Shelfworks

Privacy policy

This policy applies to every Shelfworks app: Backstock, Botsweep, Convertback, Editback, Flowkit, Shelfworks Labels, Mergerate and Shelfcheck ("the apps"), developed by Shelfworks ("we"). It explains what an app stores when a merchant installs it on their Shopify store, who else handles it, and how long it is kept.

What we collect

When you install an app, we receive the access token Shopify issues so the app can read and write the data its permissions describe. Depending on the app, we store:

• Store domain and settings you enter in the app (for example supplier contacts in Backstock, or an alert email address).
• Product, variant and inventory data needed for the app's features (for example purchase-order lines, catalog issues, label runs or bulk-edit history).
• For Convertback only: each paid order's id, number, totals, currency, coupon and line-item SKUs; the affiliate click ids and campaign parameters the shopper arrived with (for example awc or gclid) and the order's landing page and referrer; and the customer's Shopify customer id and a one-way SHA-256 hash of the order email. The email address itself is never stored. Click ids are kept in the shopper's browser for your attribution window and attached to the order only when the shopper has allowed marketing and the sharing of their data under your store's cookie banner (Shopify's Customer Privacy API); this needs Convertback's theme app embed, and on a store without it Convertback cannot see the shopper's choice and reads click ids from the order's landing page instead. If they decline, the order is stored and reported without click ids, landing page, referrer, customer id or email hash. Convertback never stores card details, names, phone numbers or addresses.
• For Mergerate only: Shopify sends each checkout's destination (including the customer's name and address) with every shipping-rate request. Mergerate uses it in memory to compute a keyed one-way fingerprint and stores only that fingerprint with the destination country and postcode, plus non-personal shipment details (the location the items ship from, item ids or SKUs, item count, amounts, weight and the rates returned). These rate-request records are deleted after 24 hours.
• For Flowkit only: the timers, counters and HTTP requests your Shopify Flow workflows run. A timer can carry the numeric id of the order or customer you attach to it, never names, emails or addresses. Each run is logged with a short summary and, for an HTTP request, the first 500 characters of the response.
• For Editback's paid History plans only: if you subscribe to a History plan, Editback records changes to your products' title, status, vendor, product type, tags, and each variant's price, compare-at price and SKU, with the time of each change and whether Editback or something else (the Shopify admin or another app) made it. It stores the last known values of these fields to detect changes. It does not record who made an edit (Shopify does not provide that), and it holds no customer or order data. Editback receives Shopify's product notifications for every installed store but discards them unless the store has a History plan.
• For Botsweep only: when you scan, Botsweep reads your customers' names, emails and sign-up times from Shopify to judge whether an account looks machine-made. It stores only the customer's Shopify ID, a score and the reasons (no name or email), kept while the account is flagged and for 30 days after it is closed. If you delete a customer through Botsweep, the customer's email is kept, encrypted, in your removal log for 90 days so you can download a record of what was removed. Botsweep also records which of your staff opened a screen showing customer details, and when, for one year.

We do not sell this data. We share it only as you direct:

• Convertback sends each paid order's conversion (order id, totals, currency, coupon, captured click ids, and the customer id or email hash only if you put them in the postback) to the affiliate or advertising destinations you configure, and nowhere else.
• Flowkit's "HTTP request" action sends exactly the URL, headers and body you set in your workflow (including any Shopify Flow variables you insert) to the address you choose. That destination's handling of the data is governed by its own terms, not this policy. Flowkit refuses private and internal network addresses.
• Alerts and data-request replies are emailed to you through our email delivery provider (Resend).

Service providers

• DigitalOcean hosts the apps and their database.
• Resend delivers the emails the apps send you.
• Cloudflare Web Analytics counts visits to this website (shelfworks.app, not the apps inside your Shopify admin) without cookies and without tracking you across sites.
• Sentry (error monitoring) receives technical reports when an app hits an error, and a sample of performance timings, from our servers and from the app pages in your Shopify admin. A report holds the error, the app and page it happened on, your store's myshopify domain, and the browser type. Before anything is sent, the apps strip cookies, request and response bodies, request headers other than the browser type, URL query strings, database values, access tokens and email addresses, so no shopper's personal data is sent to Sentry.

How long we keep it

Data is kept while the app is installed, with these limits:

• Botsweep deletes a flagged account's record 30 days after it is closed, scan records after 90 days, removal-log entries (with the encrypted email) 90 days after the action, and its staff access log after one year.
• Convertback deletes each order record and its delivery log 90 days after the order was paid.
• Mergerate deletes rate-request records 24 hours after the request.
• Flowkit deletes run logs after 30 days, and deletes finished timers (fired, failed or cancelled, with any order or customer id attached) 30 days after they finish; timers still waiting to fire are kept until they fire. It keeps the answer it gave Shopify Flow for each action run for 3 days, so that a retried request is answered from the record instead of being run twice.
• Editback deletes recorded product changes 90 days after they happen. If a History plan ends, recording stops and the remaining history is deleted 90 days later.
• Shelfworks Labels clears a print run's label contents when its print link expires, 2 hours after printing, and deletes the run record after 90 days.

Sessions are removed when you uninstall. All remaining data for your store is deleted when Shopify sends the shop redaction request, 48 hours after uninstall, or sooner on request.

Customer data requests

We respond to Shopify's customer data request and customer redaction webhooks:

• Botsweep: on a data request, it emails the store owner the flagged-account and removal-log records it holds for that customer; on redaction, it deletes them.
• Convertback: on a data request, it emails the store owner every order record it holds for that customer (found by the orders Shopify lists, the customer id and the email hash), so you can answer the customer. On redaction, it deletes those records.
• Flowkit: on redaction, it deletes timers that carry the customer's id or one of the listed orders.
• Mergerate keeps no name, street address or customer id (only the keyed fingerprint, country, postcode and non-personal shipment details), so it has nothing to return for a customer; its records are deleted after 24 hours.
• Backstock, Editback, Shelfworks Labels and Shelfcheck store no customer data.

Contact

support@shelfworks.app

Last updated: 22 October 2026.