1. Overview & Scope
This Privacy Policy explains how B2B Buyer Portal ("we", "our", or "us"), provided by [LEGAL_ENTITY_NAME], collects, uses, and processes information when merchant stores install and use the application within Shopify.
This application functions strictly as a B2B wholesale onboarding, application management, and credit tracking tool for Shopify merchants. We process data strictly to deliver these core functionalities on behalf of merchants.
2. Data We Collect & Process
We collect and store only the data explicitly submitted through registration forms or synchronized from Shopify:
- B2B Registration Data: Information submitted by buyers through merchant-configured onboarding forms, including full name, email address, phone number, company name, trade license / GST / VAT numbers, document attachments, and requested credit limits.
- Shopify Customer Data: Shopify customer IDs, email addresses, order summaries relevant to credit balance calculations, and customer tags assigned during the approval or rejection process.
- Merchant Account Data: Shopify store domain and staff access identifiers necessary to run the embedded administrative portal.
3. Third-Party Service Providers
To provide notification and billing services, certain data is transmitted to specific third-party providers:
- Twilio: Used for sending transactional WhatsApp notifications to buyers regarding application status updates.
- Resend: Used for dispatching transactional email notifications regarding application reviews, approvals, or rejections.
- Shopify: All application subscription charges and merchant billing are handled directly through Shopify's Billing API. We do not collect or store credit card or payment gateway details.
4. Data Retention
We retain wholesale customer application records and associated files for [DATA_RETENTION_PERIOD] or until a merchant uninstalls the app or submits a deletion request.
5. Mandatory Shopify Webhooks & GDPR Compliance
We strictly support and process Shopify's mandatory compliance webhooks:
- customers/data_request: In response to customer data requests forwarded by Shopify, we provide all stored application records associated with that customer.
- customers/redact: In response to customer redaction requests, we delete or anonymize stored customer application submissions and attachments.
- shop/redact: In response to store redaction requests (received 48 hours following app uninstallation), we delete all database records, forms, and uploaded assets associated with that store domain.
6. Security & Contact
If you have questions about this Privacy Policy, data processing practices, or requests regarding your information, please contact us at info@magebytes.com.