Privacy Policy

AddToWholesale is a Shopify app operated by Texvion LLC ("we", "us", "Texvion"). We help Shopify merchants offer wholesale prices to the customers they tag as wholesale, without spreadsheets or discount codes.

This policy explains what data we collect, why we collect it, how we use it, who we share it with, and how you can exercise your rights over it. It applies to the AddToWholesale Shopify app, the marketing site at addtowholesale.com, and the embedded app at app.addtowholesale.com.

From merchants who install the app

• Shop information: your shop domain (e.g. your-store.myshopify.com) and the access token Shopify issues when you authorize the app (stored encrypted). We do not store your shop name or your account owner's email.
• Plan & subscription state: which plan you're on, your subscription ID and status, and the current billing period end date. We read this from Shopify (Shopify's billing API and subscription webhooks). Shopify bills you directly — the app never sees or processes payment card details.
• App settings you create:your wholesale tag name, signup-form text, policies and fields, the email addresses you enter to receive new-application notifications, and the wholesale prices and minimum order quantities you set per variant.
• Wholesale order metadata: for orders placed by customers who carry your wholesale tag only, we keep the order ID, total, currency, customer ID, customer name and email, and timestamps to power your dashboard metrics. We do not store full order line items.
• Activity log: a history of actions taken on wholesale customers in the app, including the customer's name and email at the time of the action.

From your wholesale applicants (end customers)

When a customer fills out your wholesale signup form, we receive only what they submit:

• First name, last name, email, phone
• Company name, tax ID, business address
• Any custom fields you've added to the form (configured in your app settings)
• Any documents they upload (PDF or common image formats such as JPG/PNG; e.g. resale certificates, business licenses)
• Application date and any private notes you write about them

Uploaded documents are stored in your Shopify Files library, not on Texvion infrastructure. We only store the Shopify File IDs that point to them.

When an application is submitted, the app also creates (or reuses) a customer record in your Shopify store and saves the application details to that customer, so you can see them in your Shopify admin.

Collected automatically

• Server logs: our hosting provider (Vercel) records basic request details such as IP address, user agent, request path, response code, and timestamp. Used for debugging and abuse prevention, and kept only for the limited period Vercel retains logs.
• Error and performance diagnostics: when something goes wrong in the app, we send technical details (error message, stack trace, the page or route involved, browser and device type, and timing data) to Sentry so we can find and fix the problem. We minimise personal data in these reports: Sentry is configured not to collect personal data by default, and request bodies (such as form submissions) are removed before sending.
• Session replay (embedded app only): for a sample of merchant sessions in the embedded app (about 10%, plus sessions where an error occurs), Sentry records a replay of how the page changed. All text is masked and all images and media are blocked, so the replay shows page layout and clicks, not your data. Replay is not used on your storefront or the signup form.
• No analytics or marketing trackers on the embedded app. The marketing site (addtowholesale.com) may use privacy-respecting analytics (Vercel Analytics or similar) that do not use cookies and do not track individuals across sites.

We use the data we collect only to:

• Run the AddToWholesale app for your store (the service you signed up for)
• Store the wholesale applications your customers submit, so you can review them
• Send you (the merchant) a notification email for each new wholesale application. We do not send emails to your applicants.
• Apply your wholesale prices at the customer's checkout
• Show you metrics (revenue, top wholesale customers) on your dashboard
• Find and fix errors and performance problems in the app
• Provide customer support if you contact us
• Detect and prevent abuse, fraud, and security incidents
• Comply with our legal obligations

We do not sell, rent, or share your data with advertisers. We do not use your data — or your customers' data — to train machine learning models or for any purpose unrelated to running the app.

To run the app, we share specific data with these vetted infrastructure providers. Each operates under their own privacy and security certifications:

We do not use any other third parties to access merchant or customer data. If our subprocessor list changes, we will update this page.

• Encryption in transit: all network traffic uses TLS 1.2+.
• Encryption at rest: Shopify access tokens are encrypted with AES-256-GCM before being written to our database. Supabase encrypts the underlying database storage.
• Tenant isolation: every database query is scoped to your shop ID. Code-enforced; cross-tenant access is not possible.
• File uploads: validated by file-type allowlist (PDF, JPG, PNG, WEBP, GIF only) plus magic-byte verification. Files pass through our server only to be checked and forwarded to your Shopify Files library — we don't write them to disk or keep a copy.
• Least-privilege scopes: we request only the Shopify scopes the app actually needs. Each scope is documented in the install consent screen.

Under GDPR, CCPA, and similar laws, you and your customers have these rights:

• Access: request a copy of the data we hold about you.
• Correction: ask us to fix inaccurate or incomplete data.
• Deletion: request that we erase your data (subject to legal obligations to retain certain records).
• Portability: receive your data in a machine-readable format.
• Objection: object to specific processing activities.
• Withdraw consent: where processing is based on consent, withdraw it at any time.

For end customers (your wholesale applicants), the merchant who runs the store is the data controller. Forward customer requests to support@addtowholesale.com. Shopify also exposes standardized GDPR webhooks (customers/data_request, customers/redact, shop/redact) — we honor all three. For a data request, the merchant can see all of that customer's application data in the app.

• Active install: we keep your data for as long as the app is installed and your subscription is active.
• After uninstall: all data tied to your shop is deleted from our database promptly after you uninstall, as soon as Shopify notifies us through its app/uninstalled webhook. Files in your Shopify Files library are not deleted on uninstall — they belong to your Shopify account.
• Customer deletion requests: when Shopify sends a customers/redact request for one of your applicants, we delete that applicant's application data and the documents they uploaded to your Shopify Files library, and we remove their name and email from your activity log and order records (order totals and dates are kept for your reports).
• Shop deletion requests: when Shopify sends shop/redact (48 hours after the app is uninstalled), we delete any records for your shop that remain.
• Server logs and error reports: kept only for the limited retention periods of our providers (Vercel and Sentry), then automatically deleted.
• Backups: Supabase database backups may retain deleted records for up to 7 days before they expire.

Texvion is based in the United States. Our database (Supabase), email provider (AWS SES), and error-monitoring provider (Sentry) are also in the U.S. If you are outside the U.S., your data is transferred to and processed in the U.S. We rely on Shopify's standard contractual clauses with merchants and on each subprocessor's own data-transfer mechanisms (SCCs, adequacy decisions, etc.) for compliance with EU/UK GDPR and similar laws.

AddToWholesale is a B2B tool for Shopify merchants. We do not knowingly collect data from anyone under 16. If you believe a child has submitted data through our app, contact us and we will delete it.

The embedded app at app.addtowholesale.com uses only the cookies Shopify itself sets to authenticate merchants. We set no tracking, advertising, or analytics cookies on the embedded app. The embedded app does use Sentry for error monitoring and masked session replay (see section 2) — only to fix problems, never for advertising.

The marketing site (addtowholesale.com) may use a privacy-respecting first-party analytics tool (e.g. Vercel Analytics) that does not use cookies and does not identify individual visitors.

We may update this policy as the app evolves. Material changes will be announced via the app or via email to the merchant's registered email. The "Last updated" date at the top of this page always reflects the current version.

Privacy questions, data requests, or anything else:

• Email: support@addtowholesale.com
• Operator: Texvion LLC
• App: AddToWholesale on the Shopify App Store