CommerceMemo

Policy

Privacy Policy

This page describes how CommerceMemo handles Shopify store data for the read-only daily operations report MVP.

Shopify data we access

CommerceMemo reads store orders, products, and inventory to generate merchant-facing operations reports. Customer opportunity analysis is used only if customer data access is explicitly requested and approved.

Data we store

The app stores encrypted Shopify access tokens, operational snapshots, generated reports, and basic app event logs.

AI and email providers

The MVP sends minimized structured report metrics to OpenAI for report writing, and sends report email content to the configured email provider for delivery. The app should not send unnecessary customer-identifying fields to either provider.

Merchant-provided data

Merchants can provide a report recipient email, send time, timezone, and alert thresholds. The app uses those settings only to generate and deliver the merchant's own reports.

Security and logs

Access tokens are encrypted at rest. Operational logs are used for sync, report, billing, webhook, and delivery troubleshooting and should avoid full customer-sensitive values.

Retention

Order and customer snapshots are retained for up to 90 days, reports for up to 180 days, and operational, usage, and compliance logs for up to 90 days. Expired report links are removed after 30 days. Shopify's verified deletion webhooks can remove data sooner.

What we do not do

The app does not sell customer data, use Shopify data for advertising, use merchant or customer data to train or develop AI or machine-learning models, or automatically change products, prices, inventory, orders, or customers.

After uninstall

After uninstall, the app marks the shop inactive, disables daily email delivery, stops using the Shopify access token, and follows Shopify privacy webhook requirements.