Privacy Policy for StockMeld

1. Overview

StockMeld ("we", "our", or "the App") is a Shopify shared inventory middleware application designed to help merchants synchronize available inventory across multiple listings sharing the same physical stock.

2. Data We Collect and Why

StockMeld is built on the principle of minimal data collection. We only access and process the data strictly necessary to provide inventory synchronization:

• Shop Information: Shop domain and offline access tokens to authenticate API calls with Shopify.
• Product & Inventory Data: Product IDs, Variant IDs, Inventory Item IDs, Location IDs, SKUs, and available quantities to mirror stock across linked listings.
• Inventory Update Webhooks: Webhook payload timestamps and inventory levels to trigger event-driven updates.

Protected Customer Data: StockMeld does NOT collect, store, or process personal customer data, buyer names, shipping addresses, payment details, or individual customer emails.

3. Data Retention and GDPR Compliance

We retain store-specific pool configurations and sync audit logs while the App is installed. When the App is uninstalled, synchronization stops immediately and stored Shopify sessions are deleted. Remaining app configuration and audit records are retained only until Shopify sends the mandatory shop/redact request, at which point the shop record and its related data are deleted.

• App Uninstall: The app/uninstalled webhook marks the shop inactive, deletes stored Shopify sessions, and prevents queued jobs from performing further synchronization.
• Queue and Echo Metadata: Inventory jobs may remain in the Redis-backed queue while processing or retrying. Completed jobs are retained for no more than 24 hours and failed jobs for no more than 30 days, subject to lower count limits. Short-lived inventory-write fingerprints contain internal shop, item, location, and quantity identifiers, expire after 60 seconds, and are actively scanned for deletion when Shopify sends shop/redact.
• Webhook Deduplication: Processed webhook identifiers and their shop domain are retained for up to 30 days to prevent duplicate processing, then automatically deleted.
• Shop Redaction: The mandatory shop/redact webhook permanently deletes the shop record, pool configuration, audit logs, dead-letter records, sessions, and webhook deduplication records.
• GDPR Mandatory Webhooks: StockMeld authenticates and handles Shopify's mandatory Customer Data Request, Customer Redact, and Shop Redact webhooks. Because StockMeld does not store buyer or order records, the customer-specific handlers do not alter inventory audit identifiers.

4. Data Security

Data in transit is protected using TLS/HTTPS. The repository's production deployment configuration places database and queue services on an internal container network; every production release is gated on verifying that these controls are active in the deployed environment.

5. Contact Us

If you have questions about this Privacy Policy or your data, please contact our support team at:
Email: support@stocktwin.app