FIRM Privacy Policy

Effective date: October 2, 2026

FIRM: Inventory & Purchasing is a product of Northline Core. Northline Core respects the privacy of merchants and their customers. This Privacy Policy explains what information FIRM processes, why we process it, how we protect it, and how long we keep it when merchants use FIRM.

By installing or using FIRM, you acknowledge the data practices described in this Privacy Policy.

1. Information FIRM processes

FIRM processes only the information reasonably necessary to provide its inventory, replenishment, supplier, purchase order, shipment, and related store-management features.

This may include:

• Shopify store and app installation information;
• product, variant, SKU, inventory, and location information;
• supplier information entered by the merchant, including supplier contact email addresses and optional WhatsApp numbers;
• merchant-selected report recipients and purchasing reply-to email addresses;
• merchant store name, contact email, business/location address, timezone, and purchase-order logo or branding snapshots used to keep committed purchase-order records consistent over time;
• transactional email content and delivery metadata for requested reports and supplier purchase orders;
• merchant-configured supplier email and WhatsApp message templates;
• reorder settings and inventory configuration;
• bounded inventory-availability observations used to improve stockout-aware planning;
• purchase orders, shipments, tracking, and receiving records;
• internal purchase-order notes and private files that the merchant chooses to add to a purchase order;
• spreadsheet files uploaded by the merchant for setup review, which are processed only for the requested import workflow;
• app session and authentication information required to connect FIRM to Shopify.

Recent Shopify order data

FIRM also processes limited recent Shopify order data to provide features such as Sales Velocity.

For this purpose, FIRM processes only the minimum order information required for the calculation, such as:

• order identifiers;
• product variant identifiers; and
• current line-item quantities.

FIRM does not request customer names, email addresses, phone numbers, billing addresses, or shipping addresses for this feature.

Recent order information is processed to calculate Sales Velocity and maintain Historical sales metrics such as:

• units sold during the relevant period;
• average units sold per day; and
• estimated inventory days remaining.

FIRM does not persist raw Shopify order payloads or direct customer identity or contact fields for sales analysis. To support Historical sales and longer-term inventory analysis, FIRM retains derived daily unit-sales totals by product variant and a minimal order-linked correction state. That correction state can include Shopify order and line-item identifiers, product variant identifiers, quantities, and order timestamps needed to correct historical totals after order changes or deletions. FIRM may also temporarily cache recent derived sales totals for performance. For Inventory planning, FIRM may also retain bounded daily inventory-availability evidence by inventory item without storing a raw inventory event log.

2. How we use information

FIRM uses information only to provide, maintain, secure, and improve the store-management functionality requested by merchants.

This includes:

• displaying and managing inventory information;
• calculating reorder recommendations;
• managing suppliers and supplier information;
• preparing, sending, and tracking merchant-requested purchase orders, including manual supplier-delivery messages;
• sending merchant-requested inventory email reports;
• managing shipment and receiving workflows;
• storing merchant-added internal purchase-order notes and private files;
• calculating inventory, sales-velocity, and historical-sales metrics;
• reviewing merchant-requested CSV/XLSX setup changes before import;
• authenticating merchants and maintaining app sessions;
• troubleshooting, protecting, and operating the service.

Protected customer data obtained through Shopify is used only for the functionality described above.

3. No sale or advertising use

FIRM does not sell protected customer data.

FIRM does not use Shopify customer or order data for targeted advertising, cross-context behavioral advertising, customer profiling for marketing, unrelated marketing campaigns, or personalization directed at individual Shopify customers.

We do not rent or sell protected customer data to third parties.

4. Data minimization

FIRM is designed to process only the minimum data required for each feature.

For example, Sales Velocity does not require FIRM to access a customer's name, email address, phone number, or postal address, so FIRM does not request those fields.

If FIRM introduces functionality in the future that requires additional protected data, our data practices and Shopify permissions will be updated as required before that information is used.

