DropAloft Privacy Policy

Effective date: July 23, 2026

Last updated: July 23, 2026

This Privacy Policy explains what data the DropAloft Shopify app ("DropAloft", "the app", "we", "us") accesses, stores, and processes, and why. It is written to describe exactly what the app's code does. DropAloft is a merchant-facing app installed by a Shopify store owner. It is not directed at, and does not knowingly collect data from, that store's shoppers.

Provider: Avylka
Contact: hello@dropaloft.com

1. Summary

DropAloft displays real, store-owned numbers (recent units sold, low-stock counts, free-shipping progress, and community campaign meters) on a merchant's storefront. To do this it reads order and inventory events from Shopify and stores only aggregate counts keyed by product. It does not store shopper names, emails, phone numbers, addresses, payment details, or any other customer personal information.

2. Data we access and store

2.1 Merchant account / session data

When a merchant installs the app, Shopify's OAuth flow provides an authenticated session that DropAloft stores so it can call the Shopify Admin API on the store's behalf. This session record may contain:

• Shop domain (for example example.myshopify.com)
• Access and refresh tokens and their expiry
• The installing staff user's identifier, first name, last name, email, locale, and account-owner/collaborator flags, as supplied by Shopify

This is merchant/staff account data, not shopper data. It is used solely to authenticate API calls and is never used for marketing.

2.2 Storefront order and inventory data (aggregate only)

DropAloft subscribes to these Shopify webhooks:

• orders/create, orders/cancelled, refunds/create (Protected Customer Data)
• inventory_levels/update

From order events the app reads only each line item's product_id and quantity, plus non-personal order flags (test, financial_status, created_at) used to decide whether a sale counts. It does not read or store customer name, email, phone, shipping/billing address, IP address, or payment information, even though those fields are present in the webhook payload.

From these values the app maintains:

• Hourly per-product sold-unit buckets (shop + product id + hour + unit count)
• Rolling per-product sold aggregates (for example a 24-hour and a 7-day total)
• Last-known available inventory per product/variant
• Campaign progress counters (total qualifying units toward a merchant goal)

These aggregates are written back to the store as Shopify metafields in the dropaloft namespace (for example sold_24h, sold_7d) so the storefront widgets can display them.

2.3 Merchant settings

The app stores the merchant's own configuration: feature toggles, display thresholds, styling/brand-color choices, campaign definitions, and setup progress. This contains no customer data.

3. What we do NOT collect

• No shopper names, emails, phone numbers, or addresses
• No order-level customer identifiers tied to individuals
• No payment or financial account data
• No cookies, advertising identifiers, or cross-site tracking
• No third-party analytics, advertising, or profiling services

4. How we use data

We use the data above only to:

• Authenticate and make Shopify Admin API calls for the installing store
• Compute aggregate sold/inventory/campaign numbers for that store
• Publish those aggregates and the merchant's display settings to the store's own metafields so its storefront widgets can render

We do not sell data, share it for advertising, or use it to build profiles of individual shoppers.

5. Protected Customer Data

Because order webhooks can include customer-related fields, Shopify classifies this as Protected Customer Data access. DropAloft requests this access for app functionality only. As described in Section 2.2, the app processes just product_id and quantity from line items and does not persist any customer personal fields. Access is used only to keep the storefront's aggregate counts accurate.

6. Data sharing and sub-processors

• Shopify. The app runs on the Shopify platform and exchanges data with the Shopify Admin API and webhooks. Shopify's own handling of merchant and customer data is governed by Shopify's terms and privacy policy.
• Hosting / database infrastructure. App data (the session and the aggregates and settings described above) is stored in the app's own database, operated on hosting infrastructure controlled by the provider. It runs on Fly.io in the United States.

We do not share data with advertising networks, data brokers, or analytics vendors.

7. Data retention

• Sold-unit buckets and aggregates are retained to support the rolling display windows and remain available while the app is installed.
• Session and settings records are retained while the app is installed.
• When a merchant uninstalls the app, Shopify sends app/uninstalled and the session records for that shop are deleted.
• Shopify sends a shop/redact request approximately 48 hours after uninstall. On receiving it, DropAloft deletes all rows keyed to that shop: settings, product stats, sold buckets, campaigns, webhook dedupe records, and sessions.

8. GDPR / privacy compliance webhooks

DropAloft implements Shopify's three mandatory compliance webhooks:

• customers/data_request: DropAloft stores no customer personal data, so there is no customer data to return. The request is acknowledged.
• customers/redact: DropAloft stores no customer personal data, so there is nothing to erase for an individual shopper. The request is acknowledged.
• shop/redact: DropAloft erases all data it holds for the shop, as described in Section 7.

9. Merchant rights

Merchants can, at any time, uninstall the app to stop all data processing and trigger deletion of shop-scoped data as described above. For questions or requests regarding data the app holds, contact us at the address in the header of this policy.

10. Security

Access tokens and app data are stored in the app's database and used only to serve the installing store. Communication with Shopify uses HTTPS. Access to the app's infrastructure is restricted to the provider.

11. Children

DropAloft is a business tool for merchants and is not directed to children. It does not knowingly collect personal information from children.

12. Changes to this policy

We may update this policy to reflect changes in the app. Material changes will be reflected by updating the "Last updated" date above.

13. Contact

Questions about this policy or DropAloft's data practices can be sent to the contact address listed in the header of this document.