Privacy Policy
Updated 27 September 2026
This Privacy Policy explains how Vendkit (“we”, “us”) handles data when a Shopify merchant uses Accountly (the “App”), an app for B2B trade accounts: businesses apply, the merchant approves them, and approved businesses get trade prices at checkout.
1. Who we are and our role
The App is operated by Vendkit. When a merchant installs Accountly, the merchant is the data controller and Vendkit acts as a data processor: we process data only to provide the App's features to that merchant, on their instructions. Our processing terms are set out in the Data Processing Addendum in our Terms of Service.
Businesses with questions about their data should contact the store they applied to.
2. Data we access in your store
Accountly asks Shopify only for the permissions it needs:
| Shopify data | Permission | Why we need it |
|---|---|---|
| Customers | read_customers, write_customers | When you approve an application, find or create the customer, add the trade tag and tier, and set tax exemption if you choose. |
| Discounts and checkout rules | write_discounts, write_validations | Switch on Accountly's checkout functions that apply trade prices and trade minimums. |
| Products | read_products, write_products | Let you choose products for minimum quantities and save the minimum on the product. |
| Orders and draft orders | read_orders, write_draft_orders | Show your trade sales, and (Pro) create orders on account with payment terms when a trade customer asks. |
| Files | write_files | Save certificates uploaded with applications into your own Shopify Files. |
3. Data we store
| What | Details | Kept for |
|---|---|---|
| Applications | Business name, contact name, email, phone, website, type of business, tax ID, state and country, message, a link to the certificate, and your decision and note. | Approved: while the business is a trade customer. Declined: 12 months, then deleted. |
| Trade customers | The Shopify customer id, business and contact name, email, tier, tax-exempt status and certificate expiry date. | Until you remove their trade status or uninstall. |
| Trade orders | Order number, total, currency and whether it was placed on account — for your dashboard. | Until you uninstall. |
| Store settings | Tiers, minimums, email and ordering-on-account settings, plan and setup progress. | Until you uninstall. |
| Session details | The access token Shopify gives the App to act on your store. | Until you uninstall. |
Accountly does not store postal addresses or payment details. Orders on account use the address already saved on the customer in Shopify.
4. Why we process it (legal basis)
| Purpose | Legal basis |
|---|---|
| Reviewing applications and running trade accounts | Performance of our contract with the merchant (and the merchant's contract with the business) |
| Trade prices, minimums and orders on account at checkout | Performance of contract |
| Certificate expiry reminders (Pro) | The merchant's legitimate interest in keeping tax exemptions valid |
| Keeping the App secure and fixing errors | Our legitimate interest in running a reliable service |
| Billing your plan through Shopify | Performance of contract |
5. Who we share data with
We never sell or rent data. We use these providers (sub-processors) to run the App:
| Provider | What they do | Location |
|---|---|---|
| Shopify | The platform the App runs on; customers, orders and files; billing. | Canada / global |
| Railway | Hosts the App's servers. | United States (East) |
| Supabase | Database, encrypted at rest. | Canada (Montréal) |
| Resend | Sends application, approval and reminder emails. | United States |
| Sentry | Error monitoring. Personal data is removed from error reports before they are sent. | United States |
6. International data transfers
Data may be processed in Canada and the United States. Where data from the European Economic Area, the United Kingdom or Switzerland is transferred, we rely on the safeguards offered by our providers, such as the European Commission's Standard Contractual Clauses and Canada's adequacy decision.
7. Retention and deletion
- Declined applications are deleted automatically after 12 months.
- When you uninstall, Shopify asks us about 48 hours later to delete your store's data. We then permanently delete everything we hold for your store.
- We act on all of Shopify's mandatory privacy requests: customer data request, customer redact (we delete the customer's applications, certificate files, trade record and order rows) and shop redact.
8. Cookies
Accountly sets no cookies and uses no tracking on your storefront.
9. Your rights
Depending on where you live, laws such as the GDPR and CCPA give you rights to access, correct, delete, restrict or port your personal data, and to object to processing. Merchants can exercise these rights by contacting us or by uninstalling the App; businesses should contact the store they applied to, which can ask us for help. You may also complain to your local data-protection authority.
10. Security
All data is sent over HTTPS and stored in encrypted databases. Every request from Shopify — including each application and order placed on account — is verified with its signature before we act on it; the signed-in customer is taken from Shopify's signed request, never from the browser, and prices are always re-read from Shopify. Storefront requests are rate-limited, access to production systems is limited to the App's operator, and we keep daily database backups.
11. Children
The App is a business tool and is not directed at children. We do not knowingly process children's data.
12. Changes to this policy
We may update this policy as the App changes. The “Updated” date at the top shows when it last changed; for significant changes we will notify merchants in the App.
13. Contact us
Vendkit — vendkit.support@gmail.com. We reply within one business day.