Privacy Policy

For Stackhall Basic · Last updated October 16, 2026

This policy covers Stackhall Basic — the Shopify app that includes Product Viewer, Catalog Check, Analytics, Inventory Health and Sales Map. "We" and "us" means Stackhall, the company that makes it. "You" means the merchant who installed it. "Your customers" means the people who buy from your store.

It doesn't cover Shopify itself. Shopify has its own privacy policy, and the data we describe below is data that already lives in your Shopify admin — we only ever get a copy of it, and only the parts you gave the app permission to read.

What we store

When you open the app, it asks Shopify for a copy of three things and keeps them in our database so the reports load quickly and so we aren't hammering Shopify's API every time you click something.

1. Your store's profile

Your store name, your .myshopify.com address, your public domain, the contact email on your Shopify account, your country, currency, timezone and Shopify plan name. Plus a record of which Stackhall apps you've installed, when, and what permissions you granted.

2. Your catalogue

Products and their variants: titles, descriptions, handles, vendor, product type, tags, status, SKUs, barcodes, prices, compare-at prices, unit costs, inventory counts, weights, SEO titles and descriptions, and image addresses and alt text. Also your collections and which products are in them.

3. Your sales data

Only if you granted the orders and customers permissions. Specifically:

• Orders — the order number, the date, whether it was paid, fulfilled, cancelled or refunded, the totals (subtotal, discounts, shipping, tax, total, amount refunded), the currency, the sales channel it came from, how many items were in it, its tags, and the country, state or province, and city it shipped to.
• Order lines — which product and variant sold, its SKU, its vendor, how many, and for how much.
• Customers — numbers only. Shopify's internal ID for the customer, how many orders they've placed, how much they've spent in total, the currency, whether the account is enabled or disabled, and when it was created. That is the entire record.

What we never receive

This is the part most people actually want to know. The app does not ask Shopify for any of the following, so it cannot arrive and we could not store it even by accident:

• Customer names, email addresses or phone numbers
• Street addresses, apartment numbers or postal codes — the Sales Map knows the city and nothing narrower
• GPS coordinates or location tracking of any kind
• Credit card numbers, bank details or anything else about payments beyond the amount
• Your customers' browsing behaviour on your storefront
• Your staff members' personal details
• Anything from your other apps, or from any other store

One more limit worth knowing: by default Shopify only lets an app read orders from the last 60 days. Stackhall has asked Shopify for — and been approved to request — your full order history instead, so the permission screen you see at install (or the next time you open the app, if you installed before this changed) includes that wider access alongside the others. Approving it is what lets older orders be stored; declining it, or an install that hasn't picked up the updated permissions yet, keeps the app to the standard 60-day window until it does.

Why we store it

• Product Viewer and Catalog Check — to list your catalogue and flag products with missing images, blank SEO fields, no SKU and so on.
• Analytics — to build the reports: monthly income, top products, repeat purchase rate, average order value and the rest.
• Inventory Health — to work out what stock is sitting still and what it's worth at cost.
• Sales Map — to show which cities and countries your orders came from.
• Keeping the app working — the access token Shopify gives us, so background syncs can run when you're not looking at the app, and basic error logs so we can fix bugs.
• Knowing what to build next — counts of which pages and buttons get used, and a report when something breaks. This is about the app, not about your store: it tells us a report was opened, never what the report said.

That's the whole list. We don't use your data for anything you didn't install the app to get.

Who else can see it

We keep this list as short as we can. These are the only companies involved in running the app, and none of them is allowed to use your data for their own purposes:

Two of those deserve spelling out, because they are the ones people mean when they ask whether an app is “tracking” them. Sentry is told when the app hits an error, so we find out about bugs without waiting for you to report them. Google Analytics counts page views and button clicks, so we can see which features get used. Both watch the app being used — neither is sent your products, your orders or your customer records, and the page addresses we send to Google have Shopify's parameters (which include your store's domain and your session token) stripped off first.

And to be explicit about what isn't on that list. We do not sell or rent your data. We do not share it with advertisers, ad networks or data brokers. We run no advertising pixels and no remarketing tags. We don't use your data to train AI models, ours or anyone else's. We don't combine your store's data with another store's to build an industry benchmark or a report we sell.

The only other situation where we'd hand anything over is a valid legal order, such as a court order or a subpoena. If that ever happens we'll tell you, unless the law forbids it.

Where it's stored and how it's protected

• Your data lives in a managed PostgreSQL database in a United States or Canadian data centre, operated by DigitalOcean.
• It's encrypted while travelling over the internet (HTTPS everywhere) and encrypted at rest on disk, including in backups.
• The database isn't reachable from the public internet. Its firewall accepts connections from our own application server and nothing else.
• Your Shopify access token is never shown on a page, never written to a log, and is scrubbed from error reports automatically.
• Only pages loaded inside your Shopify admin, with a signed token from Shopify proving it's you, can see your store's data. There is no password, no separate login, and no way for a stranger to pull up your store by guessing a URL.
• Access to the production database is limited to the people who maintain the app, and used only to operate and fix it.

