Privacy Policy

Checkout AI: B2B Discounts (the “App”) is a Shopify app provided by Smith Crafts LLC (“we”, “us”). This policy explains what data the App accesses, why, and how we handle it. The App is an admin tool for authoring automatic B2B product, order, and shipping discounts that run inside Shopify’s Discount Function runtime. We do not inject scripts or trackers into your storefront, and we do not store your customers’ names, postal addresses, email addresses, phone numbers, IP addresses, order contents, or payment details.

Scopes we request

The App requests the following Admin API access scopes at install and never asks for more than what is required to run today’s features:

• read_discounts, write_discounts — read and publish only the automatic app discount nodes the App owns for your shop. Nothing else in your discount catalogue is modified.

The App does not request read_customers, read_companies, read_orders, read_all_orders, write_customers, or any Protected Customer Data (PCD) approval. The Discount Function evaluates customer-tag membership and native B2B purchasingCompany context scope-free inside Shopify’s checkout Function runtime; the App itself never fetches, stores, or transmits customer or company records through the Admin API. Order-level webhooks are not subscribed to.

Protected Customer Data (PCD) posture — Level 0

The App does not retrieve Shopify Customer records through the Admin API or the Customer Account API. Its Shopify-hosted Discount Function evaluates only yes/no membership in the merchant-specified customer tags and optional B2B buyer context during checkout. Smith Crafts LLC does not receive or store customer IDs, names, addresses, email addresses, phone numbers, or the raw Function input, and no customer data is sent to Anthropic. Merchant-entered Shopify Company or Company Location GIDs may be stored as discount-rule configuration; the App does not fetch or persist company contact records. Because no Protected Customer Data fields are read through the Admin, the App requests PCD Level 0 — no protected-customer-data approval — while remaining subscribed to the mandatory Shopify privacy compliance webhooks below.

Webhooks we subscribe to

• app/uninstalled — required by Shopify. Fires when the merchant removes the App; we immediately delete session records for the shop.
• app/scopes_update — required by Shopify. Fires when the approved scope set changes so the App can re-authenticate before its next request.
• customers/data_request, customers/redact, shop/redact — the three mandatory Shopify privacy compliance topics. See Data retention & deletion below for exactly how each is handled.

The App does not subscribe to orders/create, orders/updated, or any other order-, customer-, or checkout-event topic. No order or checkout data is delivered to our servers at runtime.

What we store

• Shop identity & access tokens. Your shop domain and the offline access token Shopify issues at install, used to authenticate the App to your store. Kept while the App is installed and deleted on uninstall and on shop/redact.
• Merchant-staff session data. The App uses Shopify’s Prisma session-storage adapter. Its schema includes columns for the Shopify staff user who installed or authorized the App — userId, firstName, lastName, email, locale, accountOwner, collaborator, and emailVerified. The App itself does not read these fields for any feature; they may be populated by Shopify during authentication. They are deleted with the shop’s sessions on uninstall and on shop/redact.
• Discount programs and publish history. The discounts you build (targets, conditions, tiers, actions, messages) and the compiled Discount Function configuration — merchant-authored, not personal data. Every publish appends an immutable version record (compiled configuration, source intent, content hash, source such as “manual” or “ai” or “rollback”) so you can see the publish history for the App’s single discount node.
• Discount activation state. One row per shop that records the App’s discount-node id and its lifecycle (active, inactive, publishing, missing, or reconciliation_required) so publishing is idempotent across retries and crashes.
• Company / company-location IDs used in rules. Only the specific IDs you enter into a rule (for example, one company or one location you selected in the Builder) are stored, embedded into the compiled Discount Function configuration for that rule. The App does not enumerate or store your Companies catalogue.
• AI rule drafts (optional). If you use the draft-a-rule-with-AI feature, the rule description you type is sent to our AI sub-processor (Anthropic) to generate a draft. The text you typed and the drafted rule are stored per shop so you can review, edit, and publish them. No customer data is sent to the AI provider.
• AI usage counters and plan state. Per-shop AI call counts, the detected billing plan handle, subscription id, and the current billing-period start, used to enforce plan-based quotas.
• Alert preferences and delivery records. Per-shop settings for in-app alerts (route mode, digest cadence, dollar-floor, mute state) and a per-alert delivery record used to dedupe repeat alerts. No customer identifiers are stored.
• Support submissions. If you send a message through the App’s help form, we store the message you typed, the shop domain, and any contact address you provided so we can reply. Optionally forwarded to a merchant-configured webhook if B2BDISC_SUPPORT_FORWARD_URL is set.
• Privacy-webhook audit log. A hashed record of every GDPR webhook delivery the App received (topic, a SHA-256 digest of topic|hashed-shop|webhookId|timestamp, outcome, and retry count), used to prove processing without ever storing payload contents. Never contains customer or order data.
• Review-prompt state. Whether we have already prompted you to review the App and whether you dismissed the prompt.
• Instrumentation events. Per-shop lifecycle events (installed, first-publish, alert-preferences-changed) with the shop domain and an event timestamp, used to measure activation and diagnose regressions. No customer or order data.

