RESTOCKER Privacy Policy

Last updated: August 10, 2026

This policy explains how RESTOCKER collects, uses, stores, and discloses information when a merchant installs or uses the RESTOCKER Shopify app.

Information we collect

• The merchant's Shopify shop domain, used to identify and isolate the store's account.
• An offline Shopify access token, encrypted at rest, used to access inventory and product information needed to provide the service.
• Inventory monitoring state, including inventory item identifiers, stock levels, configured thresholds, and alert history.
• Email addresses supplied by the merchant as alert recipients.
• Operational logs needed to secure, diagnose, and maintain the service.

RESTOCKER does not intentionally collect customer names, customer email addresses, payment-card information, or order details.

How we use information

We process this information only to authenticate the installed shop, monitor inventory, deliver low-stock and out-of-stock alerts, prevent duplicate alerts, provide support, protect the service, and meet legal obligations.

Storage, security, and service providers

RESTOCKER is hosted using Amazon Web Services in the EU (Frankfurt) region. Data is encrypted in transit. Shopify access tokens are additionally encrypted at rest using AWS Key Management Service. We use AWS services, including DynamoDB, Lambda, SQS, CloudWatch, and Simple Email Service, as infrastructure processors. Shopify processes app installation, authentication, and billing information under Shopify's own terms and privacy policy.

Retention

Store settings and the encrypted access token are retained while the app is installed. Monitoring state expires after approximately 90 days and alert-history records expire after approximately 30 days. When Shopify notifies us that the app has been uninstalled or the shop must be deleted, we delete the store's tenant data. Limited security or operational logs can remain for a reasonable period as required for service integrity or legal compliance.

Sharing and international transfers

We do not sell merchant information. We disclose it only to the infrastructure providers described above, when instructed by the merchant, or when required by law. Some providers can process information outside the merchant's country under appropriate contractual and legal safeguards.

Your choices and rights

Merchants can update alert-recipient addresses and monitoring settings in the app. Uninstalling RESTOCKER stops monitoring and triggers deletion of tenant data. Depending on applicable law, a merchant may request access, correction, deletion, restriction, or portability of personal information, or object to certain processing.

Contact

For privacy questions or requests, email nick@ab-it.io. We may need to verify the requesting store before fulfilling a request.

Changes

We may update this policy when the service or legal requirements change. The date above identifies the latest version.