Privacy Policy — Taylored Labs

Draft for review before publication. Effective date: to be set on publication.

Taylored Labs ("we", "us") builds apps for Shopify merchants. This policy explains what personal data our apps handle, why, and what rights you and your customers have. Each app has an appendix stating exactly what it stores.

Who we are

Taylored Labs, [legal entity name and address to be inserted]. Contact: support@tayloredlabs.com.

What we process and why

We process data only to provide the app you installed. Our apps access your Shopify store through the permissions you grant at install, and they connect to third-party services you choose to connect (for example QuickBooks Online). We do not sell personal data, and we do not use it for advertising or profiling.

Merchant data

We store your store's domain, the settings you choose in the app, the connection to services you link, and operational logs describing what the app did. Connection credentials (such as OAuth tokens) are encrypted at rest.

Your customers' data

Some apps handle order data that includes your customers' names, email addresses and addresses because the app's purpose requires it (for example, posting an order to your accounting system). We keep only what the purpose needs, for as long as it is needed, and we never contact your customers.

Retention and deletion

• Operational logs are retained for the period stated in the app's appendix.
• When you uninstall an app, external credentials are deleted immediately and all remaining data for your store is deleted within 48 hours.
• We honour Shopify's customer data request, customer redaction and shop redaction webhooks: data requests are answered to the merchant within 30 days, and redaction requests are applied within 30 days.

Security

Data is encrypted in transit (TLS) and at rest. Access is limited to the people who operate the service, and access to production systems requires multi-factor authentication. We keep a security incident response process and will notify affected merchants without undue delay if a breach affects their data.

Sub-processors

We host on Fly.io (application and database) and send transactional email through Postmark. Apps that connect to accounting systems exchange data with that provider (Intuit QuickBooks Online) at your instruction.

Your rights

Depending on where you are, you may have the right to access, correct, delete or export personal data we hold, or to object to its processing. Contact support@tayloredlabs.com and we will respond within 30 days. Merchants remain the controller of their customers' data; we act as a processor on the merchant's instructions.

Changes

We will post changes here and, for material changes, notify installed merchants by email.

Appendix A — Ledgerline for QuickBooks

• Reads from Shopify: orders and refunds (including customer name, email and addresses on the order), products and variants (SKU), customers (email, for optional matching), locations.
• Sends to QuickBooks Online: sales receipts and refund receipts containing line items, amounts, tax, the customer's email and billing/shipping address as shown on the Shopify order.
• Stores: QuickBooks OAuth tokens (encrypted), a sync log per order and refund (order number, totals, QuickBooks transaction id, status and error text), item and account mappings, webhook payloads for up to 30 days for replay and debugging.
• Retention: sync log for 90 days on Starter and 13 months on Growth and Scale; webhook payloads 30 days; everything deleted within 48 hours of uninstall.