Catalog protection with bounded data.

This policy applies to the Catalog Armor Shopify app, including its catalog backup, restore, monitoring, alerting, privacy-request, and merchant-support features. SolidCraftLabs operates Catalog Armor.

Shopify merchants control how they configure and use the app. Shopify and each merchant maintain their own privacy practices, which may also apply to information associated with a store.

Catalog Armor receives the merchant's permanent shop domain, Shopify-provided session and access credentials, granted access scopes, installation state, store name and contact email, plan and subscription state, and operational events needed to authenticate, support, and operate the app.

To provide backup, restore, monitoring, and alerting, the app accesses catalog and store configuration such as products, variants, collections, inventory, publications, discounts, locations, markets, themes, content, fulfillments, returns, and related lifecycle events. It stores the snapshots, rules, evaluations, alerts, and audit records needed to deliver those features.

Merchant-configured order monitoring uses recent order identifiers and structured operational facts such as order number, timestamps, financial and fulfillment status, totals, tags, and product or SKU references. Catalog Armor does not request access to older orders through Shopify's all-orders permission. It does not request or use protected customer name, postal address, phone, or email fields.

Catalog Armor stores merchant configuration such as onboarding choices, protection policies, monitoring rules, rule groups, notification settings, acknowledgements, and restore requests.

We also receive information a merchant chooses to send in a support, security, or privacy request, such as contact details, shop domain, screenshots, and a description of the issue. Merchants should remove customer personal information and secrets before sending support materials.

We use information only to authenticate merchants; capture and verify backups; compare and restore supported catalog fields; evaluate merchant-defined rules; create alerts; reconcile missed events; administer plans and limits; deliver lifecycle emails; respond to support; investigate failures; secure the service; and comply with Shopify and legal requirements.

Catalog Armor does not sell personal information, use service data for third-party behavioral advertising, or use protected customer data for automated decisions that produce legal or similarly significant effects on customers.

Shopify and Amazon Web Services process data as needed to provide the app platform, API access, storage, queues, email, monitoring, and security. Our email and professional service providers may process information when needed to handle a request or operate the business.

We may also disclose information when required by law, to protect the rights or safety of users and the service, or as part of a business reorganization or transfer subject to appropriate protections.

Catalog backup history is retained according to the merchant's active plan. Current plan limits range from 7 to 180 days. Temporary privacy exports expire after 30 days. Operational queues and logs use bounded retention periods appropriate to their recovery and security purpose.

Uninstalling Catalog Armor revokes the app's Shopify access and stops new protection activity. Shopify's mandatory shop-redaction event initiates deletion of the shop's application records, backup records, and stored backup objects. A minimal redaction fence is kept to prevent delayed work from recreating deleted data. Limited security, billing, and business records may remain where reasonably required by law or legitimate recordkeeping obligations.

Catalog Armor accepts Shopify's mandatory customer data-request and customer-redaction events. The webhook payload is reduced to resource identifiers; customer names, email addresses, phone numbers, postal addresses, and the raw payload are not retained. Applicable order monitoring records can be exported or redacted, and durable controls prevent redacted records from being recreated by delayed events.

Customers should normally submit requests through the Shopify merchant that controls their store relationship. Merchants can also contact us for help with an authenticated Shopify privacy request.

Catalog Armor encrypts data in transit and at rest, encrypts backup storage, blocks public access to service storage, separates staging and production environments, isolates merchant records, stores credentials in managed secrets, limits service permissions, and records operational activity for investigation and recovery.

Access to production systems and protected data is restricted to authorized personnel and service roles with a business need. No transmission or storage system can be guaranteed completely secure.

Depending on where an individual lives, they may have rights to access, correct, delete, export, restrict, or object to processing of personal information. We may need to verify the requester and may retain information where permitted or required by law.

Catalog Armor does not sell or share personal information for cross-context behavioral advertising. Because the app does not use protected customer data for those purposes, a sale or advertising opt-out does not change its core processing.

SolidCraftLabs operates Catalog Armor from the United States. The app's primary application data is hosted by Amazon Web Services in its US East (N. Virginia) Region. Shopify and other service providers may process information in the United States and other countries where they operate.

We may update this policy as the service or legal requirements change. We will post the revised policy at this URL and update the revision date above.

For product help, visit Catalog Armor support.