Privacy Policy

Version 2.2 · Effective date: 23 October 2026

1. Introduction and who we are

This Privacy Policy explains how Satisfy & I B.V. ("we", "us") processes data in NORTHMAST (the "app"), an embedded Shopify application that turns a merchant's revenue, cost of goods, advertising cost and operating cost data into a single profit view, and that keeps the inventory, purchasing and stock count administration behind it.

Satisfy & I B.V., Kloosterpark 12, 5554 GP Valkenswaard, The Netherlands. Chamber of Commerce number: 94013195. VAT identification number: NL866603839B01. E-mail: info@northmast.app.

We are the provider of the app and the party you contract with. Questions about this policy, and requests relating to your personal data, can be sent to info@northmast.app.

NORTHMAST was formerly developed under the working name Clearboard Analytics. It is the same application, provided by the same legal entity, and this document replaces the corresponding document published under that working name.

2. Our roles: controller and processor

Which data protection role we hold depends on the data, and the difference matters for who you should address a request to.

Processor — for order data relating to the merchant's customers, for the supplier records the merchant enters, and for the contents of any file the merchant uploads as an attachment to a stock count or a supplier invoice. The merchant decides why and how that data is processed; we process it only to provide the app to that merchant. Satisfy & I B.V. acts as processor here, under the Data Processing Addendum, with the one exception in the next point.
Independent controller — for merchant and staff account data, including the business details a merchant records for use on their own documents, as well as requests submitted through our website, support correspondence, security records, our own legal and administrative records, and the billing records we keep for usage-based charges, including the Shopify order identifiers we use to count billable orders and report them to Shopify. We decide the purposes of that processing ourselves, and this Privacy Policy describes it.

3. Information we collect

Order data relating to your customers

To calculate profit, the app stores financial order data retrieved from Shopify's Admin API. Specifically:

Orders — the Shopify order identifier, creation date, processing date, cancellation date, test flag, financial status, currency, order totals, discounts, taxes, shipping revenue and the destination country code of the order.
Order line items — the Shopify line item identifier, variant identifier, SKU, quantity, price, tax amounts and a cost price snapshot.
Refunds — the Shopify refund identifier, processing date and currency.
Refund line items — the refunded quantity, subtotal and tax per line.
Refund transactions — the amount, currency, kind, status, dates and test flag of each refund transaction.
Refund duties, order adjustments and refund shipping lines belonging to those refunds.
Shipping method — the delivery option chosen at checkout: its name, and where Shopify provides them its code, its source and a carrier identifier. This describes the service that was chosen, not where the parcel went.
Payment and refund transactions — per transaction on the order: the payment gateway that processed it, the transaction type and status, whether it was a test transaction, the amount and currency, the amount as charged to the customer where that currency differs, the transaction dates, and a reference to the related transaction where Shopify provides one.
Transaction fees — only where Shopify makes fee information available for a transaction: the fee amount and currency, the fee type, the percentage rate and any fixed component, and tax charged on the fee. Shopify does not provide this for every payment provider, and where it is absent we have no fee data.

What we do not process about your customers

NORTHMAST does not request and does not store the customer name, customer e-mail address, customer telephone number, street address and house number, address line 2, postal or ZIP code, city, geolocation coordinates of your customers. None of these fields are queried from Shopify, none are stored in our database, and none appear in any export the app generates. We request no billing address at all.

From an order's shipping address we request exactly one field: the destination country code, a two-letter country code such as NL, BE or US. NORTHMAST may process and store that country code together with the order, to support the merchant's financial calculations — in particular the merchant-configured shipping-cost rules that can differ per destination country. Detailed shipping-address information such as street, house number, postal code, city or geolocation is not required for that calculation and is not requested. The country code is never used for profiling, marketing, personalisation or advertising, and is not shown per individual customer. It is stored on the order record and follows that record's lifecycle: it is deleted with the order, including when a customer's or a store's data is deleted.