5. Data retention and deletion

Shopify order information used for Sales Velocity and Historical sales is not retained as raw Shopify order payloads by FIRM. Derived daily historical-sales totals, bounded daily inventory-availability evidence, and the minimal order-linked correction state used to keep those totals accurate are retained on a rolling basis for up to 400 days. Current per-location availability state used to interpret new observations is refreshed from Shopify only while Inventory planning or Inventory economics has been used recently; stale tracking state is removed automatically and is not treated as a permanent inventory ledger.

Merchant operational information, such as inventory configuration, supplier contact details, purchase orders, shipments, receiving records, internal purchase-order notes, private-file metadata, email delivery metadata, supplier message templates, and the saved buyer, delivery-location, timezone, branding, subject, and message snapshots used for committed supplier purchase orders, is retained while reasonably necessary to provide FIRM's services. When a transactional email needs a safe retry, FIRM may temporarily retain the generated attachment bytes needed to retry the exact message. Those attachment bytes are removed after the email provider accepts the message. Merchant-added private purchase-order file bytes are encrypted by FIRM before they are stored in private object storage and remain there only while the file stays attached to the purchase order. They are deleted when the merchant deletes the file or when FIRM processes Shopify's required shop-redaction request. Shop-redaction work is queued durably and completed by FIRM's scheduled cleanup so temporary storage outages can be retried without relying on a long-running webhook request.

Uploaded spreadsheet review drafts are temporary, stop being usable after their short review window, and are removed by FIRM's scheduled cleanup.

When FIRM is uninstalled, app session information is removed and active supplier-access links are revoked. Remaining shop data is deleted when FIRM receives Shopify's required shop-redaction request, except where retention is required by applicable law.

FIRM also responds to Shopify's mandatory privacy and data-deletion requests in accordance with Shopify's requirements. For a Shopify customer data access request, FIRM provides the store owner with the order-linked Historical sales correction data that FIRM currently stores for the requested Shopify order resources. For a customer-redaction request, FIRM removes matching order-linked correction state and its contribution to Historical sales totals. FIRM retains only a non-readable suppression token for a limited period so delayed Shopify events cannot recreate data that was redacted.

6. Security

FIRM uses reasonable technical and organizational safeguards designed to protect information against unauthorized access, alteration, disclosure, or destruction.

Data transmitted between FIRM, Shopify, its email provider, and its infrastructure providers is protected using HTTPS/TLS.

Stored application data is kept with managed infrastructure providers using access controls appropriate to each service. Merchant-added private purchase-order file contents are encrypted by FIRM before being stored in a non-public object-storage bucket.

Access to application data is limited to what is necessary to operate and maintain FIRM.

7. Service providers

FIRM relies on service providers to operate the application, including:

• Shopify, which provides the commerce platform and Shopify APIs;
• Railway, which provides application hosting and private object-storage infrastructure;
• Neon, which provides managed PostgreSQL database infrastructure;
• Resend, which provides transactional email delivery infrastructure.

These providers process information only as necessary to provide their respective services to FIRM.

If a merchant chooses the optional Open WhatsApp action, the merchant's browser opens WhatsApp with the supplier number and prepared purchase-order message. FIRM does not use the WhatsApp Business API for this feature and does not receive WhatsApp delivery or read receipts.

We may update our service providers as the application evolves while maintaining appropriate privacy and security protections.

8. Merchant and customer privacy requests

Shopify merchants and their customers may have rights relating to their personal data under applicable privacy laws.

FIRM supports Shopify's mandatory privacy webhooks for customer data requests, customer redaction requests, and shop redaction requests.

For privacy-related questions or requests, contact:
northlinereorder@proton.me

9. International processing

FIRM's service providers may process information in countries other than the country where the merchant or customer is located.

Where applicable, data is handled subject to the protections and contractual arrangements provided by those service providers and applicable law.

10. Changes to this Privacy Policy

We may update this Privacy Policy when FIRM's features, data practices, legal requirements, or service providers change.

When we make material changes, we will update the effective date shown at the top of this policy.

11. Contact

Northline Core
Product: FIRM: Inventory & Purchasing
Email: northlinereorder@proton.me