No system is perfect, and we won't pretend otherwise. If something happens to data belonging to your store, we'll tell you about it within 72 hours of finding out, along with what we know and what we're doing about it.

How long we keep it

Your choices

You're in control of all of this, and you don't have to accept all of it to use the app:

• Don't grant the orders and customers permissions. Product Viewer, Catalog Check and Inventory Health work without them. Analytics and Sales Map will simply tell you they have nothing to show instead of quietly collecting anything.
• Opt out of sales data while keeping the app. Email [email protected] and say so. We'll delete the orders and customer records we hold for your store and switch off future sales syncs, and you can carry on using the catalogue features. Ask us again later and we can switch it back on.
• Ask us to delete everything. Also an email. See below.
• Uninstall. The complete opt-out, and it needs nothing from us.

Deleting your data

Email [email protected] from the address on your Shopify account, tell us your .myshopify.com domain, and say what you want removed — everything, or just the sales data.

We'll confirm we got it, delete what you asked for within 30 days (usually much faster), and email you when it's done. Deletion means deletion: the rows are removed, not flagged as hidden, and they cycle out of backups inside the same window.

You can also ask us for a copy of what we hold about your store, and we'll send it in the same timeframe. Since the app is free, there's no billing history or invoice we're required to hang on to.

When you uninstall

• Shopify revokes our access immediately. We cannot read anything from your store from that moment on.
• We clear the stored access token straight away.
• Everything else we hold about your store is deleted within 30 days.
• If you reinstall inside that window, your synced history may still be there and the app will pick up where it left off. After it, the app starts fresh.
• Want it gone immediately instead of waiting? Email us and we'll do it.

Your customers' privacy rights

If one of your customers asks you to delete their data or send them a copy of it — under GDPR, the CCPA, or any similar law — that request goes to you, because it's your store and your relationship with them. Here's how we help:

• In most cases there's nothing of theirs here to return. We hold no names, emails, phone numbers or addresses, so we can't identify a shopper from what we store, and neither could anyone who got hold of it.
• If you forward us the request with Shopify's customer ID or the order number, we'll delete the matching customer record, its orders and its order lines from our database within 30 days and confirm it.
• Shopify also sends apps automated deletion requests on a customer's behalf, and we act on those.

The Data Protection Agreement covers this in more formal terms, if that's what your compliance process needs.

Cookies

Five, and we'll name them all:

• sessionid and csrftoken — needed for the app to work safely. One keeps your session inside Shopify admin; the other stops other websites from submitting forms as you.
• stackhall_consent — remembers your answer to the question below, so we only ask once. It holds one word, granted or denied, and nothing else.
• _ga and _ga_<id> — set by Google Analytics, which counts page views and button clicks so we can see which features get used. These are analytics cookies: they let Google recognise the same browser across visits, which is how a returning visitor is told apart from a new one.

There are no advertising cookies and nothing is sold or shared for marketing. But we're not going to call the analytics pair something softer than what they are — a cookie that recognises your browser later is a tracking cookie, whoever sets it and whatever they use it for.

On our public pages, we ask first

On our website and on the two pages you're reading now, the analytics pair is not set until you say yes. Google Analytics loads in a mode where it has no permission to store anything, a banner asks, and only an explicit Accept changes that. Reject and it stays as it was — there's no second ask, no “essential cookies” loophole, and the page works identically either way. We remember your answer for 365 days, whichever way it went, and you can change it by clearing the cookie for this site.

Inside the app, we don't yet

We'd rather tell you this than let you find it. Pages that load inside Shopify admin still set the analytics pair without asking. A consent banner inside somebody else's iframe is poor footing for a real choice, and we haven't settled on the right answer — the likely one is to run analytics there with no cookies at all, which costs us the ability to tell a returning merchant from a new one and costs you nothing. Until then: your browser's cookie controls, a content blocker, or Google's own opt-out add-on all stop the analytics pair, and every feature of the app keeps working without it.

The sessionid and csrftoken pair is not optional anywhere, because without them the app cannot tell it's really you. The two pages you're reading now set neither, having no session to keep and no form to protect.

One thing that isn't a cookie

The app notes in your browser's own storage that you've seen the welcome tour, so it runs once rather than every time you open it. It holds a version number — nothing about you, nothing about your store — and unlike a cookie it is never sent to us or to anyone else; it only ever gets read by the page you're on. Clearing this site's data forgets it, and the tour runs again.

Children

Stackhall Basic is a tool for running a business. It isn't meant for anyone under 16, and we don't knowingly collect anything from children.

Changes to this policy

If we change it we'll update the date at the top. If a change actually affects what we collect or how long we keep it, we'll also say so inside the app before it takes effect, so you can uninstall or ask us to delete your data if you don't like it. We won't start using data we already hold for a new purpose without telling you first.

Contact us

Privacy, data protection and deletion requests: [email protected]
Anything else about the app: [email protected]

We read every one of these ourselves, and we'd rather answer a question before you install than after.