Privacy Policy
Wholesale Runner ("the app", "we") is a Shopify app that lets merchants sell to approved wholesale buyers from their existing store. This policy explains what data the app handles, why, and what happens to it. It is written to match what the app actually does — nothing more.
Who this covers
Two groups of people interact with the app:
- Merchants — Shopify store owners who install the app.
- Wholesale applicants and customers — people who apply for, or hold, a wholesale account on a merchant's store. For their data, the merchant is the data controller and we act as a processor on the merchant's behalf.
What we collect, and why
From Shopify, for merchants: your store's name, domain, contact email, and an API access token — required for the app to operate on your store at all. Billing runs entirely through Shopify's billing system; we never see or store payment card details.
From Shopify, for customers: when a merchant approves a wholesale application or assigns a customer to a price group, we read and write that customer's ID, email address, tags, and app-owned metafields through Shopify's API. This is what makes wholesale pricing apply to the right person and is the only customer data the app touches in Shopify.
From wholesale applicants: when someone submits the wholesale application form on a merchant's storefront, we store what they enter — email address, and optionally first and last name, company, phone number, tax/resale ID, and a free-text note — together with the submission time and the submitting IP address (kept solely so abusive submissions can be traced). This information is shown to the merchant so they can decide on the application.
Configuration data: the pricing rules, customer group assignments, order rules, and product exclusions a merchant creates. Rule configuration is also written to app-owned metafields on the merchant's own Shopify store, where Shopify's checkout reads it.
What we do not do
- We do not sell, rent, or trade any data.
- We do not use customer or applicant data for advertising or profiling.
- We do not share data with any third party other than Shopify itself, which the app necessarily communicates with to function.
- The app does not set tracking cookies on merchant storefronts.
Where data lives, and how it moves
App data is stored in our own database on servers we operate. All traffic between your browser, merchant storefronts, Shopify, and our servers is encrypted in transit over HTTPS/TLS.
Retention and deletion
The app implements Shopify's mandatory privacy webhooks, and deletion is automatic — no request to us is needed:
- Customer data requests (GDPR Article 15): when a customer asks their merchant for their data, Shopify notifies us and we return what we hold for that customer.
- Customer deletion: when a customer asks to be forgotten, Shopify notifies us and we delete their group assignments and wholesale applications.
- Store deletion: after a merchant uninstalls the app, Shopify instructs us to purge the store's data, and we delete all of it — price groups, customer assignments, applications, exclusions, and sync logs.
Your rights
Depending on where you live (including under the GDPR and CCPA/CPRA), you may have the right to access, correct, export, or delete personal data held about you, and to object to its processing. Wholesale applicants and customers should contact the merchant they applied to first, as the merchant controls that relationship; we act on merchants' instructions and on Shopify's privacy webhooks. Merchants and anyone else can contact us directly using the details below, and we will respond within 30 days.
Changes
If this policy changes materially, the date above will be updated and merchants will be notified through the app.