Privacy Policy — Wrightloop Stock

Last updated: September 25, 2026

Who we are

Wrightloop Stock is a Shopify application developed and operated by Wrightloop (Thomas Poinçot, micro-entrepreneur, France). Wrightloop Stock helps merchants manage inventory replenishment by generating restock suggestions based on sales velocity.

If you have any questions about this policy or how we handle data, contact us at support@getwrightloop.com

What data we collect

We collect only the minimum data necessary to provide the app's core function: calculating inventory velocity and generating restock suggestions.

From your Shopify store, via the Shopify Admin API:

• Store domain (yourstore.myshopify.com)
• Product catalog data: SKUs, product names, variant identifiers
• Inventory levels by location
• Order line item data: SKU, quantity ordered, and order date — we do not access, store, or process customer names, email addresses, phone numbers, or shipping/billing addresses

Data you enter directly into the app:

• Supplier information you configure (name, contact email, lead time)
• Product settings you configure (safety stock thresholds, minimum/maximum stock levels, unit costs)
• Alert preferences (an email address and/or Slack webhook URL you provide, used solely to send you low-stock notifications)

Technical data:

• Your Shopify access token (stored encrypted, used only to authenticate API requests to your own store)

How we use this data

We use the data described above exclusively to:

• Calculate sales velocity and generate restock suggestions for your store
• Let you create, send, and track purchase orders to your suppliers
• Send low-stock alerts to the email address or Slack webhook you configure
• Sync inventory adjustments back to your Shopify store when you receive a purchase order

We do not use your data for advertising, do not sell or rent it to third parties, and do not use it to build profiles of your customers.

Legal basis for processing

We process store and order data on the basis of the merchant's authorization granted during app installation (contractual necessity — this data is required to provide the service you installed the app for).

Who we share data with (subprocessors)

We use the following third-party services to operate Wrightloop Stock. Each processes data only as necessary to provide their service to us:

• Shopify — the platform the app is built on and installed through
• Render — our hosting provider. It runs the app's server (API) in the United States (Ohio), and all data listed above passes through that server while the app is in use. The app's web interface is delivered through Render's content delivery network.
• Supabase — our database provider. It stores your store domain, your Shopify access tokens (encrypted), your subscription plan, your alert settings (email address and Slack webhook URL), your store locations, your suppliers, your product settings, your purchase orders to suppliers, and the restock suggestions and per-product sales totals calculated from your store's sales. Location: United States (Ohio)
• Resend — our email delivery provider, used to send low-stock alert emails and purchase order emails to suppliers. Location: United States
• Slack (optional) — if you configure a Slack webhook URL for alerts, low-stock notifications are sent to that webhook. This is entirely optional and only active if you provide a webhook URL.

We do not share your data with any other third party.

Data retention and deletion

We retain your store's configuration and order-derived data for as long as the app remains installed on your store, so that restock suggestions remain accurate and up to date.

When you uninstall Wrightloop Stock, we are notified automatically via Shopify's app/uninstalled webhook, and your access token is immediately invalidated on our end.

In compliance with Shopify's mandatory privacy webhooks:

• If you request deletion of your shop's data (shop/redact), we permanently delete your store's configuration data within 30 days.
• If a data subject request is made regarding customer data (customers/data_request or customers/redact), we will respond appropriately — noting that, as described above, we do not store customer personal data in the first place.

Security

Your Shopify access token is stored encrypted at rest. We limit data collection to the minimum required for the app's functionality, and access to our systems is restricted to the app's developer.

Your rights

Depending on your jurisdiction (including under GDPR for EU/UK merchants), you may have the right to access, correct, or request deletion of data we hold about your store. To exercise these rights, contact us at support@getwrightloop.com

International data transfers

Wrightloop Stock's data is hosted in the United States: the app's server (Render) and our database (Supabase) are located in Ohio, and emails are sent through Resend in the United States. The app's web interface is delivered through Render's content delivery network.

When personal data of individuals located in the European Economic Area or the United Kingdom is transferred to the United States, these transfers rely on appropriate safeguards provided for by the GDPR, such as the European Commission's Standard Contractual Clauses included in our providers' data processing agreements.

Changes to this policy

We may update this policy from time to time. Material changes will be reflected by an updated "Last updated" date at the top of this page. Continued use of the app after a change constitutes acceptance of the updated policy.

Contact