Privacy Policy
Updated 27 September 2026
This Privacy Policy explains how Vendkit (“we”, “us”) handles data when a Shopify merchant uses Sheetwell (the “App”), an app that builds PDF catalogs and line sheets from the merchant's products and can share them through a page in the merchant's store.
1. Who we are and our role
The App is operated by Vendkit. When a merchant installs Sheetwell, the merchant is the data controller and Vendkit acts as a data processor: we process data only to provide the App's features to that merchant, on their instructions. Our processing terms are set out in the Data Processing Addendum in our Terms of Service.
2. Data we access in your store
Sheetwell asks Shopify only for the permissions it needs:
| Shopify data | Permission | Why we need it |
|---|---|---|
| Products and collections | read_products | Read titles, photos, prices, SKUs, barcodes and descriptions to build your catalogs. |
| Inventory | read_inventory | Show stock levels and leave out sold-out products, if you choose. |
Sheetwell does not ask for access to orders or customers.
3. Data we store
| What | Details | Kept for |
|---|---|---|
| Catalogs | Each catalog's title, the collections and products it includes, layout, price settings, share link name and (if you set one) a securely hashed password. | Until you delete the catalog or uninstall. |
| Price lists | The names and discounts you create, e.g. “Designer · 20% off”. | Until you delete them or uninstall. |
| View counts | For each shared catalog: how many times it was viewed and downloaded per day. No viewer, device or IP address is recorded. | 24 months, then deleted. |
| Store settings | Paper size, logo link, name, colour and contact line for covers, plan and setup progress. | Until you uninstall. |
| Session details | The access token Shopify gives the App to act on your store. | Until you uninstall. |
Product details are read from Shopify each time a catalog is built and are not stored by us. PDFs are generated on request and not kept.
4. Why we process it (legal basis)
| Purpose | Legal basis |
|---|---|
| Building and sharing your catalogs | Performance of our contract with the merchant |
| View and download counts shown to the merchant | Performance of contract; the data is anonymous |
| Keeping the App secure and fixing errors | Our legitimate interest in running a reliable service |
| Billing your plan through Shopify | Performance of contract |
5. Who we share data with
We never sell or rent data. We use these providers (sub-processors) to run the App:
| Provider | What they do | Location |
|---|---|---|
| Shopify | The platform the App runs on; source of product data; billing. | Canada / global |
| Railway | Hosts the App's servers. | United States (East) |
| Supabase | Database, encrypted at rest. | Canada (Montréal) |
| Sentry | Error monitoring. Personal data is removed from error reports before they are sent. | United States |
6. International data transfers
Data may be processed in Canada and the United States. Where data from the European Economic Area, the United Kingdom or Switzerland is transferred, we rely on the safeguards offered by our providers, such as the European Commission's Standard Contractual Clauses and Canada's adequacy decision.
7. Retention and deletion
- Daily view counts are deleted after 24 months.
- When you uninstall, Shopify asks us about 48 hours later to delete your store's data. We then permanently delete everything we hold for your store.
- We respond to all of Shopify's mandatory privacy requests. Because Sheetwell holds no customer data, customer requests have nothing to return or delete.
8. Cookies
Sheetwell sets no cookies and uses no tracking on your storefront or share pages.
9. Your rights
Depending on where you live, laws such as the GDPR and CCPA give you rights to access, correct, delete, restrict or port your personal data, and to object to processing. Merchants can exercise these rights by contacting us or by uninstalling the App. You may also complain to your local data-protection authority.
10. Security
All data is sent over HTTPS and stored in encrypted databases. Every request from Shopify is verified with its signature before we act on it; share-link passwords are stored only as salted hashes, and share pages are rate-limited. Access to production systems is limited to the App's operator, and we keep daily database backups.
11. Children
The App is a business tool and is not directed at children. We do not knowingly process children's data.
12. Changes to this policy
We may update this policy as the App changes. The “Updated” date at the top shows when it last changed; for significant changes we will notify merchants in the App.
13. Contact us
Vendkit — vendkit.support@gmail.com. We reply within one business day.