Privacy policy

Last updated: August 2026 · Byte Better Co., Ltd. (“we”, “Shelfy”)

This policy covers Shelfy (commerce operations at app.goshelfy.com) and Shelfy Connect, our Shopify integration.

1. Who we are

Shelfy is operated by Byte Better Co., Ltd. as part of the Sapyne platform. Contact: support@sapyne.com

2. Data we collect

• Account data: email, name, authentication identifiers (via Supabase Auth).
• Store data you enter or sync: products, variants, inventory, locations, orders, purchases, suppliers, and customers.
• Shopify data (when you connect a store): store domain, OAuth access tokens (encrypted at rest), and data permitted by the scopes you approve (products, orders, inventory, locations, customers).
• Technical data: logs, IP addresses, and usage needed for security and reliability.

3. How we use data

• Provide catalog, inventory, and order management.
• Sync data between Shelfy and connected sales channels (e.g. Shopify).
• Authenticate users and enforce access controls per shop (tenant).
• Improve the product, prevent abuse, and comply with law.

4. Shopify merchants & GDPR webhooks

If you install Shelfy Connect on Shopify, we process store data only as needed to provide the integration. We subscribe to Shopify mandatory compliance webhooks (customers/data_request, customers/redact, shop/redact) and act on verified requests within Shopify’s required timelines.

When a shop is uninstalled or requests deletion, we remove OAuth credentials and channel mappings for that store.

5. Sharing & subprocessors

We use infrastructure providers (e.g. AWS Amplify, Fly.io, Supabase, PostgreSQL) to host the service. We do not sell personal data.

6. Retention & security

Data is retained while your account or shop connection is active. OAuth tokens are encrypted. You may disconnect Shopify at any time from Shelfy → Settings → Integrations.

7. Your rights

You may request access, correction, or deletion of your account data by emailing support@sapyne.com. Shopify merchants may also use Shopify’s standard data subject flows; we respond to verified compliance webhooks.

8. Changes

We may update this policy. The “Last updated” date above will change when we do.

Support · Sapyne