Privacy Policy

ExpiryGuard ("we", "our", or "us") is an inventory expiry management application built for Shopify merchants. This Privacy Policy explains what data we collect, why we collect it, and how we protect it. We are committed to transparency and data minimisation — we collect only what is necessary to deliver the service.

1. Information We Collect

When you install ExpiryGuard on your Shopify store, we access the following categories of data:

• Shop Information: Your store URL and Shopify session token, used to authenticate API requests and associate expiry records with your store.
• Product Data: Product titles, images, inventory levels, variant prices, and product status — used to display your inventory dashboard and calculate Value at Risk metrics.
• Metafields: We read and write a single metafield (expiry.date) on your products to store the soonest expiry date, enabling storefront badge display via our Theme Extension.
• Order Line Items: When an order is placed, we read the product ID and quantity only from order line items. This data is used exclusively to perform automatic FEFO (First Expired, First Out) batch stock rotation — deducting units from the oldest batch first. We do not read, store, or process customer names, email addresses, phone numbers, shipping addresses, or payment information from orders.
• Expiry Records: Batch labels, expiry dates, and batch quantities that you or your staff enter manually into the app. This data is stored in our database and is entirely under your control.

2. How We Use Your Information

All data collected is used solely to provide ExpiryGuard's core functionality:

• Track expiry dates per product batch and display traffic-light status (Good / Expiring Soon / Expired).
• Calculate Value at Risk — the total retail value of stock approaching expiry.
• Run the Morning Audit to automatically detect expired or expiring items.
• Perform FEFO batch stock deduction when orders are placed, keeping per-batch quantities accurate.
• Display the Freshness Badge on your storefront via our Theme Extension.
• Enable the Liquidation feature to apply discounts to expiring products via Shopify's pricing API.

We do not use your data for advertising, profiling, analytics resale, or any purpose beyond delivering the above functionality.

3. Data Sharing and Third Parties

We do not sell, rent, or share your data with third parties for commercial purposes. Data is shared only in the following circumstances:

• Shopify: We interact with the Shopify Admin API and Webhooks API as required to deliver app functionality. Your data is subject to Shopify's own Privacy Policy.
• Infrastructure Providers: Our app is hosted on Fly.io. Data is stored in an encrypted SQLite database on Fly.io's infrastructure. Fly.io does not have access to your data.
• Legal Requirements: We may disclose data if required to do so by law or in response to valid legal process.

4. Data Retention

We retain expiry records, batch labels, and batch quantities for as long as you have ExpiryGuard installed. Liquidation logs are retained for up to 12 months to support your Value Protected history.

If you uninstall the app, your store's data will be deleted from our database within 48 hours, in accordance with Shopify's mandatory GDPR compliance webhooks (shop/redact). Product metafields written by ExpiryGuard will remain on your Shopify products unless manually removed.

5. Data Security

We take the security of your data seriously:

• All data is transmitted over HTTPS (TLS encrypted in transit).
• Our database is stored on encrypted infrastructure provided by Fly.io.
• Authentication is handled exclusively via Shopify's OAuth flow — we never store your Shopify password.
• Webhook payloads are verified using HMAC signature validation to prevent spoofing.

6. Your Rights

As a merchant using ExpiryGuard, you have the right to:

• Access the data we hold about your store by contacting us.
• Delete your data at any time by uninstalling the app.
• Correct any inaccurate expiry records directly within the app dashboard.

7. GDPR Compliance

ExpiryGuard complies with Shopify's mandatory GDPR webhook requirements. We respond to the following compliance webhooks:

• customers/data_request — We do not store customer personal data, so no customer data export is applicable.
• customers/redact — We do not store customer personal data, so no redaction is required.
• shop/redact — All store data is deleted within 48 hours of receiving this webhook.

8. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last Updated" date at the top of this page. Continued use of ExpiryGuard after changes are posted constitutes your acceptance of the updated policy.

9. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your data, please contact us: