ConsignKit Privacy Policy

1. Who we are

ConsignKit is a Shopify app that helps merchants manage consignment relationships — tracking consignors, assigning products, calculating commissions, and processing payouts — inside the Shopify admin.

Provider: BullMoose Apps
Contact: hello@bullmooseapps.com

2. Information we collect

When you install ConsignKit, with your authorization through Shopify, we access and store the following:

a. Store and account data

• Your store domain, shop ID, and basic shop settings
• Authentication tokens that let the App connect to your store

b. Product and order data (via the Shopify API)

• Products and variants you assign to consignors
• Order and line-item data (sale price, product, date) used to attribute sales and calculate commissions
• Limited customer information associated with orders, only as needed to record a sale. We do not use this for marketing.

c. Data you enter into the App

• Consignor records you create (name, optional email, commission rate, start date, notes)
• Commission profiles, payouts, adjustments, and audit history

d. Technical data

• Log and diagnostic information (timestamps, errors) for operating and securing the App

We do not collect payment card numbers. Billing is handled entirely by Shopify.

3. How we use information

We use the information solely to:

• Provide and operate the App's features (commission tracking, payouts, reports, statements)
• Calculate amounts owed to consignors and generate payout statements
• Send consignor notifications by email, if you enable that feature
• Bill usage-based charges through Shopify (e.g., the per-payout fee on metered plans)
• Maintain security, prevent abuse, debug, and improve the App
• Comply with legal obligations

We do not sell your data or your customers' data, and we do not use it for advertising.

4. Roles (controller / processor)

For consignor and customer personal data processed through the App, you (the merchant) are the data controller and we act as a data processor acting on your instructions. You are responsible for having a lawful basis to provide consignor and customer information to the App and for your own privacy disclosures to those individuals.

5. How we share information

We share information only with service providers that help us run the App, under appropriate confidentiality and data-protection terms:

• Shopify — platform, authentication, and billing
• Fly.io — application hosting and database storage
• Resend — sending consignor email notifications (only if email is enabled)

We may also disclose information if required by law or to protect our rights, users, or the public.

6. Data storage and security

Data is stored on infrastructure operated by our hosting provider Fly.io, region Sydney. We use industry-standard measures — encrypted connections (HTTPS), access controls, and isolation by store — to protect data. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

7. Data retention and deletion

• We retain your data for as long as the App is installed.
• When you uninstall the App, we receive Shopify's app/uninstalled webhook and delete or de-identify your store's data within 30 days, except where retention is required by law.
• We honor Shopify's mandatory privacy webhooks: customers/data_request, customers/redact, and shop/redact.

You may request export or deletion of your data at any time by contacting us at hello@bullmooseapps.com.

8. Your rights

Depending on your location (e.g., GDPR in the EU/UK, CCPA/CPRA in California), you may have rights to access, correct, delete, or restrict processing of personal data, and to data portability. To exercise these rights, contact us at hello@bullmooseapps.com. For consignor or customer data, requests may be directed through the merchant as the controller.

9. International transfers

Your data may be processed in countries other than your own. Where required, we rely on appropriate safeguards (such as Standard Contractual Clauses) for such transfers.

10. Cookies

The App uses only essential cookies/session storage needed to keep you authenticated within the Shopify admin. It does not use advertising or third-party tracking cookies.

11. Children

The App is intended for business use and is not directed to individuals under 16. We do not knowingly collect personal data from children.

12. Changes to this Policy

We may update this Policy from time to time. We will revise the "Effective date" above and, for material changes, provide reasonable notice. Continued use of the App after changes means you accept the updated Policy.

13. Contact