ShopVitals Privacy Policy

ShopVitals — Privacy Policy

Effective date: November 6, 2026

ShopVitals ("the App") is provided by AGENDA365.COM LLC, Battle Ground, WA, USA ("we," "us"). This policy explains what data the App accesses, what it stores, and how that data is handled when a Shopify merchant installs and uses the App.

Who this policy covers

This policy covers merchants who install ShopVitals on their Shopify store. It also describes, in limited form, how information contained in a merchant's order records is treated, because one of the App's checks reads order records.

What the App accesses

The App connects to a merchant's Shopify store through Shopify's API using read-only access only. The App does not change products, orders, prices, inventory, or settings in the merchant's store.

The App reads:

  • Products and variants — titles, status, variants, and availability, used for the no-US-shipping check and the sold-out-while-listed check.
  • Orders — order identifiers, creation dates, and fulfillment status, used for the stale unfulfilled orders check.
  • Shipping and delivery settings — delivery profiles, shipping zones, and delivery estimates, used for the delivery-promise check.

The App requests only the read-only permissions needed to run these four checks.

What the App stores

The App stores the following in its own database:

  • The shop's Shopify domain (for example, your-store.myshopify.com) and the access information Shopify provides so the App can connect to that store.
  • The merchant's App settings, including the shipping-promise values the merchant sets in the App: processing time, US delivery window, and the stale-order threshold.
  • Flags raised by the checks — each flag records the product or order it relates to, the check that raised it, a plain-language explanation, and its status (open, resolved, or removed).
  • An activity log of actions taken inside the App, such as running the checks, editing settings, and resolving or reopening flags.

End-customer information

ShopVitals is a store-operations tool for merchants. It does not collect, build profiles on, or market to a merchant's end customers.

Order records read by the stale-order check may contain customer information that Shopify includes in order data. The App reads only the fields needed to determine whether an order has remained unfulfilled past the merchant's threshold. The App does not use end-customer information for advertising, does not contact end customers, and does not sell or share end-customer information.

How data is used

Stored data is used only to operate the App for the merchant who installed it:

  • Running the four store-health checks
  • Displaying flags, the health score, settings, and the activity log to the merchant
  • Providing support when the merchant contacts us

What we do not do

  • We do not sell personal data or store data.
  • We do not share merchant or end-customer data with third parties for their own marketing.
  • We do not use store data to train advertising or profiling systems.
  • We do not write to or modify the merchant's store through the API.

Data is shared only with the service providers needed to run the App (such as hosting and database providers), who process it on our behalf, and where disclosure is required by law.

Shopify privacy webhooks

The App honors Shopify's mandatory compliance webhooks:

  • Customer data request (customers/data_request) — If a merchant receives a data request from a customer and Shopify notifies us, we will provide the merchant with any data the App holds that relates to that customer, where such data exists. Because the App does not build customer records, in most cases the App will hold no customer-specific data to provide.
  • Customer redact (customers/redact) — When Shopify notifies us to erase data relating to a customer, we delete any App-held data that relates to that customer, where such data exists.
  • Shop redact (shop/redact) — When Shopify notifies us after an uninstall, we delete the shop's stored data from the App's database as described below.

We respond to these webhooks in accordance with Shopify's required timelines.

Data retention and deletion

  • While the App is installed, the App retains the shop's settings, flags, and activity log so the merchant can use them.
  • When a merchant uninstalls the App, the shop's access is revoked by Shopify. The App deletes the shop's stored settings, flags, and activity log in connection with the uninstall and Shopify's shop/redact process, except where retention is required by law or for legitimate record-keeping such as billing records held by Shopify.
  • A merchant may also request deletion of their shop's data at any time by contacting us at the email address below. We will delete the data, subject to any legal retention requirements, and confirm when deletion is complete.

Security

We use reasonable administrative and technical safeguards appropriate to the nature of the data, including access controls on the App's database and encrypted connections (HTTPS) for data in transit. No system is completely secure, and we cannot guarantee absolute security.

Changes to this policy

If we make material changes to this policy, we will update this document and revise the effective date. Continued use of the App after a change takes effect constitutes acceptance of the updated policy.

Contact

Questions about this policy or requests relating to your data:

AGENDA365.COM LLC Battle Ground, WA, USA Email: agenda365.com@gmail.com