What we do not do

• We do not store your customers’ names, postal or shipping addresses, email addresses, phone numbers, IP addresses, order contents, or payment details.
• We do not receive order webhooks and do not maintain a copy of your orders. Discount evaluation happens inside Shopify’s Function runtime; only the aggregate outputs the Function returns are visible to Shopify.
• We do not sell, rent, or share your data with third parties for their marketing.
• We do not use your shop’s data to train AI models.
• We do not inject scripts or tracking pixels into your storefront. Discounts run inside Shopify’s own Function runtime.

Sub-processors

• Shopify (Shopify Inc.) — hosts the platform, issues the OAuth tokens the App uses, sends the webhooks we subscribe to, and processes billing for our paid plans.
• DigitalOcean, LLC — hosts the App’s compute (App Platform, U.S. East / New York region). Traffic to the App is served over TLS.
• Neon, Inc. — provides the managed PostgreSQL database where the tables described above are stored. Data is encrypted at rest and in transit.
• Anthropic, PBC — provides the large-language-model API used by the optional draft-a-rule-with-AI feature. Only the merchant-typed rule description is sent; no customer or order data.
• Merchant-configured support-forwarding endpoint (optional). If the merchant sets B2BDISC_SUPPORT_FORWARD_URL, support submissions are also POSTed to that URL. The merchant chooses and controls this endpoint.
• Transactional email (not yet in use). The App does not currently send transactional email. If an email-alert channel ships in a future release, we will update this policy to name the chosen email provider before enabling it.

How data is protected

• Encryption in transit. All traffic to the App and to our sub-processors is served over HTTPS/TLS.
• Encryption at rest. The PostgreSQL database (Neon) encrypts data at rest, as does the underlying App Platform storage (DigitalOcean).
• Access control. Production database and hosting credentials are held only by Smith Crafts LLC operators, are stored as hosting-provider secrets rather than in source control, and are rotated on personnel change.
• Minimum-necessary scope. The App’s installed OAuth scopes are limited to what today’s features require and are listed in our public app configuration. We do not hold any Shopify scope we do not currently use in code.

Data retention & deletion

We retain installation, session, discount-program, activation, alert, AI-draft, AI-usage, support-submission, review-prompt, and instrumentation records while the App is installed. When you uninstall, Shopify sends the App’s app/uninstalled webhook and we immediately delete the shop’s Session rows (including the merchant-staff fields listed above). About 48 hours later Shopify sends the mandatory shop/redact webhook; at that point the App deletes every remaining record for the shop across all enumerated tables above. The privacy-webhook audit log retains only the hashed shop identifier and outcome once records for the shop have been purged.

When Shopify sends a customers/redact webhook, the App acknowledges it and confirms that no customer-scoped records exist to delete — the App does not store data keyed to individual customers. A hashed audit row is written to prove the request was received and processed.

When Shopify sends a customers/data_request webhook, the App acknowledges it and responds that the App holds no personal data about the identified customer. Because the App never stores customer names, addresses, emails, phone numbers, IP addresses, or order contents, that response contains no personal-data inventory. Merchants may also email us at the address below to request deletion or a copy of the data we hold for the shop.

Your rights

Depending on your jurisdiction (including the EU/UK GDPR and the California CCPA/CPRA), you may have rights to access, correct, port, or delete data we hold that relates to you. Merchants can exercise these rights via the Shopify privacy webhooks described above or by emailing [email protected]. We respond within the timeframes required by applicable law. End customers of a merchant’s store should direct requests to the merchant, who is the data controller for their store’s customer data; we act as a processor on the merchant’s behalf.

International transfers

The App is operated from the United States. If you access it from elsewhere, your data may be transferred to and processed in the U.S. under the safeguards required by applicable law.

Changes

We may update this policy; material changes will be reflected by the effective date above and, where features that change data handling are added, in a same-release update. Continued use of the App after an update constitutes acceptance of the revised policy.

Contact

Smith Crafts LLC · Data-protection contact: [email protected].