Privacy Policy

VendorFlow turns orders from your Shopify store into purchase-order (PO) documents that you send to your suppliers, by printing or by email. To do that, the app reads certain data from your store and from the email account you choose to connect.

• Order data from your Shopify store: order numbers, dates, line items and quantities, product and vendor names, and — for the orders you open — customer names, shipping addresses, phone numbers and email addresses. This is used to build the PO documents and to show your order list.
• Supplier and vendor details you enter: vendor names, email addresses and whether a vendor is enabled. This is used to address and send POs.
• Your store's email connection: if you connect a sending email account (Gmail/Google, Outlook, Yahoo, a mail server, or a service like Resend or SendGrid), the app stores the settings or credentials needed to send email on your behalf. Passwords, app passwords and API keys are encrypted before storage and are never displayed back to you in full.
• App usage records: counts of POs sent or printed (used for plan limits), your chosen plan, and basic records of when POs were sent to which vendor.
• Notes and preferences: order notes you type and settings like sender name, reply-to address and email template wording.

• To provide the service you asked for (performance of a contract): reading orders, building and sending POs, showing history.
• On your instructions as a processor: for your customers' details, we act only on the store owner's instructions.
• Legitimate interests: keeping the service secure, preventing abuse, enforcing plan limits and fixing problems.
• Legal obligations: where the law requires us to keep or disclose information.

• We do not sell or rent your data or your customers' data, and we do not "share" it for cross-context behavioural advertising.
• We do not send marketing emails to your customers.
• We do not read your inbox — a connected email account is used only to send the PO emails and test emails you ask for.
• We do not use your data, or your customers' data, to train artificial-intelligence models.
• We do not make automated decisions that have legal or similarly significant effects on anyone.

If you choose "Connect with Gmail", VendorFlow asks Google only for permission to send email on your behalf and to see your email address, so it can show which account is connected. It does not read, store or analyse your emails.

VendorFlow's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google data is not transferred to others except to provide the sending feature, for security, or to comply with law; it is never used for advertising and no human reads it unless you ask us to for support, it is needed for security, or the law requires it. You can disconnect at any time in Settings or from your Google account's security page.

We share data only with providers needed to run VendorFlow, under contracts that require them to protect it:

• Shopify — the platform the app runs in, and billing for paid plans.
• Cloud hosting and database providers — to run the app and store its data.
• The email service you choose to connect (for example Google, Microsoft, Yahoo, your own mail server, Resend or SendGrid) — to deliver the POs you send.

We may also disclose information if required by law, or to a buyer if the business is sold, in which case this policy continues to apply.

VendorFlow is used worldwide, and our providers may process data in countries other than yours, including the United States and India. Where the law requires it (for example for data from the EU, UK or Switzerland), transfers rely on recognised safeguards such as the European Commission's Standard Contractual Clauses or equivalent protections.

Data is stored on managed cloud infrastructure with encryption in transit and at rest. Email connection secrets are encrypted before they are saved. Each store can only see its own data. Access is limited to people who need it to run and support the service. If a data breach affects your information, we will notify you and the relevant authorities where the law requires, without undue delay.

Customer names, addresses and contact details appear in VendorFlow only because they appear in your Shopify orders. The store owner is the data controller and is responsible for having a lawful basis to use that information and for telling customers about it in the store's own privacy policy. Magnoriva Global acts as a data processor and uses it only to create and send the POs you request.

When Shopify tells us that a customer has asked for their data, or asked for it to be erased, we respond through Shopify's privacy request process and delete or provide that customer's data as required.

• While your store uses the app, we keep order information, vendor records and send history so your dashboard and plan limits work.
• When you uninstall, the email connection is disabled immediately, and all store data is deleted within 48 hours of Shopify's deletion request (normally sent 48 hours after uninstall).
• A customer's data is erased within 30 days of a valid erasure request.
• Limited records may be kept longer only where the law requires (for example billing records).

Depending on where you live, you may have the right to access, correct, delete or receive a copy of your personal data, to object to or restrict its use, and to withdraw consent. This includes rights under the EU and UK GDPR, the California Consumer Privacy Act (CCPA/CPRA) and other US state laws, Canada's PIPEDA, Brazil's LGPD, India's Digital Personal Data Protection Act 2023, Australia's Privacy Act and similar laws.

To use these rights, email us. We will reply within 30 days (or sooner if your law requires) and will not treat you differently for using them. If you are a store's customer, please contact that store first, as it controls your data; we will help it respond. You also have the right to complain to your local data protection authority.

VendorFlow is a business tool for Shopify merchants and is not directed at children. We do not knowingly collect data from anyone under 16 as a user of the app.

Subscription payments for paid plans are handled by Shopify billing, on your store's Shopify invoice. VendorFlow never sees or stores your payment card details.

VendorFlow uses browser local storage to remember which store you are working with, and strictly necessary session technology needed for the app to function. We do not use advertising or tracking cookies, so no cookie consent is needed for these.

If this policy changes, the new version will be posted on this page with an updated date. If a change materially affects how your data is used, we will notify you through the app or by email.

VendorFlow is operated by Magnoriva Global, a company based in India. For privacy questions, data requests or complaints, email info@magnorivaglobal.com. We aim to answer within 30 days.