There is one further narrow exception, and it exists only because Shopify requires it. When Shopify passes on a customer's request for a copy or the deletion of their data, the request contains a numeric Shopify customer identifier and the identifiers of the orders concerned. We store those identifiers with the request so that it can be answered and checked. They are pseudonymous identifiers, not contact details, and they are subject to the retention limits described below.

Special categories of personal data

The app is not designed for, and is not intended to process, special categories of personal data within the meaning of Article 9 GDPR — such as data revealing health, racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic or biometric data, or data concerning a person's sex life or sexual orientation. The app queries no field of that kind. Merchants must not knowingly supply such data to the app, including through free-text configuration fields, without a separate written agreement with us first.

Merchant and staff account data

Separately from order data, the app stores the Shopify session records that make the embedded app work. Shopify supplies these; they can include the store domain, a Shopify user identifier, first name, last name, e-mail address, locale, and flags indicating whether the user is the account owner, a collaborator, or has a verified e-mail address, together with the access token and refresh token for the store.

This is merchant and staff data, not customer data. It is used to authenticate the app against Shopify and to run synchronisations on the store's behalf.

Paid access, subscription and usage billing

NORTHMAST is a paid app, billed through Shopify. To decide whether your store may open the app, we ask Shopify whether a subscription for NORTHMAST is currently active for your store, using the identifier Shopify uses for it. Shopify collects the charge itself: we never receive or store card details, bank details or any other payment credentials, and we do not store Shopify's invoices.

Each plan includes a number of Shopify orders per billing cycle, and orders above that number are charged as additional orders at the rate of your plan. So that Shopify can charge them, we keep billing records for your store:

Subscription details Shopify provides for your store: the identifier of your subscription, which plan it is, whether it is in a trial and when that trial ends, the start and end of each billing cycle, and any plan change Shopify has scheduled.
For each billing cycle, the number of included orders, the rate per additional order and the currency of the plan that applied in that cycle.
For each Shopify order: its order identifier and order date, whether it counts towards usage or is excluded — for example as a test order or an order placed during a trial — and, for an order that counts, whether and when it was reported to Shopify and the technical outcome of that report.
For checking our records against Shopify: per billing cycle, the number of orders we reported, the usage Shopify recorded, any difference between the two and whether the cycle has been closed, and when we started tracking your subscription and when, and with what result, we last checked it with Shopify.

Your business, supplier and operational records

Beyond the Shopify data above, the app holds the administration you build up in it yourself: what you buy, from whom, at what cost, and what you have in stock. This is your own business data. We process it to provide the app to you and for no other purpose.

You can record your own business details for use on the documents the app produces: your business name, a contact e-mail address, a telephone number and a business address. You enter these yourself, and they appear on the purchase orders and other documents you generate.

You can record the suppliers you buy from. A supplier record holds the company name and your own reference code for it, and optionally the name of a contact person, an e-mail address, a telephone number, an address and your own notes. Where you fill those fields in, they are personal data about that contact person — someone who is neither our customer nor yours — and you decide what to enter. We do not obtain supplier details from any other source, do not enrich or verify them, and do not use them for anything except showing them to you and placing them on the purchase documents you generate. A supplier's details are deleted with the supplier, and when your store's data is deleted.

The remaining records are business data rather than personal data, but they are listed here so that you can see everything the app keeps for your store in one place:

Products and variants read from your Shopify store — identifiers, titles, SKUs, barcodes, options and the status Shopify reports, together with the collections a variant belongs to.
Cost prices and their history — the cost per item you enter or import, with the date each cost took effect, so that an order from three months ago can be valued at the cost that applied then.
Inventory quantities per Shopify location, and the locations themselves as Shopify reports them.
Warehouses you define yourself, including their address, and which of them is your default.
Supplier records, and the purchasing conditions you set per supplier and product — lead time, minimum order quantity, order multiple, purchase price and currency.
Purchase orders with their lines, notes, documents and full change history, from draft through ordered to received or cancelled.
Receipts and supplier returns, including corrections and reversals, and the stock movements they produce.
Stock counts: the count itself, its description and status, the counted quantities per variant and location, and any file you attach to it.
Operating costs you record yourself, such as rent, software or salaries, with their amount, currency, period and category.

