Privacy Policy

Information we process

Cratevero stores information that a merchant enters or imports to manage suppliers, purchase orders, receiving, inventory adjustments, invoices, payments, credits, discrepancies, and accounting exports.

We also process the merchant's Shopify store identifier, authorized staff session information, access token, granted scopes, products, variants, inventory locations, and inventory transfers as needed to provide the app.

Cratevero records first-party operational product milestones linked to the merchant's store, such as when a purchase order, receipt, invoice, reconciliation, or transfer link is committed. These tenant-level records are not anonymous. They use bounded categories and coarse counts and do not include staff identity, supplier or customer identity, product identifiers, document contents, money amounts, URLs, or free text.

Cratevero does not request Shopify customer or order access and does not process customer payment-card information.

How we use information

• Provide purchasing, receiving, reconciliation, and reporting workflows.
• Apply merchant-initiated Shopify inventory adjustments.
• Generate documents, barcode labels, and accounting exports.
• Secure, operate, troubleshoot, and improve the service.
• Measure store-level activation and workflow adoption to improve Cratevero and decide which product workflows to develop.
• Meet legal, security, fraud-prevention, and Shopify platform obligations.

We do not sell or rent merchant data, use it for third-party advertising, track page views or clicks, or use product milestones to measure individual staff performance.

Service providers

Cratevero uses Shopify for app authentication and billing, Render for application hosting, Neon for PostgreSQL database hosting, Sentry for error and performance monitoring and operational logs, and Resend for transactional purchase-order and supplier-claim email. Those providers process only the information necessary to deliver the requested feature.

Uploaded documents use private Cloudflare R2 storage and a Render-hosted ClamAV malware-scanning worker. Documents remain unavailable while scanning and can be downloaded through short-lived signed links only after a clean result. Infected files and files that cannot be scanned successfully remain unavailable and are queued for deletion.

Security and retention

Data is encrypted in transit. Production providers encrypt stored data at rest. Access is restricted by tenant, and downloadable resources use short-lived, purpose-specific authorization.

Cratevero retains merchant data while the app is installed and as needed to provide the service. After uninstall or a verified deletion request, database data is deleted and stored objects are queued for deletion, subject to limited backup, security, and legal-retention requirements.

Tenant-level product milestones are retained for no more than 13 months while the app is installed. They are then deleted after eligible activity has been summarized. Daily summaries are retained only when at least three stores contributed to the cohort and contain no store identifier. Uninstalling deletes the store's tenant-level milestones; a thresholded summary cannot be traced back to that store.

Your choices and rights

Merchants may request access, correction, export, or deletion of their Cratevero data. Uninstalling the app initiates account-data deletion. Because Cratevero does not request customer or order data, Shopify customer data requests normally return no stored customer records.

Contact

For privacy questions or requests, email support@cratevero.app.