Privacy and data

What we read

With your permission, the app reads — read-only — your products and variants, inventory levels and locations, and order line items (which product sold, how many, and when). It never creates, edits, or deletes anything in your store.

What we store

• Derived metrics — per-SKU dormancy, trapped capital, ageing, velocity, and the recommended action.
• Short-lived sale records — for each order line, only the variant, quantity, sale date, and the Shopify order/line identifiers. These are pruned automatically after 90 days.
• Your settings — thresholds, exclusions, digest preferences, and plan.

We do not store customer personal data — no names, emails, phone numbers, addresses, or payment information. Order data is only used in aggregate, to date when a product last sold.

Retention and deletion

Raw sale records are pruned after 90 days. When you uninstall, all of your store’s data is deleted in response to Shopify’s shop/redact webhook (about 48 hours after uninstall). You can request deletion any time at support@harbourlabs.app.

Security and sub-processors

Data is stored in the United States and transmitted over TLS; Shopify access tokens are encrypted at rest. Sub-processors: Shopify, Vercel (hosting), Supabase (database), and an email provider for the optional digest.

GDPR & CCPA

Because we hold no customer personal data, Shopify’s customers/data_request and customers/redact webhooks are acknowledged with confirmation that we store no personal data for that customer. The full policy is published at deadstock.harbourlabs.app/privacy.