Privacy Policy — Taylored Labs

Draft for review before publication. Effective date: to be set on publication.

Taylored Labs ("we", "us") builds apps for Shopify merchants. This policy explains what personal data our apps handle, why, and what rights you and your customers have. Each app has an appendix stating exactly what it stores.

Who we are

Taylored Labs LLC, 809 Theresa Ave, Austin, TX 78703, United States. Contact: support@tayloredlabs.com.

What we process and why

We process data only to provide the app you installed. Our apps access your Shopify store through the permissions you grant at install, and they connect to third-party services you choose to connect (for example QuickBooks Online). We do not sell personal data, and we do not use it for advertising or profiling.

Merchant data

We store your store's domain, the settings you choose in the app, the connection to services you link, and operational logs describing what the app did. Connection credentials (such as OAuth tokens) are encrypted at rest.

Your customers' data

Some apps handle order data that includes your customers' names, email addresses and addresses because the app's purpose requires it (for example, posting an order to your accounting system). We keep only what the purpose needs, for as long as it is needed, and we never contact your customers.

Retention and deletion

• Operational logs are retained for the period stated in the app's appendix.
• When you uninstall an app, external credentials are deleted immediately and all remaining data for your store is deleted within 48 hours.
• We honour Shopify's customer data request, customer redaction and shop redaction webhooks: data requests are answered to the merchant within 30 days, and redaction requests are applied within 30 days.

Security

Data is encrypted in transit (TLS) and at rest. Access is limited to the people who operate the service, and access to production systems requires multi-factor authentication. We keep a security incident response process and will notify affected merchants without undue delay if a breach affects their data.

Sub-processors

We host on Fly.io (application and database) and send transactional email through Amazon Web Services (Amazon SES). Apps that connect to accounting systems exchange data with that provider (Intuit QuickBooks Online) at your instruction.

Your rights

Depending on where you are, you may have the right to access, correct, delete or export personal data we hold, or to object to its processing. Contact support@tayloredlabs.com and we will respond within 30 days. Merchants remain the controller of their customers' data; we act as a processor on the merchant's instructions.

Changes

We will post changes here and, for material changes, notify installed merchants by email.

Appendix A — Ledgerline for QuickBooks

• Reads from Shopify: orders and refunds (including customer name, email and addresses on the order), products and variants (SKU), customers (email, for optional matching), locations.
• Sends to QuickBooks Online: sales receipts and refund receipts containing line items, amounts, tax, the customer's email and billing/shipping address as shown on the Shopify order.
• Stores: QuickBooks OAuth tokens (encrypted), a sync log per order and refund (order number, totals, QuickBooks transaction id, status and error text), item and account mappings, webhook payloads for up to 30 days for replay and debugging.
• Retention: sync log for 90 days on Starter and 13 months on Growth and Scale; webhook payloads 30 days; everything deleted within 48 hours of uninstall.

Appendix C — Restocked

Restocked stores, for your store only:

• Locations, products and variants (titles, SKUs, prices, whether inventory is tracked, inventory policy, product status and Online Store publication).
• Inventory quantities per item and location and the history of changes to them, kept only to decide when a variant is buyable again.
• Back-in-stock sign-ups: the shopper's email address, the variant they asked about, the language of the page, whether they ticked the marketing-consent box, and the Shopify customer record created or matched for them.
• A delivery log per restock email (queued, delivered, bounced, opened, clicked) and a suppression list of addresses that bounced, complained or unsubscribed.
• The settings you choose (sender name, reply-to address, consent default, send rules, widget text) and a log of what Restocked did.

Shoppers' addresses are used only to send the restock alert they asked for. They are never sold, aggregated across stores, or emailed for anything else. Every restock email carries a one-click unsubscribe link.

Access logging: every privacy-law webhook the app processes is written to an access log with the store, the resource and the time.

Retention: sign-ups until the shopper unsubscribes, or 12 months after they were notified; delivery log 13 months; webhook payloads 30 days. Customer data requests return the shopper's sign-ups; redaction requests delete them and remove the address from the delivery log. Everything is deleted within 48 hours of uninstalling.