we use Resend as our transactional email delivery provider for supplier purchase orders, weekly low-stock summaries, and compliance/data-request reports. The destination email address and message contents, including any purchase-order PDF attachment and applicable order-derived operational data, are disclosed to Resend solely to deliver the email. Provider-side delivery records and retained message data are governed by Resend's terms and privacy practices and are not covered by the shop-uninstall deletion described below, which applies only to data stored in our own database.
• Tigris: provides encrypted off-site object storage where we keep the database backups described below, plus the minimal redaction metadata (hashed identifiers only, never raw order IDs or customer data) needed to make sure deleted data stays deleted if a backup is ever restored.
• Sentry (Functional Software, Inc.): provides application error monitoring and diagnostics. Replenly sends only minimized, redacted technical error and diagnostic telemetry to the EU/Germany region for this Replenly Sentry organization. The server-side integration disables default PII and request-data collection, and the organization is configured not to store IP addresses. In the authenticated embedded app, we also use privacy-first Sentry Session Replay to diagnose frontend errors: normal sessions are not sampled, while sessions containing an error may be sampled. All text and input values are masked, media is blocked, and HTTP request/response bodies, raw keystrokes, and raw user identities are not collected. Replays may contain only redacted UI structure, limited technical interaction/timing metadata, and sanitized exception stack-frame metadata needed to diagnose the error; source lines, local variables, URL origins/query strings, and arbitrary frame properties are not collected. We do not deliberately attach merchant or staff identity.
• Cloudflare: hosts the replenly.app website and provides the Web Analytics described above. It does not host the app or store your shop data.
• Google: if we connect Google Analytics 4 to our App Store listing, Google receives the listing measurement data described above, including the shop identifiers Shopify reports for installs.

None of these providers is given access to your data beyond what's necessary for the purposes described above. Sentry is limited to the diagnostic telemetry described above, is not initialized on the public marketing, terms, or privacy pages, and is not used to process your shop records.

If you connect a Slack incoming webhook, low-stock summaries (such as product titles, SKUs, quantities, supplier names and purchase order references) are also sent to the Slack workspace you chose. Slack is not a Replenly processor; you control that destination and can disconnect it in Settings.

Data retention

• We retain order-derived operational records (the Shopify order and line-item identifiers, variant IDs, quantities, and dates, with no customer names, emails, or addresses attached) for as long as they are useful for reorder forecasting. Aggregate sales records older than 90 days are automatically deleted on a nightly schedule. Before deletion, they are folded into anonymous monthly per-product totals (units sold and revenue by calendar month, with no order identifiers or customer data), which we retain to support seasonal reorder forecasting; these totals are deleted with the rest of your shop's data if you uninstall.
• Expired online staff sessions and sessions whose refresh tokens have expired are removed during the nightly retention cleanup. Valid offline sessions are retained while the installation remains active so the app can continue its Shopify integration, and all sessions are removed during shop redaction.
• Completed compliance-request metadata, including keyed redaction handles, is retained for up to 90 days for operational evidence and then removed. Raw order IDs are cleared as soon as a request is completed. The separate minimal hashed redaction fences needed to prevent replay remain retained.
• If you uninstall Replenly, all of your shop's data (products, suppliers, purchase orders, stocktakes, ingredient records, and sales aggregates) is deleted from our live systems when Shopify sends its mandatory shop/redact webhook, which Shopify normally issues about 48 hours after an app is uninstalled. When the delivery can be correlated safely to that uninstall generation, we begin the deletion promptly and drive it to completion (retried automatically until it succeeds). If Shopify's event clock is missing or invalid, we record the authenticated delivery for safe operator resolution rather than risk deleting a replacement installation. Backup copies are normally pruned after 30 days (see Backups below), and we retain only minimal redaction metadata (hashed identifiers, never the data itself) as necessary to prevent deleted data from being restored.
• You can request earlier deletion at any time by emailing vkundar@gmail.com.

Backups

We keep off-site database backups for disaster recovery and target pruning them after 30 days. Automated pruning runs nightly; if a provider or configuration failure prevents cleanup, older copies may remain until pruning succeeds and the failure is recorded for operator follow-up. Because of this, data you delete (including data removed by an uninstall or a redaction request) may persist in a backup beyond that target period. The supported restore process keeps deletion/redaction state separately from ordinary backups and reapplies that state after restoring, which is designed to prevent a restored backup from reactivating data that was already deleted or redacted. This protection depends on the deletion state having been durably recorded and on the supported restore process being used.

Shopify GDPR compliance webhooks

Replenly implements Shopify's three mandatory webhooks:

• customers/data_request: we do not extract customer personal data from Shopify orders, but we do retain the order-derived operational records described above for the specific orders named in the request. We compile those records (order/line-item IDs, variant IDs, quantities, and dates, never any customer identifier) and provide them to you, the merchant, so you can respond to your customer.
• customers/redact: we delete the order-derived operational records we hold for the orders named in the request, and keep only a hashed marker of the affected order IDs so those records can't be re-created by a late webhook delivery or a backup restore. (Raw-material stock levels already consumed by those orders are physical inventory data, not personal data, and are not altered.)
• shop/redact: triggers a purge of all data associated with the shop from our live systems, with backup copies expiring within 30 days as described above.

The two customer requests above cover the order-derived records described in this policy. They do not reach ship-to details typed on a purchase order, because those are not linked to a Shopify order; we handle them on your request as described under "What data we process". A copy already emailed to a supplier is held by that supplier, so you would need to ask them to delete it.

Billing

Subscription billing is handled entirely by Shopify's billing system. We never see or store your payment card details.

Changes to this policy

If this policy changes, we'll update the date at the top of this page. Continued use of the app after a change means you accept the updated policy.