Privacy Policy

Summary

OversellCap ("the App", "we") is a Shopify application that enforces oversell limits on product variants that continue selling when out of stock. The App stores no customer personal data. It stores only the minimum store data required to provide its functionality (described below), and deletes it when the App is uninstalled or upon Shopify's mandatory GDPR data-erasure requests.

1. What we access

Through Shopify's Admin API, and only with the store owner's authorization, the App accesses:

• Products and variants — read/write: to read and set the "continue selling when out of stock" selling policy on variants you choose to protect.
• Inventory levels — read/write: to monitor stock across your locations and to know when a limit has been reached.
• Locations — read: as part of inventory level data.
• Shop contact information (email address) — read: used solely to send you operational alerts (e.g., "a variant reached its limit") if email notifications are enabled. This is your store's contact email, not customer data.

The App does not access orders, customers, checkout data, payment data, or any customer personal information.

2. What we store

The App stores the following data on its backend (hosted on Cloudflare):

• Your shop domain (e.g., your-store.myshopify.com)
• Shopify API credentials (access token and refresh token) issued to the App so it can act on your behalf. These are used exclusively to enforce the rules you configure.
• Protection rules: for each protected variant — variant/product/inventory-item identifiers, product title, your configured oversell limit and buffer, current protection status, and the original selling policy (so it can be restored).
• Inventory snapshots for protected variants (per location, quantity available).
• Operational logs: rule events (e.g., auto-stop, resume, sync failures) and webhook delivery receipts used for de-duplication and reliability.

3. How we use it

• To enforce your oversell limits in near real time
• To display protection status in the App's dashboard
• To send you operational alerts (only if enabled)
• To debug and ensure reliability

We do not sell, share, or use this data for advertising. It is not used to train machine-learning models.

4. Sub-processors

• Cloudflare, Inc. — application hosting and database (data is processed on Cloudflare's edge network).
• Resend — transactional email delivery (only if you enable email notifications).

5. Retention and deletion

• Data is retained only while the App is installed.
• Uninstalling the App triggers immediate deletion of your store's data from our systems.
• Shopify's mandatory GDPR webhooks are implemented: customers/data_request and customers/redact respond that no customer data is stored; shop/redact erases all store data (rules, tokens, snapshots, logs).
• You may also request deletion at any time via the contact above.

6. Security

Data is transmitted over TLS and stored in Cloudflare's infrastructure with access restricted to the App's backend. API credentials are used only by the App's worker to call Shopify's API on your behalf. Access tokens are short-lived and rotated automatically.

7. Your rights

As a merchant, you can request access to, correction of, or deletion of your store's data by contacting zchu1994@gmail.com. Because the App holds no customer personal data, customer-rights requests under GDPR/CCPA regarding individuals' data are responded to by confirming no such data is stored.

8. Changes

We may update this policy; material changes will be reflected in the App's listing or notified in-app.