Privacy Policy

Effective Date: October 26, 2026

1. Data Boundaries (No End-Customer or Sales Order Access)

Peksta PO & Transfer Labels operates strictly on merchant catalog and inventory supply-chain entities (Products, Variants, Purchase Orders, Inventory Transfers, and Inventory Shipments). The app does not request, read, process, or store any end-customer personal data (names, emails, shipping addresses, phone numbers) or customer sales orders.

2. Shopify API Scopes Used (100% Read-Only)

read_products — Reads product titles, variant titles, SKUs, retail prices, and barcode strings.
read_inventory_purchase_orders — Reads Shopify Purchase Orders (API version 2026-10).
read_inventory_transfers — Reads Inventory Transfers linked to purchase orders or warehouses.
read_inventory_shipments — Reads Inventory Shipments associated with purchase orders and transfers.
read_inventory_shipments_received_items — Reads line-item accepted, rejected, and canceled quantities on received shipments.

3. Token Encryption & Data Retention

Store OAuth access and refresh tokens are encrypted at rest using AES-256-GCM before being stored in our database. We also store a log of prepared barcode PDF batches (and archival PDF snapshots) so your team can track remaining unprepared quantities and re-download past shipment PDFs. Upon app uninstallation or receipt of Shopify's shop/redact webhook, all records associated with your store are permanently deleted.

We maintain verified HMAC-SHA256 endpoints for customers/data_request, customers/redact, shop/redact, and app/uninstalled in full compliance with Shopify App Store requirements.