Files you attach to a stock count or a supplier invoice

A file you attach to a stock count or to a supplier invoice is your own document, and we do not know what is in it. A scan or photograph of a counted sheet or of an invoice may contain personal data — the name or the handwriting of whoever counted, or the contact details printed on a supplier's invoice, for example — because you chose to upload it. Before a file becomes an attachment, the app technically processes its contents to verify that it is a supported PDF, JPEG or PNG and that it is intact: it checks the actual file type and structure, and rejects files that are unsupported, damaged or not what their name says. A supported image is re-saved in a controlled form that removes metadata such as location and camera information. This is a file check, not an antivirus or malware scan. Apart from that check, the app does not index, analyse or extract anything from the contents, and nothing in the file is used in any calculation or in checking an invoice.

A stock count and a supplier invoice can each carry one attachment: a PDF, JPEG or PNG of at most 5 MB. We store the file itself, the name you gave it, its file type and its size, linked to your store and to the count or invoice it belongs to. The file is kept in private storage: it is never publicly reachable, and it can only be opened through a short-lived link that the app issues after checking that the count or invoice belongs to your store.

Merchant configuration and advertising data

You can connect your own advertising accounts to the app. Two platforms are supported: Meta Ads and Google Ads. Each connection is optional and separate, and what we read and store differs per platform, so they are listed separately below.

Configuration you enter in the app, such as transaction fee settings, named shipping rates and language preference.
Meta Ads cost data, if you connect Meta: campaign, ad set and ad names and identifiers, date, spend, currency, impressions, clicks and click-through rate.
Google Ads cost data, if you connect Google Ads: the calendar date in the advertising account's own time zone, the campaign identifier, the campaign name, the cost, the currency, impressions and clicks. The reporting query also returns the campaign status; it is not stored and is discarded together with the rest of the response. We store no ad group, ad, keyword, search term, audience, conversion or click-through-rate data from Google Ads, and no data about the people who saw or clicked your advertisements.
The Meta connection details: the ad account identifier and name, the account currency, the Meta user identifier of the person who made the connection, the granted permissions, and the access token, which is stored encrypted and never in plain text.
The Google Ads connection details: the Google Ads customer identifier of the account you selected, the customer identifier of the manager account through which it is reached where that applies, the account name, currency and time zone, the granted scope, and the access token and refresh token, which are stored encrypted and never in plain text.

Requests submitted through our website

Our public website carries a form for merchants who want to hear from us about NORTHMAST, and we are the controller for what is submitted there. This is separate from everything else in this policy: it concerns people who are not yet using the app, and no Shopify data is involved.

We use it to read and answer the request, to judge whether the product fits the store as it works today, and to contact the sender about getting access. We do not use it for newsletters or any other marketing, and we do not share or sell it.

The legal basis is the taking of steps at the sender's request before entering into a contract. Where a request does not lead to a contract, our basis for keeping the record for the limited period below is our legitimate interest in knowing which stores approached us and what we answered.

A request is delivered to us as e-mail and is not stored in the app's database. We keep it for a maximum of 12 months after submission, unless the sender becomes a customer, or ongoing correspondence or a legal obligation means a different retention period applies to that specific record. A sender can ask us to delete their request earlier at info@northmast.app.

To deliver that e-mail we use Resend, a transactional e-mail provider, which processes the fields the application contains for the purpose of sending that one message to us. Our account with them is configured to use their European (Ireland) region. We do not claim that all processing by this provider takes place exclusively within the EEA. Apart from website application e-mail, this provider delivers only the internal billing notifications described under "Providers for our own communication"; it receives no order details and no data about a merchant's customers.

First and last name.
Work e-mail address.
The website or store domain of the store the application concerns.
Monthly order volume, as a range rather than an exact figure.
An optional message describing what the applicant would like help with.

