Privacy Policy
LandedCost Shopify app · Last updated: 2026-09-07
1. Who is responsible
This app is developed and operated by Rainline ("we"). Contact: zhang.rainlam@gmail.com.
2. What data the app processes
LandedCost is designed to process the minimum data required to operate. The current version requests read-only scopes (read_products, read_inventory, read_locations, read_orders) to synchronize product, inventory and order data for inventory costing calculations. It does not read customer names, emails, addresses, phone numbers or payment details. It processes only:
| Data | Purpose | Retention |
|---|---|---|
| Shop domain and installation/authorization timestamps | Identify the installing store and protect a new installation from delayed lifecycle events | Until shop data erasure (see §4) |
| OAuth access/refresh tokens and expiry times | Authenticate app requests through Shopify's supported session lifecycle (expiring offline tokens, refreshed via refresh_token grant) | Deleted when the current installation's uninstall event is processed |
| Granted scopes | Record of authorization (read_products, read_inventory, read_locations, read_orders) | Until shop data erasure |
| Billing subscription ID and status | Subscription state (PENDING/ACTIVE/CANCELLED/…), delivered via Shopify webhooks | Until shop data erasure |
| Product, variant and SKU data (title, type, vendor, weight) | Associate purchase order lines with real products; weight enables per-weight landed cost allocation | Until shop data erasure (see §4) |
| Inventory levels and location data | Compute current stock for reorder point calculations | Until shop data erasure (see §4) |
| Order facts (order ID, timestamps, cancellation/refund status, line-item variant, quantities, amounts) — no customer names, emails, addresses or payment details | Compute daily demand statistics for safety stock and reorder point calculations | Until shop data erasure (see §4) |
| Daily demand aggregates and ABC classification results | Statistical inputs for inventory policies (computed from order facts) | Until shop data erasure (see §4) |
| Inventory policies, formula runs and reorder suggestions | Record safety stock / reorder point calculations with full audit trail (inputs, outputs, formula version) | Until shop data erasure (see §4) |
| Purchase orders, supplier names, line items, currencies and landed cost charges | Provide the inventory costing service | Until shop data erasure (see §4) |
| Receipt quantities, receipt dates, references, notes and recorded cost totals | Record partial deliveries and preserve the cost known when a receipt was recorded | Until shop data erasure (see §4) |
| Supplier invoice numbers, kinds, statuses, cost corrections and per-receipt cost-impact records | Reconcile late invoices and credit notes against recorded costs without rewriting history | Until shop data erasure (see §4) |
| PO/charge/receipt/invoice/revision audit records and idempotency request identifiers | Explain business changes and prevent duplicate receipt or revision posting | Until shop data erasure (see §4) |
| Webhook event identifiers and processing status | Track delivery processing | Until shop data erasure |
| Pending sync/job records (job outbox) | Durable task boundaries for bulk data synchronization and recomputation | Until shop data erasure |
| Minimal lifecycle replay guard: hashed store/delivery identifiers and expiry times | Prevent a retried old event from deleting a new installation's data | 90-day expiry; expired records are removed during the next lifecycle-event processing operation |
We do not store raw webhook payloads or payment credentials. PO, receipt, invoice, revision and audit records contain the business information you enter; avoid entering customer personal data in notes. Replay-guard hashes are pseudonymous, not anonymous, and contain no raw shop domain, token or payload. Payment processing is performed by Shopify Billing.
3. Legal bases (GDPR)
- Performance of a contract (Art. 6(1)(b)) — operating the app and subscription you installed.
- Legitimate interest (Art. 6(1)(f)) — fraud/abuse prevention and service security.
- Legal obligation (Art. 6(1)(c)) — mandatory Shopify compliance webhooks.
4. Uninstall and data deletion
Shopify revokes app access when an app is uninstalled. When we process a verified uninstall event for the current installation, we remove its stored sessions. Shopify documents a shop-level erasure event 48 hours after uninstall; delivery may be delayed or retried. We validate the event's timing and installation state before deleting the remaining business data, so an old event cannot erase a new installation. Only the minimal pseudonymous replay guard described in §2 is retained after business-data erasure. If event metadata or installation state cannot be confirmed, we defer destructive processing for verification rather than claim deletion succeeded. You may request earlier deletion by contacting zhang.rainlam@gmail.com.
5. Data subject rights
To exercise access, rectification, erasure, restriction, portability, or objection rights, contact zhang.rainlam@gmail.com. You may also lodge a complaint with your supervisory authority.
6. Processors and sub-processors
| Provider | Service | Data |
|---|---|---|
| Shopify | Platform, billing, webhook delivery | Per Shopify's own terms |
| Render (Virginia, US) | Application hosting | App requests and data in §2 processed to provide the service |
| Supabase (AWS us-east-1) | Database hosting | Data in §2 |
7. International transfers
Data is processed in the United States (Render Virginia region; Supabase on AWS us-east-1). Transfers from the EEA/UK rely on Standard Contractual Clauses under each processor's Data Processing Addendum.
8. Changes
Material changes to this policy will be reflected in the "Last updated" date above and, where required, announced in-app.