> ## Documentation Index > Fetch the complete documentation index at: https://docs.bridgeful.app/llms.txt > Use this file to discover all available pages before exploring further. # Privacy Policy > How Bridgeful collects, uses, stores and protects your store's data, who it is shared with, and the choices and rights you have over it. **Last Updated:** November 15, 2026 ## Company Details * **Organization:** Bridgeful * **Data Protection Contact:** [support@bridgeful.app](mailto:support@bridgeful.app) ## Overview Bridgeful ("the App") is a Shopify application that keeps two or more Shopify stores in sync: inventory between paired locations, and products and collections from a main store to its connected stores. This Privacy Policy explains how we collect, use, and protect information when you use the App. ## Information We Collect When you install and use Bridgeful, we access and store the following data from each store the App is installed on: ### Store Information * Store name, domain, and Shopify identifier * Store email address, currency, country, primary language, and timezone * Staff account information associated with the Shopify admin (name, email address, language) ### Product, Collection & Inventory Data * Product and variant details used to match and sync products: titles, handles, SKUs, barcodes, options, status, vendor, product type, tags and images * The product and collection fields you choose to sync, and the product and collection metafields you add to the sync * Inventory levels at the locations you pair, and location names * Which sales channels products and collections are published to ### Sync Records * Which store is linked to which, and the matches between their products, variants, collections and locations * A record of every change the App makes, with the values before and after, shown to you in Activity * Your sync settings, price rules and location pairs ### Support & Assistant * Messages you send to the in-app assistant or to our support team, and our replies * Email preferences and the lifecycle emails we have sent ### What We Do Not Collect * **Orders and customer data** - the App does not request access to orders or customers, and never reads, stores or processes your customers' personal information. * **Payment card information** - all billing is handled through Shopify; we never see card numbers, expiry dates, or CVV codes. * **Storefront browsing data** - we do not track your storefront visitors, set cookies on your storefront, or receive analytics events from customer-facing pages. * **Children's data** - see the Children's Privacy section below. ## How We Use Your Information We use the information collected to: * **Deliver the service** - match products across your stores and keep inventory, products and collections in sync as you have set them up * **Show you what happened** - record every change in Activity * **Improve the App** - analyze usage patterns and performance to improve features and reliability * **Provide support** - respond to your questions and troubleshoot issues * **Communicate with you** - send service emails about your account and data, and the optional emails you have chosen in your email preferences * **Ensure security** - detect and prevent fraud, abuse, or technical issues * **Meet legal obligations** - comply with applicable laws and Shopify's requirements ## AI Features Bridgeful's in-app assistant is powered by [Anthropic](https://anthropic.com)'s Claude models, through Cloudflare's AI Gateway. Searching the help docs uses embeddings from [Cloudflare Workers AI](https://developers.cloudflare.com/workers-ai/). **What we send to the AI provider:** * The message you type and the conversation so far * The sync data needed to answer it, read from your own store's records: for example your linked stores, sync settings, location pairs, matched and unmatched products, and recent changes in Activity * Help docs passages relevant to your question **What we do not send:** * Customer personal data (the App does not hold any) * Payment, billing, or staff account credentials * Any data from a store you are not linked to **Data handling at the provider:** Requests are sent through Anthropic's standard API and are subject to Anthropic's API data usage and retention terms, under which inputs and outputs are not used to train its models. **What Bridgeful stores:** * Assistant conversations, kept against your store so you can browse your history * Short summaries of past conversations, so the assistant can pick up where you left off * Feedback you give on answers (thumbs up or down), and our quality reviews of answers, used to improve the assistant The assistant only reads your data. It cannot change your stores, products or settings. ## Legal Bases for Processing We process your data under the following legal bases, depending on your jurisdiction: * **Contractual necessity** - processing required to deliver the service you've installed * **Legitimate interests** - improving service quality, ensuring security, and preventing abuse * **Consent** - where required by local law (e.g., Brazil's LGPD, India's DPDP Act), consent is obtained during app installation ## Third-Party Services We share data with the following third-party service providers to operate the App. We do not sell, rent, or trade your personal information. | Service | Purpose | Data Shared | | - | - | - | | [Cloudflare](https://cloudflare.com) | Application hosting and backend infrastructure (Workers, KV, Queues), AI gateway and docs search embeddings | All app data in transit; assistant requests | | [Neon](https://neon.tech) | Primary database (PostgreSQL) | All app data (primary data store) | | [Shopify](https://shopify.dev) | E-commerce platform integration | Store data via API - the access set out under Data Security below | | [Anthropic](https://anthropic.com) | The in-app assistant | Assistant messages and the sync data needed to answer them. Never customer data. | | [Resend](https://resend.com) | Email delivery | Recipient