Technical infrastructure data

Our hosting and database providers do, however, necessarily process connection metadata — such as the IP address a request comes from, timestamps, the requested path and error information — in their own infrastructure logs, because a request cannot be delivered or a database connection established without it. That processing takes place under those providers' own terms and retention periods, which we do not control. We use it only where it reaches us as part of diagnosing an operational fault.

The app keeps its own synchronisation logs, described under retention below. They record which synchronisation ran and whether it succeeded, and contain no access tokens, message contents or personal data.

4. How and why we use information

Why we process this data

To provide analytics and revenue reporting.
To read and reply to a request submitted through our website.
To calculate profit, contribution margin and cost of goods sold.
To calculate advertising cost and return on ad spend alongside Shopify data.
To keep your inventory, purchasing and stock count administration, and to work out what to reorder.
To determine whether your store's paid access to the app is currently active.
To keep the billing records for your plan, report billable orders to Shopify and answer questions about a charge.
To secure the service, including authenticating requests and verifying that messages from Shopify are genuine.
To provide support when you contact us, and to meet our legal obligations.

Why we process shipping and payment metadata

We use the shipping and payment metadata described above to calculate and explain your order economics — which costs belong to which order, and what remains as profit — and to support the shipping-cost and transaction-cost settings you configure yourself. It is not used for customer profiling, advertising, personalisation, segmentation or any form of scoring.

NORTHMAST never receives or stores payment credentials. We do not request card numbers — not even masked or truncated ones — card security codes, cardholder names, bank account or bank login details, payment account passwords, or any other payment authentication secret. What we process is transaction economics: which gateway processed a payment, what type and status the transaction had, how much it was and in which currency. That is not the payment instrument itself. We also do not process payout, settlement or bank reconciliation data, and we hold no payout history.

How billing records are used

We use these records only to report your usage to Shopify, to make sure the same order is never reported twice, to show you your plan and usage in the app, to detect and correct differences between what we reported and what Shopify recorded, and to answer questions about a charge. For each order that counts towards usage, we send Shopify one usage event containing your store's Shopify identifier, the order date, a technical reference derived from the order so that Shopify can recognise a repeated report of the same order, and a quantity of one. The event contains no customer details, no amount and no product information, and these billing records contain no customer name or contact details. Shopify calculates and collects the final charge, and its billing records are authoritative; the usage and estimated charges shown in the app are our own count. For these records we act as an independent controller, because we decide why they are kept: to bill our own service.

Legal bases for the processing we control

This section concerns only the processing for which we are an independent controller — merchant and staff account data, requests submitted through our website, support, security, administration and the billing records for usage-based charges. For customer order data, supplier records and attachment contents we act as processor, and the merchant is responsible for establishing the legal basis.

Performance of a contract, including steps taken at your request before entering into one — to give you access to the app, authenticate your store against Shopify, establish whether your paid access is active, keep the billing records for your plan and report your usage to Shopify, run synchronisations on your behalf, answer your support requests, and read and reply to a request submitted through our website. Without this processing we cannot provide the service you installed.
Compliance with a legal obligation — to meet our obligations under tax, accounting and data protection law, including responding to a supervisory authority.
Legitimate interests — to keep the service secure and operable, to detect and resolve faults, to prevent misuse and unauthorised access to another merchant's data, to keep records of what happened when something goes wrong, and to count each billable order exactly once and keep the records needed to answer a question about a charge. We have weighed these interests against your rights and limited the processing to what the service actually requires.

What we never do

We do not sell personal data.
We do not use your data, or your customers' data, for personalised advertising.
We do not carry out automated decision-making that produces legal effects or similarly significant effects on any individual.
We do not use your data for purposes unrelated to providing the service.

Shopify

Shopify is the platform the app runs on and the source of the order data described above. Shopify is not a subprocessor engaged by us: the merchant has their own direct relationship with Shopify, and Shopify determines its own processing under its own terms. We access store data through Shopify's official Admin API using the permissions the merchant granted at install.

Advertising platforms

A merchant may voluntarily connect their own Meta Ads account, their own Google Ads account, both, or neither. Every connection is started by the merchant through that platform's own official OAuth authorisation screen and never by us; it covers only accounts the merchant already has access to; and the app works without any advertising connection at all.

