Privacy Policy

1. About this policy

This Privacy Policy explains how Brand WebApps LLC, the company that provides Replenor ("Replenor," "we," "us," or "our"), collects, uses, discloses, retains, and protects personal information when merchants install or use the Replenor application and related services (the "Service").

Replenor helps Shopify merchants manage products, inventory, suppliers, forecasting, purchase orders, fulfillment, dropshipping, and receiving workflows. When we process a merchant's customer information to provide the Service, the merchant generally determines why and how that information is processed, and Replenor acts as the merchant's service provider or data processor. We act as a controller or business for information we use for our own account administration, security, billing, support, and legal-compliance purposes.

This policy applies to Replenor. Shopify separately processes information under the Shopify Privacy Policy.

2. Information we collect

Information received from Shopify

After a merchant installs and authorizes Replenor, we receive only the Shopify information permitted by the merchant and approved access scopes. Depending on enabled features, this can include:

• Store and account information: Shopify store ID, store domain, installation and authorization details, granted scopes, and authorized merchant or staff identifiers and contact information.
• Catalog and inventory information: products, variants, SKUs, barcodes, vendor information, product media, prices and costs, inventory items, inventory quantities, and locations.
• Order and fulfillment information: order identifiers, dates, line items, quantities, financial and fulfillment status, notes, totals, currency, sales channel, fulfillment assignments, tracking information, and related operational records.
• Protected customer information: customer identifiers, names, email addresses, phone numbers, order history or order count, and billing and shipping names and addresses. We process these fields only when needed for authorized order-management, fulfillment, dropshipping, or receiving functions.
• Shopify events: webhook events needed to synchronize authorized product, inventory, order, fulfillment, installation, and privacy-request changes.

Information provided by merchants and authorized users

We collect information that merchants or their authorized users enter into the Service, such as team-member information, suppliers and supplier contacts, purchasing settings, forecast filters, purchase orders, product mappings, receiving records, printer configuration, tracking details, support communications, and subscription or billing status.

Technical information

We may collect limited technical and security information generated when the Service is used, such as authentication and session records, timestamps, request and error logs, device or browser information, IP address, feature activity, and audit records. We use essential cookies or similar technologies for authentication, session continuity, security, and application functionality. Replenor does not use merchant or customer information for third-party behavioral advertising.

Information collected directly from merchant customers

Replenor is an administrative operations application and does not independently ask a merchant's customers to create Replenor accounts or submit information directly to us. We receive customer information through Shopify or through a merchant's authorized use of the Service. The merchant's own privacy policy governs the merchant's collection and use of customer information.

3. How we use information

We use information to:

• provide, operate, maintain, secure, and troubleshoot the Service;
• authenticate merchants and authorized staff and enforce role-based access;
• synchronize authorized Shopify catalog, inventory, location, order, and fulfillment data;
• generate inventory forecasts and reorder recommendations selected and reviewed by merchant users;
• create and manage draft purchase orders, supplier workflows, fulfillment, dropshipping, tracking, receiving, and label-printing operations;
• provide support and service-related notices;
• administer subscriptions and verify access to paid or approved plans;
• detect, prevent, and investigate fraud, abuse, security incidents, and technical problems;
• respond to privacy requests and comply with law, legal process, and Shopify platform requirements; and
• create aggregated or de-identified information that does not reasonably identify an individual.

We limit our use of Shopify personal information to the purposes disclosed here and the merchant's documented instructions. We do not use Shopify customer data to build advertising profiles or for purposes unrelated to providing Replenor.

4. Forecasting and automated processing

Replenor analyzes inventory levels, order demand, incoming inventory, open purchase orders, and merchant-selected planning settings to produce reorder recommendations. These recommendations support merchant inventory decisions; an authorized merchant user reviews the information and decides whether to create, approve, or place a purchase order. Replenor does not use customer personal information to make decisions that produce legal or similarly significant effects on individual customers.

5. When we disclose information

We may disclose information only as needed for the purposes described above:

• To the merchant and authorized users: within the merchant's Replenor workspace according to assigned roles.
• To Shopify: when communicating through Shopify APIs, webhooks, authentication, billing, and app-review or compliance processes.
• To service providers: including cloud hosting, database, backup, monitoring, identity, security, and email-delivery providers that process information for us under contractual restrictions. Replenor currently uses Microsoft Azure for core application hosting and data storage.
• For legal and safety reasons: when we reasonably believe disclosure is required by law, legal process, or to protect the rights, safety, and security of Replenor, merchants, customers, or others.
• For a business transaction: in connection with a merger, acquisition, financing, reorganization, or sale of assets, subject to appropriate confidentiality and data-protection safeguards.

We do not sell personal information. We do not share personal information for cross-context behavioral advertising or targeted advertising. We do not disclose Shopify customer data to data brokers.

6. Data retention and deletion

We keep personal information only for as long as necessary to provide the Service, fulfill the merchant's instructions, maintain security and auditability, resolve disputes, enforce agreements, and meet legal obligations.

• Active merchant workspace information is generally retained while the merchant uses Replenor and for only as long afterward as required for deletion, security, billing, or legal purposes.
• Sensitive Shopify compliance-webhook payloads are encrypted while pending and cleared after processing.
• Customer-data export results generated in response to Shopify's customers/data_request webhook expire after 30 days.
• When Shopify sends a customers/redact request, Replenor deletes or irreversibly redacts the applicable customer information and prevents a later synchronization from restoring that personal information, except where retention is legally required.
• After an app uninstall, Shopify normally sends a shop/redact request 48 hours later. Replenor then erases the merchant workspace and associated personal information, retaining only a non-reversible record needed to demonstrate completion.
• Encrypted backups may retain deleted information for a limited period under our hosting provider's backup lifecycle. Backup copies are isolated from ordinary use and are overwritten or expire according to the applicable backup schedule.

We complete Shopify privacy requests within the period required by Shopify and applicable law, generally no later than 30 days after receipt unless the law requires us to retain particular information.

7. Security

We use administrative, technical, and organizational safeguards designed to protect personal information. These include encryption in transit and at rest, encrypted backups, environment separation, role-based and least-privilege access, authentication controls, protected credentials, access and audit logging, monitoring, data-loss prevention practices, and incident-response procedures. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

8. International data transfers

Replenor's core systems are hosted in the United States. We and our service providers may process information in countries other than the country where the merchant or customer is located. Where required, we use legally recognized transfer mechanisms and contractual protections for international transfers of personal information.

9. Privacy rights and requests

Depending on applicable law, individuals may have rights to access, correct, delete, restrict, object to, or obtain a copy of their personal information, and to appeal or complain about certain privacy decisions.

Merchant customers should contact the Shopify merchant from whom they purchased. The merchant is best positioned to verify the request and submit it through Shopify. Replenor receives and supports Shopify's mandatory customers/data_request, customers/redact, and shop/redact processes.

Merchants and Replenor account users can submit a request using the contact details below. We may need to verify identity and authority before responding. We will not discriminate against an individual for exercising an applicable privacy right.

10. Children's privacy

Replenor is a business operations service intended for merchants and their authorized personnel. It is not directed to children, and we do not knowingly collect personal information directly from children through a Replenor account.

11. Changes to this policy

We may update this Privacy Policy to reflect changes to the Service, our practices, or applicable requirements. We will post the updated policy with a revised "Last updated" date and provide additional notice when required by law.

12. Contact us

Questions, complaints, or privacy requests may be sent to: