Privacy Policy
Last updated 31 August 2026
BatchProof is a Shopify app that tracks inventory lots, their expiry dates, and which orders each lot shipped in, so a brand can trace a recall. This policy describes exactly what the app stores, why it needs it, and how to have it removed.
In this policy, "we" means the operator of BatchProof, contactable at batchproof@fintizan.com. "You" means the Shopify merchant who installs the app. Where the app processes personal data belonging to your customers, you are the data controller and we act as your processor.
What we store
| Data | Why |
|---|---|
| Your shop domain and a Shopify access token | To authenticate the app to your store. Required for the app to work at all. |
| Lot records you enter: lot number, SKU, product name, quantity, expiry date, received date, notes | The core function. Entered by you, not read from Shopify. |
| For each order that consumes a lot: order ID, order name, SKU, line item title, quantity, and the customer's name and email address | This is the recall trail. If a lot is recalled, it is what lets you tell each affected customer that they received it. Without the contact details, a recall notice cannot be sent. |
| The email address you set for expiry alerts, and your alert threshold | To send the expiry digest you asked for. |
| A record that your shop has used its free trial | Each shop gets one trial. This is a single row containing only your shop domain and a date. |
We do not sell your data, share it for advertising, or use it to train machine-learning models. We do not use it for any purpose other than operating BatchProof for you.
Customer personal data
The customer name and email stored against each order are read from the orders in
your Shopify store, under the read_orders permission you grant at install.
This is the only Shopify data the app reads. We do not read products, inventory,
customers, or any other resource.
We keep this data for as long as the lot allocation exists, because a recall may need to reach customers who bought a product months or years earlier. Shelf-stable goods make this a genuinely long window; that is the nature of traceability and it is the reason the data is retained rather than discarded after fulfilment.
Deleting data
We implement Shopify's mandatory privacy webhooks:
- Customer redaction. When Shopify tells us a customer has requested erasure, we blank the customer name and email on every affected order record. The allocation row itself is kept — quantities, SKU, lot, and date — so your recall history and the quantities in it stay intact and auditable, but the person is no longer identifiable from it.
- Shop redaction. 48 hours after you uninstall, Shopify asks us to erase your shop. We delete all lots, all order allocations, all unallocated lines, all processed-order records, and your alert settings.
- Uninstall. When you uninstall, we immediately delete your access token and your alert settings, so the app can no longer reach your store and stops emailing you.
One record outlives shop redaction: the single row noting that your shop already used its free trial. It contains your shop domain and a date, and no personal data. It exists so the trial cannot be claimed repeatedly by reinstalling.
To request data access or deletion outside these flows, email batchproof@fintizan.com. Shopify also forwards customer data requests to us; we respond to those directly with you, as the merchant, since you are the controller of that data.
Who else processes the data
| Provider | Role |
|---|---|
| Shopify | Source of order data; handles all billing. We never see your payment details. |
| Neon | Hosts the PostgreSQL database where the data above is stored. |
| Hostinger | Runs the application server. |
| Cloudflare | DNS for our domain, and forwarding for our support address. |
| Resend | Delivers expiry alert emails, if you enable them. Receives the alert address you configure and the contents of the digest. |
Security
All traffic is served over HTTPS. Access tokens are stored in the database and are never exposed to the browser. Every request from the app to your store is authenticated with a Shopify session token. Data is separated by shop domain on every query, so one merchant's data is not reachable from another's session.
Payments
Subscriptions are billed entirely through Shopify's billing system. We do not receive, process, or store card numbers or any other payment instrument.
Your rights
Depending on where you live, you may have rights to access, correct, export, or delete your personal data, and to object to or restrict its processing. Merchants can exercise these by emailing us. Consumers whose data appears in a merchant's recall trail should contact that merchant, who controls the data; we will assist the merchant in fulfilling the request.
Changes
If this policy changes materially, we will update the date above and, where the change affects how we handle personal data, notify merchants by email before it takes effect.
Contact
Questions, requests, or complaints: batchproof@fintizan.com.