For Meta, the app reads advertising cost and performance data for the selected ad account using the read-only ads_read permission.

For Google Ads, the app requests a single scope, https://www.googleapis.com/auth/adwords. That is the only scope the Google Ads API offers, and it is not itself limited to reading, so what matters is what we actually do with it: we use it exclusively for read-only reporting. The app makes only search (reporting) requests — one to list the advertising accounts you can select, and one to retrieve daily cost, impressions and clicks per campaign for the account you selected. The account listing returns, for each account you already have access to, its customer identifier, name, currency, time zone, status and whether it is a manager or a test account; we keep only the details of the one account you then select, as listed above, and discard the rest. It issues no write request of any kind, and therefore does not create, change, pause or delete campaigns, advertisements, ad groups, budgets, bids, keywords, audiences, conversions or account settings.

No Shopify order data and no data about your customers is ever sent to Meta or to Google. The only thing the app sends to Google Ads is the reporting query itself, which contains an account identifier and a date range and nothing else.

A merchant can disconnect either platform at any time from the app's settings, and disconnecting one platform never touches the other. Disconnecting stops all further synchronisation from that platform and deletes the stored access credentials, the selected account details and any pending authorisation state; for Google Ads, the app also asks Google to revoke the token. Advertising cost data that was already imported is not deleted by disconnecting: it remains part of the store's reporting history for at most 24 calendar months, and is deleted earlier when the merchant asks us to delete it or when the store's data is deleted after the app is uninstalled.

Uninstalling the app, and the deletion of the store's data that follows it, removes every advertising platform connection and the advertising cost data imported for the store, as described under "Data retention and deletion".

An advertising platform connected this way is not a subprocessor engaged by us either. We read data from it on the merchant's instruction; we do not send it data to process on our behalf.

Subprocessors

A subprocessor is a provider we engage to process data on our behalf. This is a different category from Shopify, which the merchant has their own relationship with, and from an advertising platform the merchant chooses to connect. We engage the following providers:

Vercel — Application hosting and the serverless runtime that executes the app, including its scheduled jobs, and hosting of our public website and support pages. Data categories: All data processed in transit by the application: Shopify order and refund data, advertising cost data, merchant configuration, and Shopify session data. Processing context: Serverless execution and hosting infrastructure operated by Vercel, Inc., processing the application traffic and the data required to serve a request. The app's serverless functions are configured to run in Vercel's Frankfurt (Germany) region, but Vercel states that its primary processing facilities are in the United States and that data may be processed wherever Vercel or its own subprocessors operate; we do not claim that processing is limited to a single region. Contract: Vercel's Data Processing Addendum applies to the Vercel service we use for the app and forms part of our agreement with Vercel. Transfers: That Data Processing Addendum incorporates the EU Standard Contractual Clauses and the UK Addendum where these are required for a transfer.
Supabase — Managed PostgreSQL database where all application data is stored, and the private object storage that holds the files merchants attach to a stock count or a supplier invoice. Data categories: Orders, order line items, refunds and refund components, order shipping method and payment transaction metadata, advertising cost records, product and variant data, cost prices and cost history, inventory quantities and locations, warehouses, supplier records including any supplier contact details the merchant enters, purchase orders, receipts, supplier returns, stock counts, operating cost records, merchant settings and shipping rates, synchronisation logs, privacy request records, subscription and usage billing records, Shopify session records, encrypted advertising platform tokens, and the attachment files themselves, on stock counts and supplier invoices. Processing context: The primary database and the private object storage are hosted in a European Supabase project region: eu-central-1, in Frankfurt, Germany. Supabase may carry out supporting processing, such as operations and support, outside that region; we do not claim that all Supabase processing takes place exclusively within the EEA. Contract: We have concluded a Data Processing Addendum with Supabase. Transfers: That Data Processing Addendum incorporates the EU Standard Contractual Clauses where these are required for a transfer.

