Privacy Policy

What we collect from Shopify

When you connect a Shopify store, the Free Audit requests only Shopify's read-only product, inventory, and location permissions. It combines that evidence with publicly available storefront readiness checks.

The Free Audit does not request or use Shopify orders, sales, customer records, or customer contact fields such as names, emails, addresses, or phone numbers. Commerce Health displays evidence coverage and marks sales as unavailable rather than estimating or inferring it. A future Sales Signals enhancement, if offered, would require separate merchant consent and is not part of the Free Audit.

How we use and retain data

We use Shopify-derived catalog, inventory, and location data only to connect your store, run and present your MerchantVector audit, maintain active-service audit history, and improve the continuity of recommendations for your connected store. We retain audit reports, health snapshots, recommendation history, and inventory-location evidence only while the Shopify connection remains active.

OAuth connection states are short-lived security records. They expire after 10 minutes and cannot be used after expiration. MerchantVector keeps existing server-side OAuth validation protections, including state and Shopify callback signature checks.

Uninstalling MerchantVector

When Shopify notifies us that MerchantVector has been uninstalled, we verify the webhook signature and remove the connected store's Shopify access token, connection record, OAuth states, audit reports, Commerce Health snapshots, opportunity and recommendation history, inventory-location evidence, and related remediation records. Repeated uninstall notices are handled safely without restoring or retaining deleted Shopify-derived records.

Website analytics

We may use PostHog on public MerchantVector marketing pages to understand website visits and marketing interactions. MerchantVector does not load that browser analytics integration on authenticated workspace, audit, product, or billing screens, so those screens do not broadly transmit store or audit content through public-site analytics.

Service providers and security

MerchantVector relies on service providers to host the application, process Shopify connection requests, and operate public-site analytics where enabled. Shopify access tokens are handled server-side and are not exposed in the MerchantVector browser application. We use reasonable administrative and technical safeguards, but no internet transmission or storage system is completely secure.

Changes to this policy

We may update this policy as MerchantVector evolves. We will post the current version on this page and update the effective date when material changes are made.

Contact us

For privacy or support questions, contact us at jason@jasonkboyd.com.