Privacy Policy

This Privacy Policy describes how Trade Account Checkout ("the App", "we", "our") collects, uses, and shares information when a Shopify merchant installs and uses the App on their store.

1. Who we are

The App is operated by KOL DEALS LTD ("we", "us"). You can reach us at support@tradeaccount.app.

2. Information we collect

When a merchant installs the App, Shopify provides us with:

• The merchant's shop domain (e.g. example.myshopify.com)
• An OAuth access token scoped to write_orders
• The shop's billing subscription status

When orders are placed through the App's checkout extension, Shopify sends us an orders/create webhook containing the order ID, the shop domain, and the order's note attributes (including the account number the customer entered at checkout). The payload also contains customer information (name, email, shipping address) which we do not read, store, or process — we only extract the order ID, shop domain, and the merchant-configured account-number note attribute.

We do not collect:

• Customer names, emails, phone numbers, or addresses
• Payment card information
• Browsing or behavioural analytics
• Any data from stores that have not installed the App

3. How we use information

We use the information we collect to:

• Authenticate API requests to the merchant's Shopify store
• Tag orders that used a trade-account payment method
• Write the account number to an order metafield for the merchant's reporting
• Count orders per billing period to enforce subscription limits
• Send the merchant transactional emails about their subscription

4. How we share information

We do not sell or rent any data. We share data only with:

• Shopify — to authenticate requests, write metafields, and process subscription billing.
• Fly.io — our hosting provider, which stores the App's database encrypted at rest in the US.

We do not use third-party analytics, advertising networks, or tracking pixels.

5. Data retention

We retain shop-identified records (shop domain, configuration, monthly order counts) for the lifetime of the merchant's subscription. When the App is uninstalled, Shopify fires the shop/redact webhook 48 hours later and we delete every row keyed by the shop domain within that window, including:

• The shop's saved configuration
• All discovered payment methods
• All recorded order-usage counts
• The OAuth session

6. GDPR / CCPA mandatory webhooks

We comply with Shopify's mandatory privacy webhooks:

• customers/data_request — logged. We respond directly to the merchant if any customer-identified data is implicated. In practice this is never the case because we do not store customer data.
• customers/redact — no-op. We do not store customer-identified data.
• shop/redact — wipes all shop-keyed rows from our database.

7. International transfers

The App's database is hosted in the United States via Fly.io. By installing the App, you consent to your shop data being processed in the United States.

8. Your rights

If you are a merchant who has installed the App, you can at any time:

• Export your shop's data by emailing support@tradeaccount.app
• Delete your shop's data by uninstalling the App (deletion completes within 48 hours via Shopify's shop/redact webhook)
• Request immediate deletion by emailing the address above

9. Changes

We may update this policy from time to time. Material changes will be posted to this page with an updated "Last updated" date.

10. Contact

Questions about this policy can be sent to support@tradeaccount.app.