Privacy policy

Information the app processes

Through Shopify, we process your shop domain, authorization tokens and permissions, product and variant identifiers, titles, handles, SKUs, options, vendors, tags, and app-related metafields. We also process app subscription identifiers, plan, status, trial information and billing period information. Shopify handles subscription approval and payment; we do not receive payment card details.

Shopify authentication can provide the authorizing staff member’s identifier, name and email. App actions record an actor identifier so merchants can review who approved or published a change.

You provide supplier compatibility files, source addresses, mappings, integration credentials, custom rules, review notes and app settings. If you enable a supported email summary, the app stores the recipient address you supply. When you contact support, we receive the information included in your message.

Shopper information

The app does not request Shopify customer or order access, or use customer profiles, order histories, payment information or customer addresses. Do not upload customer or order information in supplier files or review notes.

The storefront panel requests published compatibility data for the displayed product or variant. The app does not add advertising pixels, behavioral analytics or tracking cookies. Shopify may attach customer-related parameters to a signed app proxy request; the app does not use them for fitment matching or store the proxy query string in application request logs. Network infrastructure necessarily processes request information to deliver the service.

How information is used

We use app data to authenticate your shop, validate and organize imports, run audits, explain findings, process changes you approve, display published compatibility information, provide exports, verify your plan, secure the service and respond to support requests. Imports and audits do not automatically approve or publish product changes.

We do not sell app data or use it for advertising. Supplier integrations can upload data only within the connected shop. Their API tokens do not grant approval or publishing access.

Service providers and storage

The app and its database are hosted on DigitalOcean in the United States (New York region). Shopify provides authentication, platform APIs and app billing. Data may therefore be processed outside your country. Connections you configure communicate with the supplier endpoints you specify. Support messages are handled through the email provider for our support mailbox.

Access is separated by shop. Connections use HTTPS, and saved remote-source credentials are encrypted by the app. Operational logs record request paths, response status and service errors to help maintain the service. These measures reduce risk but do not eliminate every security risk.

Retention and uninstalling

Uploaded source files and downloadable import error files expire after seven days. Imported active compatibility records remain available separately from these temporary files. Eligible audit and activity history is retained for 30 days on Starter, 180 days on Growth and 730 days on Pro. Active records and unresolved work can remain longer so that ongoing reviews and published data continue to function.

Uninstalling pauses app work, revokes supplier API tokens and deletes Shopify authentication sessions when Shopify’s uninstall notification is processed. When Shopify sends a verified shop deletion request, the app removes that shop’s stored app records, temporary files and sessions. Data already written to your Shopify products is managed within Shopify; uninstalling the app is not a rollback of those writes.

Contact us to request deletion before uninstalling or to ask about data that you supplied to support. Operational infrastructure and email systems have their own retention processes.

Your choices and requests

You can review and export app records, edit settings, pause sources, revoke supplier tokens and manage your subscription from the app. You can request access, correction or deletion of information by emailing [email protected]. Include your shop domain and the type of request, without passwords or access tokens. We may need to verify your authority over the shop before acting.

Depending on your location, you may have additional rights concerning personal information or a right to contact a data protection authority. If you are a shopper, contact the merchant whose store you visited for requests concerning that merchant’s customer or order records.

Contact and policy changes

For privacy questions about CompatLedger Fitment QA, contact [email protected]. Updates to this policy will appear on this page with a revised date.