Oxpeka Inventory – Privacy Policy
Effective date: October 16, 2026
Oxpeka Inventory ("Oxpeka", "we", "us") is a Shopify app that helps merchants plan purchases, track stock, manage suppliers and purchase orders, and make products from raw materials. This policy explains what information Oxpeka processes when a merchant installs and uses the app, why, who receives it, how long we keep it and the rights people have, including under the EU and UK GDPR, US state privacy laws (such as the California Consumer Privacy Act as amended by the CPRA) and Canadian privacy laws (PIPEDA and Quebec's Law 25).
Who we are. Nahom Accorsi, trading as Oxpeka, Salita del Castelvecchio 39, La Spezia, Sp 19126. Privacy contact (also our Privacy Officer for Canada): privacy@oxpeka.com.
1. Our role
- Store data (products, stock, sales, suppliers, purchase orders and everything else a merchant manages in the app) is processed on behalf of the merchant. The merchant decides what goes into the app and why; we are the merchant's processor under the GDPR, service provider under US state laws and a service provider handling information on the merchant's behalf under Canadian law. Our Data Processing Addendum applies to this data.
- Account and support data (who installed the app, which plan, messages to our support team) is processed by us as controller to run our business.
Oxpeka is a business tool for merchants. It is not directed to consumers or to children under 16.
2. Information we process
From the merchant's Shopify store, through Shopify's API, once the app is installed:
- Products and variants: titles, SKUs, barcodes, vendor, prices, images, inventory quantities, costs and locations.
- Orders: only the SKU, quantity and date of each order line, and order tags, used to calculate sales. We do not request, read or store the names, email addresses, phone numbers or addresses of the store's customers.
- Store details: store name, contact email, currency, country and time zone.
Information the merchant enters or uploads: suppliers (company name, contact email, country, notes, payment terms), supplier product codes and costs, purchase orders, product settings, raw materials and bills of materials, stock counts and adjustments, report schedules and the email addresses of report recipients, and documents uploaded to "Add a supplier from a document" (invoices, price lists, photos). Supplier and recipient details can include the name and business email of a contact person.
Information about the merchant's staff using the app: the Shopify user ID, only to remember their display preference; questions typed to the AI features (section 4); and, when they write to support, the email address they give and their message.
Plan and billing: charges are handled entirely by Shopify. We only learn which Oxpeka plan the store is on. We never see card or bank details.
Technical information: server logs and error reports (time, page without its query string, store domain, error details), used for security and to fix problems. We do not record IP addresses in error reports.
Cookies and similar technologies: Oxpeka runs inside the Shopify admin and signs in with Shopify session tokens. It sets no advertising, analytics or tracking cookies. It uses the browser's local storage only for conveniences (for example, whether a panel is open); these never leave the browser.
3. Why we use it, and our legal bases (GDPR)
| Purpose | Legal basis |
|---|---|
| Providing the app: forecasts, reorder recommendations, purchase orders and supplier emails, transfers, stock counts, production, reports and analytics | Performance of our contract with the merchant (Art. 6(1)(b)); for store data, the merchant's instructions under the DPA |
| Sending the reports and purchase-order emails the merchant asks for | Contract (Art. 6(1)(b)) |
| Answering support requests | Contract (Art. 6(1)(b)) and our legitimate interest in helping our customers (Art. 6(1)(f)) |
| Keeping the service secure, preventing abuse, fixing errors | Legitimate interests (Art. 6(1)(f)) |
| Keeping records the law requires (e.g. tax, accounting) | Legal obligation (Art. 6(1)(c)) |
We do not use store data to train AI models, to build profiles of individuals or for advertising.
4. AI features
Three optional features use an AI model provided by Anthropic (Claude):
- Copilot: the question and a summary of the store's stock (SKUs, quantities, status, missing suppliers).
- Add a supplier from a document: the uploaded file and the list of the store's SKUs and product names, to fill in the supplier and match its products. The merchant reviews the result before anything is saved; the file itself is not stored by Oxpeka.
- Help assistant: the question and Oxpeka's own help guides. No store data.
No data about the store's customers is sent. Under Anthropic's commercial terms, inputs and outputs are not used to train its models; Anthropic keeps them for a limited period for trust and safety purposes (see Anthropic's commercial terms). Please don't type personal data into these features.
5. Who receives information
We do not sell personal information, and we do not "share" it for cross-context behavioral advertising as those terms are defined in US state laws. We disclose information only to the service providers below, under contracts that require them to protect it and use it only to provide their service to us:
| Provider | Purpose | Where |
|---|---|---|
| Shopify | The platform the app runs on | Canada / worldwide |
| Render | Hosting and database | United States (Virginia) |
| Anthropic | AI features (section 4), only when used | United States |
| Postmark (ActiveCampaign, LLC) | Sending reports, purchase-order and support emails | United States |
| Sentry | Error reports | United States |
We may also disclose information if the law requires it, to protect our rights or users' safety, or as part of a merger or acquisition (the buyer would be bound by this policy).
6. International transfers
Our service providers are mostly in the United States. When personal data from the European Economic Area, the United Kingdom or Switzerland is transferred there, we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum), or on the provider's certification under the EU-US Data Privacy Framework and its UK and Swiss extensions. For people in Canada, including Quebec: your information may be stored and processed outside Canada, where local authorities may be able to access it under local law; we protect it with contractual safeguards comparable to Canadian standards.
7. How long we keep it
- While the app is installed: as long as needed to provide it (sales history up to two years).
- After uninstall: Shopify asks us to delete the store's data 48 hours after the app is uninstalled; we then delete all of it, including suppliers, purchase orders, settings and support requests. Access tokens and scheduled emails stop at uninstall.
- Backups: encrypted database backups are overwritten within 30 days.
- Logs and error reports: up to 30 days.
- Emails to support in our inbox: up to two years, or longer if needed for a legal claim.
8. Security
Data is encrypted in transit (HTTPS/TLS) and at rest by our hosting provider. Every request is authenticated by Shopify, each store's data is kept separate from every other store's, access to production systems is limited to the people who need it, and secrets are kept in our hosting provider's secret store. No method is perfectly secure; if a breach affects personal data, we will notify the merchants concerned without undue delay, and the authorities where the law requires it.
9. Your rights
How to exercise them: write to privacy@oxpeka.com. For store data, we usually pass the request to the merchant, who decides on it, and help them answer it. We answer within the deadlines the law sets (generally one month in the EU/UK, 45 days in California, 30 days in Canada) and will not discriminate against anyone for exercising a right.
- EU, EEA and UK: access, rectification, erasure, restriction, portability, objection to processing based on legitimate interests, and complaint to a data protection authority (in Italy: the Garante per la protezione dei dati personali, or the authority where you live or work).
- United States (California and other states with privacy laws): to know what personal information we process and to get a copy, to correct it, to delete it, and to opt out of sale, sharing or targeted advertising (we do none of these). You may use an authorized agent; we will verify the request.
- Canada (PIPEDA, Quebec Law 25): access and correction, withdrawal of consent where consent is the basis, and complaint to the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d'accès à l'information.
10. The store's customers
Oxpeka does not hold personal data about the store's customers. If a customer asks the merchant for their data or for its deletion, Shopify forwards the request to us; we confirm we hold none.
11. Changes
We will post changes here with a new effective date, and tell merchants in the app or by email before material changes take effect.
12. Contact
Nahom Accorsi, trading as Oxpeka – Salita del Castelvecchio 39, La Spezia, Sp 19126 – privacy@oxpeka.com