ConsignTrace

Privacy Notice

Last updated: September 24, 2026

This notice explains how ConsignTrace handles information when a merchant installs the ConsignTrace Shopify app, uses its payout tools, or gives a consignor access to a read-only statement portal.

Our role

The merchant generally decides why Shopify order and consignor information is processed. For that information, ConsignTrace acts as a service provider or processor on the merchant's instructions. ConsignTrace acts as a controller for account administration, security, support, and legal compliance information.

Information we process

ConsignTrace does not intentionally persist customer names, customer email addresses, phone numbers, or postal addresses from Shopify orders. It does not sell personal information or use it for advertising.

Why we process information

We use information to authenticate users, synchronize Shopify orders and refunds, calculate and explain consignor payouts, create statements, secure and troubleshoot the service, provide support, and comply with legal obligations. Depending on the context, processing is necessary to provide the service, follows the merchant's instructions, supports legitimate security and service-improvement interests, or is required by law.

Service providers

We use Shopify to provide store authentication and commerce data, Render to host the application and database, Namecheap to provide domain and support-email services, and Better Stack for availability monitoring of our health endpoint. Availability monitoring is not a privacy-request processing or deadline-alert service. These providers process information under their own terms and data-protection commitments. We may also disclose information when legally required or when necessary to protect the service and its users.

Retention and deletion

Authentication sessions are removed when the app-uninstallation notification is successfully processed. Shopify's verified privacy webhooks record customer access, customer-redaction, and shop-redaction requests. Receipt of a request is not proof of completed deletion or delivery: customer requests require scope review and an explicit apply step, and failed or oversized requests remain open for operator handling. Successfully processed shop redactions remove application records, while the minimal safeguards described below remain. Consignor portal links expire after seven days and only a cryptographic hash of the token is stored. Limited security and support records may be retained as needed to investigate incidents, resolve disputes, or meet legal obligations.

During beta, our erasure journal is stored in the same PostgreSQL database as application records. It contains request and store identifiers, relevant order identifiers, the application time, and an integrity hash; it does not contain customer contact details, raw order payloads, or monetary amounts. These identifiers may still be personal data. Minimal erasure receipts and re-import guards remain after application-record deletion to prevent erased data returning; their disposal must account for recoverable backups and there is currently no automatic expiry. Before a database restore, our recovery procedure requires stopping writes, saving the latest journal separately, and reapplying recorded erasures to the isolated restored database before resuming service. We do not currently use an independent external erasure anchor. If both the database and the separately saved journal are lost or incomplete, we may be unable to identify all later erasures from an older backup; complete protection against that loss is not guaranteed.

For our currently recorded Render Hobby workspace configuration, the documented point-in-time recovery window is three days. Render retains generated logical backup exports for seven days. Older backups may still contain information removed from the active database within those windows. Downloaded or manually retained copies can outlast seven days, so seven days is not a guaranteed maximum for all copies or evidence of physical deletion. See Render's recovery documentation. A seven-day portal-link lifetime is not a seven-day data-retention period; the initial 60-day order-import window is not a deletion schedule.

Security and international processing

We use encrypted transport, restricted production-database access, scoped Shopify permissions, signed session and webhook verification, hashed portal tokens, and tenant-scoped records. Providers may process information outside your country using legally recognized safeguards where required. No online service can guarantee absolute security.

Your choices and rights

Merchants can uninstall the app and can contact us about access, correction, deletion, restriction, objection, or portability requests. Customers should normally submit Shopify-order privacy requests to the merchant that controls the store. Consignors may contact the merchant or us about their portal information. Applicable rights vary by location.

Contact

Operator: A.C Simsek, Netherlands. Privacy questions, requests and general support: support@consigntrace.com.

Pre-release notice: retention arrangements, operator contact details, processor terms and international-transfer safeguards require final review before App Store submission. This local notice update has not itself completed that review.