ReceiveFlow — Privacy Policy

Last updated: June 11, 2026

This Privacy Policy explains what data the ReceiveFlow app ("ReceiveFlow", "we", "us") accesses, stores, and processes when you install it on your Shopify store, and the choices you have. By installing ReceiveFlow you agree to this policy.

1. Who we are

ReceiveFlow is a Shopify-embedded application that helps merchants create purchase orders, receive inbound stock on mobile and tablet devices, print product/barcode/price labels, and write received quantities back to Shopify inventory.

Contact: receiveflowapp@gmail.com

2. What data we access and store

ReceiveFlow is designed to collect the minimum data needed to operate. We do not collect, store, or process any of your customers' personal data.

Data we read from Shopify (via the APIs you authorize)

ReceiveFlow requests only these access scopes:

• read_products — to search your catalog and build purchase orders.
• read_inventory and write_inventory — to read current stock and to write back received quantities.
• read_locations — to receive stock into the correct store location.

We do not request access to orders, customers, or customer personal information, and we cannot read that data.

Data we store

We store only the following, keyed to your store's myshopify.com domain:

• Store/session information provided by Shopify during installation (shop domain, access token, and the installing staff user's name/email as supplied by Shopify's OAuth). This is used solely to authenticate the app to your store.
• Purchase order data you create in the app: PO references, supplier names, line items (product title, SKU, barcode, price, cost, ordered/received quantities), expected dates, and status.
• Receipt records: what was received and when.
• App settings: your selected label stock, currency, and cached primary location ID.

We do not store customer names, customer emails, customer addresses, order data, or payment/card data. We do not sell or share your data with third parties for advertising or marketing.

3. How we use the data

We use the data only to provide the app's functionality: creating and managing purchase orders, receiving stock, generating labels, and synchronizing received quantities back to your Shopify inventory. Server logs may record technical events (such as webhook receipt) for reliability and debugging; these do not contain customer personal data.

4. Where data is stored

App data is stored in the application's own database, scoped per store. Data is transmitted over encrypted connections (HTTPS) between your store, Shopify, and the app.

5. Data sharing and sub-processors

We use Shopify's platform APIs to read and write the data described above. We do not share your data with any third party except as required to operate the app's infrastructure (hosting/database provider) or as required by law. We never use your data to train advertising profiles and we do not sell it.

6. Data retention and deletion

• On uninstall: Shopify sends an app/uninstalled webhook; we delete the store's session/credentials.
• GDPR/privacy compliance webhooks: ReceiveFlow subscribes to Shopify's three mandatory compliance webhooks:
  • customers/data_request — we hold no customer data, so there is nothing to return.
  • customers/redact — we hold no customer data, so there is nothing to erase.
  • shop/redact (sent ~48 hours after uninstall) — we permanently delete all data we hold for that store: purchase orders (and their lines and receipts), suppliers, settings, and sessions.
• Manual deletion: you may request deletion of your store's data at any time by emailing receiveflowapp@gmail.com.

7. Your rights (GDPR / CCPA)

Because ReceiveFlow does not collect personal data about your customers, most data-subject requests will not apply to data we hold. For the limited store/staff information described above, you may request access, correction, or deletion by contacting receiveflowapp@gmail.com. We will respond within the timeframe required by applicable law.

If you are an EU/EEA or UK merchant, you act as the data controller for your store and ReceiveFlow acts as a processor for the limited data it stores on your behalf.

8. Children's data

ReceiveFlow is a business tool not directed at children and does not knowingly process children's personal data.

9. Changes to this policy

We may update this policy as the app evolves or as legal requirements change. The "Last updated" date at the top will reflect any change, and material changes will be communicated through the app or by email where appropriate.

10. Contact

Questions or data requests: receiveflowapp@gmail.com