PrimeCast #003

Privacy Policy

Last updated: September 12, 2026

PrimeCast Stock Money Map ("the App", "we", "our") is designed to provide e-commerce merchants with capital allocation and inventory purchasing intelligence ("Know What to Buy. Know What to Stop Buying."). We are committed to protecting merchant and customer privacy.

1. Data We Access

To compute restock priorities, reorder buffers, and excess capital estimates, the App accesses Shopify store data via official Shopify Admin GraphQL APIs under the following read-only scopes:

• read_products: Product titles, variant IDs, SKU codes, and inventory item associations.
• read_inventory: Inventory levels, available quantities, and incoming transfer quantities by location.
• read_orders: Order quantities and sales timestamps to compute velocity (lead time demand and daily run-rate).
• read_locations: Active fulfillment location identifiers for multi-location inventory mapping.

2. Data We Store & Data We Do NOT Store

• Tokens & Credentials: We store shop authorization tokens securely on isolated staging infrastructure to authenticate GraphQL calls.
• Zero Customer PII: The App does NOT store customer personal data, customer names, addresses, emails, phone numbers, or payment credentials. Sales velocity calculations aggregate SKU units sold without persisting individual customer identities.
• Calculations in Memory: Inventory health evaluations and capital metrics are computed on-demand or transiently.
• Merchant Assistant ("Ask Money Map"): The read-only merchant chatbot does not persist chat history. Conversations exist solely in browser session memory. The assistant receives only non-PII inventory metrics and never accesses or outputs customer personal data.

3. Compliance Webhooks

The App strictly complies with Shopify mandatory compliance webhooks:

• customers/data_request: Handled with cryptographic HMAC verification. The App stores no customer PII.
• customers/redact: Handled with cryptographic HMAC verification. No customer PII is retained.
• shop/redact: Handled with cryptographic HMAC verification. Upon receipt, all stored shop authorization tokens and cached configurations are purged.
• app/uninstalled: Automatically invalidates and deletes stored tokens and cache.

4. Data Security

All communication with Shopify APIs and web browsers is encrypted using TLS/HTTPS. Credentials and authorization tokens are strictly guarded with least-privilege system access.

5. Contact & Inquiries

For privacy questions or data requests, contact: privacy@primecastcore.com or visit Support.