email addresses, email content | | [Zoho Mail](https://zoho.com/mail) | The [support@bridgeful.app](mailto:support@bridgeful.app) mailbox | Emails you send to support | | [Chatwoot](https://chatwoot.com) (self-hosted by us) | Support conversations | Support messages, your name, email address and store | | [Sentry](https://sentry.io) | Error tracking and monitoring | Exception data, store identifier (no product or inventory data) | | [Axiom](https://axiom.co) | Operational analytics and event logging | Event logs, store identifier, operational metrics | | [Trigger.dev](https://trigger.dev) | Background job execution | Task payloads (store identifiers, job parameters) | Each provider processes data in accordance with their own privacy policies and is contractually obligated to protect your information. ## Data Security We implement the following security measures to protect your data: * **Encryption in transit** - all data transmitted over HTTPS/TLS * **Access control** - multi-tenant isolation ensures each store can only access its own data and the data of stores it is linked to, as the link allows * **Scoped API access** - the App uses only the Shopify API scopes its features need: | Scope | Type | Purpose | | - | - | - | | `read_products` | Read | Read products, variants and collections to match them across your stores and detect changes. | | `write_products` | Write | Keep connected stores in step with the main store, as you have set up the sync: create and update products, variants, images, collections and the metafields you add, append tags, and set a deleted product to draft or delete it as your settings say. Only the parts you switch on are written, and only on stores linked to your main store. | | `read_inventory` | Read | Read inventory levels at paired locations to detect changes. | | `write_inventory` | Write | Set or adjust inventory levels at paired locations so they follow each other. Each change is sent with the level the App last read, so a level that moved in the meantime is re-read rather than overwritten. | | `read_locations` | Read | List locations so you can pair them. | | `read_publications` | Read | Read which sales channels products and collections are published to. | | `write_publications` | Write | Publish synced products and collections to the same sales channels on connected stores, when sales channels are switched on in the sync. | * **Credential protection** - access tokens are stored encrypted (AES-256-GCM at rest) and never exposed to the frontend * **Alignment with Shopify standards** - development and security practices follow Shopify's app development guidelines ## Our Role Under GDPR For the purposes of the EU/UK General Data Protection Regulation (GDPR) and equivalent laws: * You (the merchant) are the **data controller** for your store data. * Bridgeful acts as a **data processor** on your behalf, processing the data only in line with your instructions and this Privacy Policy. A standalone [Data Processing Agreement](https://docs.bridgeful.app/policies/data-processing-agreement.md) governs this relationship and satisfies Article 28 of the GDPR. EU/UK-based merchants are deemed to have accepted the DPA on installation; a counter-signed copy is available on request at **[support@bridgeful.app](mailto:support@bridgeful.app)**. ## Data Retention and Deletion * **Sync data** - retained while the App is installed, so stores keep syncing and Activity keeps its history * **Upon uninstallation** - app data is retained for 48 hours in case you reinstall, then permanently deleted when Shopify sends its data deletion request * **If a free trial ends without a plan** - app data is retained for 30 days after syncing stops (we email a warning before deletion), then permanently deleted * **If a plan is cancelled** - app data is permanently deleted 7 days after access ends * **Shopify compliance** - we honor all Shopify GDPR/privacy webhooks (customer data requests, customer redaction, and shop redaction) * **Support records** - retained for up to 3 years for quality and legal purposes * **Legal obligations** - data may be retained longer where required by applicable law ## Your Rights Depending on your jurisdiction, you may have the following rights regarding your data: * **Access** - request a copy of the data we hold about your store * **Correction** - request correction of inaccurate data * **Deletion** - request deletion of your data (or uninstall the App) * **Portability** - request your data in a machine-readable format * **Restriction** - request that we limit processing of your data * **Objection** - object to processing based on legitimate interests ### Regional Rights * **GDPR (EU/EEA/UK)** - you have the right to lodge a complaint with your local supervisory authority * **CCPA/CPRA (California)** - you have the right to know, delete, and opt out of the sale of personal information. We do not sell personal information. * **PIPEDA (Canada)** - you may access and challenge the accuracy of your information * **LGPD (Brazil)** - you may request confirmation of processing, access, correction, anonymization, or deletion To exercise any of these rights, contact us at **[support@bridgeful.app](mailto:support@bridgeful.app)**. ## Children's Privacy Bridgeful is a business-to-business application intended for use by Shopify merchants. We do not knowingly collect information from children under 13 (or the applicable age in your jurisdiction). If you believe we have inadvertently collected such information, please contact us immediately. ## Changes to This Policy We may update this Privacy Policy from time to time. We will notify you of material changes by updating the "Last Updated" date at the top of this page. Continued use of the App after changes constitutes acceptance of the revised policy. ## Contact Us If you have questions about this Privacy Policy or our data practices, please contact us: * **Email:** [support@bridgeful.app](mailto:support@bridgeful.app) This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.