Providers for our own communication

For our own communication we use two further providers. Our e-mail, including support requests and other messages sent to info@northmast.app, the website requests that reach us by e-mail and the billing notifications described below, is hosted by Microsoft (Microsoft 365), which we use through GoDaddy. Resend delivers the notification e-mail for website requests, as described above. Resend also delivers the internal notifications that the app sends to our own mailbox when it detects a possible problem with the subscription and usage billing records, and a daily status overview of those records. Such a notification identifies a store by its Shopify store domain and an internal reference, and contains the billing cycle and plan, the status of the records, counts and error codes. It never contains data about a merchant's customers or the details of an order. We use these notifications only to check and correct billing, and keep them for no longer than 12 months. Resend states that it stores account data and message metadata in the United States. Resend's Data Processing Addendum, which forms part of its terms, incorporates the EU Standard Contractual Clauses, and the UK Addendum where required, for such transfers.

6. International transfers

Satisfy & I B.V. is established in the Netherlands, and the primary database is hosted in the European Union. Some of the providers named above can process data outside the European Economic Area: Vercel, which states that its primary processing facilities are in the United States; Supabase, for supporting activities such as operations and support; and Resend, as described above. Where we rely on a safeguard for such a transfer, it is named with that provider. A merchant who needs the current transfer details for a particular provider can request them at info@northmast.app.

7. Data retention and deletion

How long we keep data

Detailed order data — orders and their line items, refunds and their components, shipping method metadata, payment and refund transaction metadata and any Shopify-provided transaction fee information — is kept for at most 24 calendar months, counted from the date the order was placed: the order date Shopify records for the sale, not the date the order was imported into Shopify and not the date it was shipped. Older records are deleted automatically, and orders older than the limit can no longer be imported or re-created.

Advertising cost data and the related import records are kept for at most 24 calendar months, the same reporting period as detailed order data, and are deleted automatically after that. Disconnecting an advertising platform stops further imports but does not delete this history early; it is always deleted in full when your store's data is deleted. On a valid request we also delete the imported history of one platform separately, without touching the store's other data; a platform that is still connected must be disconnected first, because the next synchronisation would otherwise import that history again.

Synchronisation logs, which record when a sync ran and whether it succeeded, are retained for a maximum of 90 days.

When a customer asks, through Shopify, for a copy of their data, we keep the completed request, including the export we prepared, for at most 30 days after it was completed, and then delete it in full.

Files you attach to a stock count or a supplier invoice have no separate time limit: they are your own documents, and they are kept for as long as the stock count or invoice they belong to. They are removed from storage when you remove or replace the file, when you delete the draft count it belongs to, and when your store's data is deleted. A file that is rejected, or whose upload is never completed, is removed automatically. Uploaded files are not part of any database backup, so a removed or replaced file cannot be restored.

Merchant settings and shipping rates are kept for as long as the app is installed for your store, because the app needs them to calculate profit. They are deleted when your store's data is deleted.

Your business details, supplier records and operational records — products, cost prices and their history, inventory quantities, locations, warehouses, purchase orders, receipts, supplier returns, stock counts and operating costs — carry no separate time limit. They are your own administration, and the app keeps them for as long as it is installed for your store, or until you delete the record yourself. They are deleted in full when your store's data is deleted.

A request submitted through the form on our website is kept for a maximum of 12 months after it was submitted, unless the sender becomes a customer or another retention period applies as described in the section on those requests.

These billing records carry no separate time limit. They are kept for as long as the app is installed for your store, so that usage for a billing cycle can still be checked after that cycle has ended, and they are not removed by the 24-month limit for detailed order data. When a customer's data is deleted at their request, we remove the order identifier from the billing record of each order concerned, normally within one day, together with the other details that link the record to that order where they are no longer needed to report usage; the record itself remains, without that link, because it is part of the count for its billing cycle. After you uninstall the app, the billing records are deleted together with the rest of your store's data, as described under "Deleting store and customer data".

Support requests reach us by e-mail. Support correspondence is kept for 12 months after the matter has been handled. We keep it longer only where that is necessary: while a claim or dispute it relates to is ongoing, until that has been resolved, or where the law requires us to keep it.

