Your data · our responsibilities

Privacy policy

Effective September 30, 2026. This policy describes the current RefillLane Shopify app and this website.

Who operates RefillLane

RefillLane is operated by RefillLane, 402 Holstein Ct, Middletown, DE 19709, United States. Contact us about privacy at [email protected].

Merchants decide how customer information is used in their stores. RefillLane processes the store information described below to provide the workflow requested by the merchant. We also use account, technical, and support information to operate and support the app.

Information we process

  • Store and access information: store domain, store name, time zone, installation and subscription status, granted permissions, and Shopify session and access credentials. Shopify authentication can also supply staff identifiers, name, email, locale, and account-role information.
  • Products and schedules: Shopify product identifiers, titles and status; merchant-selected refill intervals, lead times, quantity rules, and enabled state.
  • Orders and customer references: recent order identifiers and names, dates, cancellation/payment status, product identifiers, purchased and remaining quantities, Shopify customer identifiers, and current email marketing permission. Derived review records include due dates, status, and reasons for changes.
  • Operations: sync counts and times, job and webhook identifiers, error codes, privacy-request status, and technical service logs that can include a store domain and request information.
  • Support: the email address and information you voluntarily send us. Please do not send passwords, access tokens, or unnecessary customer details.

The order queries do not request customer email addresses, phone numbers, postal addresses, or payment-card details. Customer email addresses are not stored in review records. Shopify webhook deliveries may contain additional fields; our handlers use the identifiers needed for the event and do not persist the full webhook payload.

Why we use it

We use this information to authenticate the installation, apply product schedules, calculate and review refill dates, check current marketing permission, respond to order changes, provide merchant-requested exports, manage subscriptions through Shopify, prevent repeated trial claims, handle privacy requests, and investigate service problems.

RefillLane does not send customer messages, operate an email campaign, edit Shopify orders or products, sell customer data, use it for advertising, or send it to an AI service. A marketing-permission state does not cause RefillLane to send a message.

Services and locations

The app uses Shopify for authentication, merchant billing, and store APIs. The web application and PostgreSQL database run on DigitalOcean in the New York region of the United States. Authorized operators can retain encrypted operational backup files separately. Support emails are handled through the mailbox provider for the contact address above.

Merchant-requested CSV and privacy exports are delivered to the merchant’s device. The merchant is responsible for the copies they download and any subsequent use. We may disclose information when required by applicable law or to protect the service and legal rights. This policy does not claim a separate signed data-processing agreement or a particular international-transfer certification.

Retention and deletion

While the app is installed, schedules and store configuration remain until uninstall. The app automatically deletes expired online sessions 30 days after their expiry; order-derived review records 13 months after purchase; and customer suppression references 13 months after their last update. A cleanup run is attempted at server start and daily while the app is running. Records for a shop with an outstanding customer-data export are held until that request is resolved, then removed by a subsequent cleanup run. Completed or failed operational jobs and webhook event metadata are deleted after 90 days. Redacted request receipts are kept for 90 days, and merchant-fulfilled request receipts for 180 days after completion. Pending requests are not age-deleted.

When a verified Shopify uninstall notification is received, the app deletes the store’s installation data and associated schedules, reminders, jobs, events, privacy requests, and sessions from the live database. A keyed store fingerprint used to prevent repeated free trials remains until the verified Shopify shop-redaction request removes it.

A verified Shopify customer-redaction request removes linked reminder and suppression data and clears the customer reference from the request record. Data-request exports are limited to the requesting store and customer. The merchant delivers the export to the requester and records completion.

Encrypted database backup snapshots are stored separately from the live database on the operator's designated Windows device. A scheduled daily job attempts to create and verify a fresh encrypted snapshot; older snapshots past 30 days are removed, while the newest valid snapshot is kept until replaced by a newer one. If the device is offline or a backup fails, the most recent valid snapshot remains and its age may exceed 30 days. Live deletion does not rewrite a previously captured snapshot; expired copies are removed by the same local rotation process. Copies outside that designated folder, if made by an operator for recovery, require separate deletion. Contact us about deletion or retention of backup and support records.

Security and your choices

Implemented controls include HTTPS, Shopify authentication, store-scoped database access, webhook signature verification, runtime secret configuration, TLS 1.3 observed on the production database connection, and authenticated encryption for operator backup files. The current database is an App Platform development database; we have not established provider evidence confirming encryption at rest for this database type. No security measure eliminates every risk. We do not claim an independent security certification or a completed third-party security audit.

Depending on your location, you may have rights to access, correct, delete, restrict, or object to processing of your information, or to request a portable copy or raise a concern with a privacy authority. Customers should first contact the merchant whose store they used; merchants and account contacts can email us at the address above. We may need enough information to verify the request and locate the relevant store record. Do not email sensitive credentials.

This app is intended for Shopify merchants. We do not use advertising trackers on this website. Shopify and hosting services process technical information needed to deliver and secure their services. Updates to this policy will be published here with a revised effective date.