Privacy policy

CountWell is a Shopify app made by InfiWits, based in Ahmedabad, India. This policy explains what the app stores, why, who receives it and how to have it deleted. “You” means the merchant who installs CountWell and the staff who use it. Questions: [email protected].

In short

• CountWell has no access to your customers’ or orders’ data, and doesn’t store any.
• We don’t sell personal information. There is no advertising or analytics.
• Your CountWell data is deleted 48 hours after you uninstall. Encrypted backups are gone within 14 days after that.

What we store and why

• Your store. Your myshopify.com domain, currency, country, time zone, and your plan and trial dates from Shopify. Used to run the app and apply your plan.
• Access tokens. The tokens Shopify gives the app, used to read and update your store on your behalf.
• Products, stock and locations. Copied from Shopify: product and variant titles, vendors, SKUs, barcodes, costs, selling prices, stock levels, and location names and addresses. Used for purchase orders, stock counts, labels, transfers and reports.
• Records you create in the app. Purchase orders, receipts, stock counts, transfers, lost units, notes, stock history and daily stock value snapshots. Kept so you can work with them and report on them.
• Supplier details you enter or import. Name, contact person, email, phone, address, account number, terms and notes. Used on purchase orders and when you email them.
• Purchase order emails. Who each email went to (including copies), the reply-to address, subject and message, and who sent it. The reply-to address is your store email from Shopify unless you set another. We keep a copy of the PDF only until we know whether the send worked.
• Your staff. The Shopify user ID and name of staff who use the app, and their login email if Shopify says it’s verified. Names show who received, counted or resolved something, and are saved on those records. The email is used only for “Send me a copy”.
• Settings and logo. Your CountWell settings and the logo you upload for PDFs.

Your customers

CountWell does not ask Shopify for customer or order data. Its permissions cover only products, inventory, locations, inventory transfers and inventory shipments. Stock changes caused by orders reach us as quantities, with no details of the order or the buyer.

If Shopify passes us a customer’s privacy request, we have nothing about that customer to return or delete, and we don’t keep the contents of the request. If you are a customer of a store, please contact that store.

Who receives data

We use these providers to run CountWell:

• Shopify (the platform): reads and updates to your store, staff names, and your plan and billing. Billing is handled entirely by Shopify, and we never see your payment details.
• Supabase (database, United States): everything listed above.
• DigitalOcean (hosting, New York, United States): runs the app, so all of it passes through their servers. Server logs hold request paths, store domains and error messages.
• GitHub (database backups): creates our nightly backup of the whole database, encrypts it with AES-256 and stores it. GitHub stores only the encrypted file.
• Resend (email, United States): only when you use “Email to supplier”. Receives the recipients, the reply-to address, your store name, the subject and message, and the purchase order PDF. Your supplier then receives the email itself.
• Sentry (error reports, United States): your store domain, the app version, the time, the request method and path, the type of error, its message and the place in our code where it happened. We don’t send cookies, form contents, request headers or user details. A filter removes email addresses, phone numbers, tokens and names from error messages before they are sent, though an unusual name could get through. Like any web service, Sentry can see the IP address of the server or browser sending a report.

Your data is stored in the United States. InfiWits staff may access it from India to run the app and to help you when you ask. For EU and UK data moved outside the EU and UK, we rely on our providers’ Standard Contractual Clauses. We don’t sell or rent personal information to anyone, and we share it with others only if the law requires it.

Merchants who need a data processing agreement can email us at [email protected].

How long we keep it

• While CountWell is installed: until you ask us to delete it or you uninstall. Daily stock snapshots are removed after 35 days, except month-end ones, which stay until then.
• When you uninstall: we delete your access tokens and stop all background work for your store. Your other data stays for 48 hours, in case you uninstalled by accident or are reinstalling to fix something.
• If you reinstall within 48 hours: your records are all still there, and we read your stock from Shopify again.
• 48 hours after you uninstall: if you haven’t reinstalled, we delete all of your data, including products, stock, suppliers, records, staff names, settings and logo. We can’t restore it after that, so download anything you need before then.
• Record of the deletion: we keep your store’s domain and the date it was deleted for 30 days, and nothing else, so that if we ever restore a backup we can delete your data again.
• Backups: encrypted copies of the database are kept for 14 days and then deleted automatically, so your data can remain in them for up to 14 days after it is deleted. We use them only to recover from a failure.
• Error reports, server logs and email logs: these are kept by Sentry, DigitalOcean and Resend for their own retention periods. Uninstalling doesn’t remove them.

Stock, cost and transfer changes CountWell made in Shopify stay in Shopify, and emails already sent stay with whoever received them.

Requests for export or deletion

To get a copy of your data, correct it or delete it without uninstalling, email [email protected] from your store’s owner or admin address and include your myshopify.com domain. We may ask you to confirm the request, and will answer within 30 days.

GDPR and UK GDPR

For the data you put into CountWell, you decide what is stored and InfiWits handles it on your behalf. For our own running of the service, such as error reports, we rely on our legitimate interest in keeping it working.

People in the EU, EEA and UK have the right to access, correct, delete, restrict, object to and receive a copy of their personal data, and to complain to their data protection authority. Staff and supplier contacts whose details a merchant added should contact that merchant first. If you write to us instead, we will pass your request on or help as far as we can.

California (CCPA)

California residents have the right to know what personal information is held about them, and to have it corrected or deleted, without being treated differently for asking. We do not sell or share personal information as the CCPA defines those words. To make a request, email [email protected].

Cookies and tracking

CountWell sets no cookies, on this site or in the app. There is no analytics, advertising, tracking pixel or session recording.

• In the Shopify admin, you sign in with Shopify. Shopify’s admin uses its own cookies under Shopify’s privacy policy.
• The app saves two preferences in your browser’s local storage: whether scan sounds are muted, and that you dismissed a trial notice. They stay on your device.
• These pages load a font from Shopify’s servers, which can see your IP address when they do.

Security

The app is served only over HTTPS, every record is tied to its store, and backups are encrypted. No system is perfectly secure. If a breach affects your data, we will tell you without undue delay.

Children

CountWell is a tool for businesses and is not meant for anyone under 18.

Changes to this policy

If this policy changes, we will update this page and the date at the top.

Contact

InfiWits, Ahmedabad, India. [email protected]