The service includes a daily backup of the database, and each backup is kept for 7 days. Backups exist to restore the service after an incident, not to recover records or files you deleted yourself. Data deleted from the app can remain in a backup until that backup expires. Uploaded files are not part of these backups.

Deleting store and customer data

When you uninstall the app, our access to your store ends and the Shopify session records for your store — which hold the staff account details and access tokens — are deleted immediately. Shopify then asks us to delete the rest of your store's data, normally 48 hours after the uninstall, and we delete it when that request arrives. We do not wait for it indefinitely: if Shopify's request does not reach us, we verify the uninstall ourselves and delete the remaining store data no later than 30 days after the uninstall, unless the law requires us to keep something, in which case we keep only what that law requires.

If your Shopify store is permanently closed or deleted, Shopify normally notifies us in the same way as when the app is uninstalled, and your store's data is deleted as described above. If, exceptionally, that notification does not reach us, we delete your store's data once we have confirmed that the store has been permanently closed or deleted, with the same legal exceptions. A temporary problem — such as an outage, a paused or frozen store, an expired or invalid access token, or a store website that cannot be reached — is never on its own treated as a closure.

When your store's data is deleted, all data the app holds for your store is deleted: orders and their line items, refunds and their components, advertising cost data and any advertising platform connection, products and variants, cost prices and their history, inventory quantities and locations, warehouses, suppliers and their contact details, purchase orders, receipts, supplier returns, stock counts, recorded operating costs, your own business details, settings and shipping rates, synchronisation logs, subscription and usage billing records and privacy request records. The files you uploaded — the attachments on your stock counts and supplier invoices — are removed from storage at the same time, and not only from our records of them.

When a customer asks for their data to be deleted and Shopify passes that request on to us, we delete the order data concerned immediately. We keep only the identifiers of those orders, for as long as the app is installed for the store, so that a later synchronisation cannot import the deleted orders again. No name, contact details, address, customer identifier or amount is kept with them.

8. Data security

We apply technical and organisational measures appropriate to the data we process. In practice this includes: each store's data is kept strictly separate, so one merchant's data cannot be reached from another's account; advertising platform tokens are encrypted at rest (AES-256-GCM) and never logged; messages from Shopify are verified as genuine before we act on them; each authorisation step for connecting an advertising platform is protected and can be used only once; access to our internal administration requires multi-factor authentication; and our logs and error messages are designed not to contain access tokens, message contents or personal data.

Connections to the app and to our website are encrypted in transit with TLS. Our database provider states that it encrypts the data it stores at rest. The daily database backup described above is there so that we can restore the service after an incident.

We hold no security certifications, and we make no absolute guarantee. No method of transmission or storage is completely secure.

9. Privacy rights and requests

Depending on where you are located, you may have the right to access, correct, delete, port, or restrict the processing of your personal data, and to object to it. Where we act as a processor on a merchant's behalf — which is the case for customer order data, apart from the order identifiers in our own billing records — requests from a customer should be directed to the merchant, and we will assist the merchant in answering them. To exercise rights in relation to data for which we are the controller, such as merchant account and support data, contact us using the details below.

To make a request, e-mail info@northmast.app and describe what you want. We may need to ask you for information to confirm who you are, so that we do not disclose or delete data on the basis of a request from someone else. We answer without undue delay and in any event within the period applicable data protection law allows. Exercising these rights is free of charge.

If you are not satisfied with how we handle your request, you have the right to lodge a complaint with your local supervisory authority. For us that is the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

10. Cookies and third-party services

The app itself does not store IP addresses, device identifiers or browsing behaviour. It contains no cookies for analytics, no tracking pixel and no third-party analytics script, and it does not build a profile of you or of your customers.

Shopify and any advertising platform you connect are not our subprocessors; how they process data is described under "Sharing information and subprocessors".

11. Changes to this policy

Each document carries its own version number and effective date. A material change results in a new version number and a new effective date shown at the top of the page. Minor corrections that do not change your rights or our obligations — such as a typographical fix — do not.

12. Contact