Privacy policy
FeedForge: Supplier Sync ("FeedForge", "the app") is a Shopify app operated by NexLab ("we", "us"). It imports product feeds from a merchant's suppliers and updates that merchant's own Shopify catalog and inventory. This policy explains what the app stores, why, for how long, and how it is deleted.
The short version
- The app works with catalog and inventory data only. It has no permission to read customers or orders, and it never does.
- We use your data only to run the imports you configure. We do not sell it, share it for advertising, or use it to train models.
- When you uninstall the app, Shopify asks us 48 hours later to erase your shop's data, and we delete all of it.
Information the app stores
| Data | Why | Kept |
|---|---|---|
| Your shop's domain, plan and install dates | To identify your installation and apply your plan's limits | Until your shop's data is erased |
| Shopify access tokens, encrypted at rest | To read and update your catalog and inventory on your behalf | Deleted on uninstall |
| Your import profiles: feed source settings, field mapping, rules, schedules and write policy | To run the imports you set up | Until you delete the profile or your shop's data is erased |
| Supplier connection credentials (for example FTP/SFTP passwords), encrypted at rest | To download your supplier feeds | Until you remove them or your shop's data is erased |
| Supplier feed files and the rows parsed from them | To plan and apply an import, and to show previews | Parsed rows 7 days; a small preview sample while the profile exists |
| A copy of your products' and variants' identifiers and the values the app manages (for example SKU, barcode, price, inventory) | To match feed rows to your products and to detect what changed | Refreshed nightly; until your shop's data is erased |
| Import history: each change's before and after value, and errors | So you can review, download and undo imports | 90 days |
Supplier feeds are files your suppliers produce. If a supplier includes other information in a feed (for example a contact column), the app stores it only as part of that feed's rows, for the retention above, and does not use it. The app keeps no customer or order data and sets no cookies or tracking pixels. Application logs record technical events (for example a run's id and a row number), never the contents of feed rows.
Where the data is stored
The app and its database run on servers of Hetzner Online GmbH in Germany (EU). Backups are encrypted before they leave the server. Access is limited to the operator, over encrypted connections.
Who else receives data
- Shopify: the app reads and writes your catalog and inventory through Shopify's APIs, and Shopify handles billing for paid plans.
- Your suppliers' servers: the app connects to the feed locations you configure, in order to download your feeds.
- Hetzner: hosts the servers and backups, as described above.
We share nothing else, except where the law requires it.
Uninstalling and deletion
When you uninstall the app, it immediately deletes your shop's access tokens and stops all scheduled imports. Your profiles and history are kept briefly so that a reinstall can pick up where you left off. Shopify then sends a data-erasure request 48 hours after uninstall (shop/redact), and the app permanently deletes all of your shop's data: profiles, credentials, feeds, product copies and history. Encrypted backups containing it expire within 30 days.
Because the app never holds customer data, Shopify's customer data requests (customers/data_request, customers/redact) find nothing to report or delete.
Your rights
For merchants in the EU/EEA and the UK, we process this data on your behalf as a processor, and you remain the controller of your store's data. You can ask us to access, correct or delete it at any time by writing to the address below. You can also delete profiles and their data in the app, or erase everything by uninstalling it.
Changes
If this policy changes, the date at the top of this page changes with it.
Contact
NexLab — privacy@supplier-feed.com