Privacy policy

What we read from Shopify

We request read-only store-data permissions: read_products, read_inventory, read_orders, read_all_orders, read_locations and read_returns. These permissions let us read store data, not change your orders or inventory.

We read your shop identifier, domain, shop email, time zone and currency; product and variant identifiers, titles and SKUs; inventory quantities, unit costs, locations and availability history.

For orders, we request identifiers, processing and update dates, cancellation dates, test and edited flags, sales channel and app, currency, financial status, totals, discounts, SKU line quantities and prices. Refund and return facts include identifiers, dates, statuses, quantities, amounts, taxes and restocking information. Our order queries do not request customer names, email addresses, phone numbers or postal addresses. The shop email is separate from customer contact details. Shopify's install screen lists customer device and activity data (such as IP address and browser) because the orders permission can reach it; our queries do not request those fields.

What you give us and how we use it

We keep your account email and, for a standalone account, a password hash. You may enter supplier facts such as lead times, minimum quantities and case packs; purchase orders and receipts; planning decisions; and uploaded sales, inventory or order-rule files. Optional survey answers cover your current planning tool, renewal month and annual spend band. You can skip the survey.

We use these facts to provide demand forecasts and reorder proposals, save your reports and purchase orders, manage your account and subscription, and send account and operational emails. We also keep account-owned installation, connection, first-plan, order-day and subscription milestones to understand the setup and reorder workflow.

Raw uploads are processed in memory and never stored. Merchant data is never used to train models.

We do not sell merchant data.

Cookies, trackers and advertising

The public website sets no cookies. The standalone Replenwise app uses only a sign-in cookie named SESSION. It can persist between browser sessions; the signed-in session expires after 90 idle days. The cookie is HttpOnly, Secure on the hosted app and SameSite=Lax. Embedded Shopify access uses Shopify session tokens rather than a Replenwise sign-in cookie.

The app also saves your theme and supplier-view preferences in your browser's local storage.

We use no third-party trackers or advertising. Account-owned workflow milestones stay in Replenwise; they are not sent to an external analytics service. Billing providers handle their own checkout services.

Service providers

• Google Cloud Platform (GCP) hosts the application and database in us-central1.
• Cloudflare Pages hosts this public website.
• Fastmail sends account verification, password-reset and operational emails.
• Shopify provides the store connection and bills subscriptions installed through Shopify.

Retention and deletion

Saved data: Reports, runs and purchase orders stay until account deletion. For Shopify installs, uninstalling also deletes the account and its reports: Shopify requests erasure through shop/redact 48 hours after uninstall, and we then delete the account. Download your data before you uninstall. Disconnecting Shopify or uninstalling the app deletes synced Shopify data immediately. Daily Shopify availability history older than 468 days is removed during cleanup.

Subscription cancellation: Canceling alone does not delete your account. Paid access ends when cancellation takes effect; saved data remains available to download subject to the Shopify deletion and history limits above.

Account deletion: Access ends immediately. Live account data and reports are purged within 24 hours, even if billing cancellation is still pending.

Billing on deletion: We request immediate subscription cancellation. If billing is unavailable, cleanup retries every 6 hours. Only detached Paddle customer and subscription IDs and cancellation retry details remain in Replenwise until cancellation succeeds; cleanup then removes them. These records are separate from your merchant data and have no fixed expiry while cancellation is pending.

Encrypted backups: Copies can remain until the last backup containing your data rotates out of the 7 retained successful daily backups: normally up to 7 days after purge (up to 8 days after your deletion request). Failed or missed backups can extend this; 7 backups is not a strict 7-day bound. Database recovery logs and the final backup taken when the database is deleted are retained for 7 days.

The homepage also publishes our cancellation and deletion timeline.

Your choices and privacy requests

While your account is active, use Download my data in Account, at /account/export, to download your account archive. You can also delete your account from Account. Download what you need before deleting or uninstalling.

For privacy questions or GDPR/CCPA access, correction or deletion requests, email hello@replenwise.app.

We honour Shopify's customers/data_request and customers/redact webhooks. Data requests return the requested order facts we hold, with no customer contact data. Redaction removes the requested orders from synced facts and records their identifiers as hashes to prevent them from being imported again.

Changes to this policy

Changes are posted on this page with an updated effective date.