1. What Cratebird accesses
When you install Cratebird, Shopify grants it read_products, read_inventory, write_inventory, read_locations and read_orders. It reads your products, stock levels and locations; it writes inventory only when you receive a purchase order (adding the received units at the delivery location). It reads orders only for the product variant and quantity of each line, to calculate how fast each product sells. It never requests customer names, email addresses, phone numbers, shipping or billing addresses, or any other shopper information.
2. What we store
- Your store's myshopify.com address, store name and currency, and the access token Shopify issues to the app.
- The suppliers you add (company name, order email address, lead time, currency, notes) and, for each product you map, the supplier, supplier SKU, unit cost, minimum order and case pack.
- Your purchase orders and receiving history.
- Order line quantities: order ID, order date, product variant ID and quantity sold. Nothing else from the order.
- Your settings (reorder formula, alert thresholds, digest email address) and daily digest summaries.
- Your plan. Billing is handled by Shopify; we never see your payment details.
Data is stored with Cloudflare (Workers and D1) and is encrypted in transit and at rest.
3. Emails to suppliers
By default Cratebird sends no email itself: a purchase order opens in your own email app, addressed to the supplier. Each purchase order email contains a private link to that order's PDF; the link is signed, expires after 90 days and stops working if the order is cancelled. If email delivery from the app is switched on, supplier emails and your daily digest are delivered through our email provider (Resend), which processes only the message itself.
4. How we use it
Only to run the app for you: reorder suggestions, low-stock alerts, purchase orders, receiving and the daily digest, and to apply your plan's limits. We do not sell, rent or share data with anyone, and we do not use it for advertising.
5. Retention and deletion
Order line quantities and digests are deleted after 100 days. When you uninstall Cratebird, its access token is deleted immediately, and Shopify's shop/redact request 48 hours later deletes every supplier, mapping, purchase order and order line we hold for your store. Because Cratebird holds no customer data, customers/redact and customers/data_request requests have nothing to remove or report; we still acknowledge them and can confirm this to you by email.
6. Your rights
You can ask us at any time to export or delete the data we hold for your store, wherever you are (including under the GDPR and CCPA). Email us from the address on your Shopify account and we will answer within 30 days.
7. Changes
If a future version changes what Cratebird collects, we will update this page and change the date above before that version is released.
8. Data Processing Addendum
For personal data your store processes through Cratebird, you (the merchant) are the controller and Dixon App Studio is the processor. OurShopify Apps Data Processing Addendumsets out the purposes, sub-processors (Cloudflare, Shopify and, only if email delivery is turned on, Resend), retention, security measures, breach notice and Standard Contractual Clauses, and forms part of ourTerms of Service. You accept it by installing or using Cratebird.
9. Contact
Questions about this policy: email support@dixonappstudio.com. Our studio-wide policy is at dixonappstudio.com/privacy.