Privacy Policy

Effective date: August 1, 2026

This Privacy Policy explains how Ezy Kiwi Limited ("we", "us", "our") collects, uses, stores, and protects information through the Ezy-OTB application ("the App") when installed on a Shopify store. It applies to merchants who install the App from the Shopify App Store and to the customers whose order data passes through the App as a result.

1. Who we are

Ezy-OTB is operated by Ezy Kiwi Limited. For any question about this policy or your data, contact us at admin@ezy.kiwi.

2. What information we collect

When a merchant installs the App, Shopify's OAuth flow grants the App access to the following categories of data from the merchant's store, which the App retrieves and stores in order to provide its inventory planning and reporting features:

Category	Examples
Store & product data	Product titles, SKUs, variants, prices, inventory quantities, and store locations.
Order data	Order line items, prices, discounts, shipping/billing addresses, and order status, used to generate sales and inventory reports.
Customer data	Name, email, phone number, and marketing-consent state associated with orders, as provided by Shopify. This is used only to attribute orders correctly and is not used for marketing by us.
Authentication data	An OAuth access token and refresh token issued by Shopify, used solely to make authorized API calls back to the merchant's store on their behalf. These tokens are never shown to the merchant or any third party.
Billing data	Subscription status and pricing, managed entirely through Shopify's own Billing API. We do not collect or store payment card details ourselves.
Documents you upload	Purchase order confirmations and similar supplier documents (PDFs, scans, or photos) that a merchant chooses to upload so the App can read the order details off them automatically. These are supplied by the merchant, not retrieved from Shopify. See Section 5 for how they are processed.

3. How we use this information

To synchronize product, inventory, and order data so the App can generate the merchant's open-to-buy planning, sales, and inventory reports.
To operate the merchant's account, including billing status and subscription management.
To respond to support requests and, where legally required, to compile or delete data in response to a request from a merchant or their customer.

We do not sell this information, use it for advertising, or share it with third parties except as described in Section 5.

4. Where data is stored

Data is stored in a database operated by us and hosted in New Zealand, scoped to the merchant's own account. Because we are a New Zealand company using New Zealand hosting, data from merchants in other countries is transferred to and stored in New Zealand. It is retained for as long as the App remains installed. If the App is uninstalled, synced order and customer data is retained only until Shopify's mandatory shop/redact webhook is delivered (per Shopify's own retention schedule after uninstall), at which point it is deleted or anonymized as described below.

5. Data sharing

We share data only with:

Shopify, as the source of the data and the platform the App integrates with.
Our email service provider, solely to deliver operational notifications (e.g. sync alerts, compiled data-request exports).
Anthropic PBC (the Claude API), used only when a merchant uploads a supplier purchase order document for automatic extraction. In that case the uploaded file itself is sent to Anthropic's API so the order lines can be read off it and returned to the merchant for review. This happens only on an upload the merchant deliberately initiates - no Shopify product, order, or customer data is sent to Anthropic as part of routine syncing or reporting. Anthropic processes the request on our behalf as a service provider and, under its commercial API terms, does not use the content to train its models.

We do not use third-party analytics or advertising trackers within the App.

6. GDPR / data subject rights

The App implements Shopify's mandatory privacy webhooks:

Customer data request - when a customer asks a merchant what data is held about them, we compile the relevant order and profile data for the merchant to provide.
Customer redact - when a customer's data must be deleted, we erase personally identifying fields (name, email, phone, address details) from their orders while retaining non-identifying, aggregate fields (such as region) needed for the merchant's reporting.
Shop redact - after a store uninstalls the App, we delete the store's synced order data and anonymize any customer profiles that are no longer referenced by any retained order.

To exercise a data access, correction, or deletion request directly, contact us at admin@ezy.kiwi.

7. Security

Access tokens are stored server-side only and are never exposed to the browser or any third party. All communication with Shopify's API and webhooks is made over HTTPS, and incoming webhooks are verified using Shopify's HMAC signature before being processed.

8. Changes to this policy

We may update this policy from time to time. Material changes will be reflected by an updated effective date at the top of this page.

9. Contact

Questions about this policy or your data can be sent to admin@ezy.kiwi. Merchants can also review our Data Processing Agreement, which covers how we process a merchant's own customer data on their behalf in more detail.