Privacy policy

1. Who this is from

Pidwise is operated by Cleo Wangayi, 3 3rd Street, Westview, Kadoma, Zimbabwe. Questions about this policy go to dev@watacle.com.

Where the app processes personal data about your customers, you are the controller and we act as your processor. Where it processes details about you and your staff, we are the controller.

2. What the app reads from Shopify

These are the only permissions the app asks for. Shopify shows them to you before you install.

read_products, write_products

Product titles, vendor, variant SKUs and barcodes, and the app's own fields on each variant (supplier reference, no-GTIN flag and the result of the last check). The app writes only the fields you edit in it and its own check results.

read_inventory, write_inventory

The HS code and country of origin on each inventory item. The app writes them only when you edit them in the app or import them. It never changes stock quantities.

read_orders, write_orders

For orders shipping to the EU: the order number, the destination country and province, and the line items. The app adds one tag to each of those orders (customs-pid-ok or customs-pid-missing). It also counts units sold to the EU in the last 60 days to rank the fix list.

3. What the app never collects

The app does not request access to customers, and it never stores a customer's name, email address, phone number, street address or postcode. Shopify sends order webhooks with more than the app needs; the app keeps the order id, order number, destination country and line items, and discards the rest before anything is written.

4. What the app stores

Variant checks

For each active variant: product and variant title, vendor, SKU, barcode, supplier reference, HS code, country of origin, the no-GTIN flag, the rules it fails and units sold to the EU. Replaced on every scan.

Order checks

For each EU order: order id, order number, destination country, line items (variant, SKU, title, quantity, unit price, currency), the result and the tag applied. Kept for 13 months, for your audit trail.

Fix history

Each change made through the app: the field, old and new value, whether it came from an edit, an import or a supplier, and the Shopify user id of the staff member who made it.

Files

CSV files you upload and exports you request. Kept for 30 days; export links stop working after 7.

Supplier requests

The vendor name, the email address you enter for that supplier, the variants listed and what the supplier submits. Supplier submissions are never written to your store until you review and apply them.

Your shop record

Shop domain, timezone, plan, settings (including the notification email you choose) and Shopify access tokens.

5. Where it is held, and who else touches it

The database and the application run in the eastern United States. These companies process data on our behalf:

Vercel Inc.

Application hosting, background jobs, scheduled jobs and storage of CSV files you upload or export, deleted after 30 days. United States.

Neon, Inc.

The PostgreSQL database. United States (Northern Virginia).

Resend (Plus Five Five, Inc.)

Sending supplier requests and notices by email, only when email is switched on. United States.

Functional Software, Inc. (Sentry)

Error reports, which carry a shop domain but no customer data. European Union (Frankfurt).

We do not sell data, share it with other merchants, or use it for advertising. Every query is scoped to your shop.

6. When it is deleted

• When you uninstall, your access tokens are deleted immediately.
• 48 hours later Shopify sends a shop redaction request, and every row the app holds for your shop is deleted, along with stored files.
• When Shopify sends a customer redaction request, the order checks for that customer's orders are deleted.
• Short-lived background job records are deleted automatically within 14 days.

The supplier references and no-GTIN flags the app saved to your products are your data in your store. They stay there after you uninstall, and you can delete them from the product page.

7. Your rights

You can ask what we hold about you or your shop, ask us to correct it or delete it, by writing to dev@watacle.com. We answer within 30 days. Requests about your customers reach us through Shopify's data request process, and we answer those too. You can also complain to the Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ), or to the data protection authority where you live.

8. Changes

If this policy changes in a way that matters, the date at the top changes and we tell you in the app.