Privacy policy.

01. Who we are

Replumi is operated by 1001746566 ONTARIO INCORPORATED, an Ontario, Canada corporation ("Replumi," "we," "us"). This policy covers replumi.com, the Replumi Shopify application, and communications with us. Andrew is responsible for privacy inquiries at andrew@replumi.com.

For store information supplied through Shopify or a merchant, we process it to provide the merchant's inventory planning service. The merchant remains responsible for its relationship with its customers and for providing appropriate notices and permissions. We manage our own website, support correspondence, and service administration.

Replumi is available through the Shopify App Store. The app practices below apply to connected merchant workspaces; visiting this website alone does not connect a store. The service is intended for business users, not children.

02. Information we handle

Shopify store and connection details

Store name, store domain, currency, identifiers, authorized permissions, installation and synchronization status, and credentials needed to maintain the connection. Shopify authentication also supplies information needed to verify a staff member's access. We also store subscription identifiers, plan, billing currency, subscription status and trial eligibility. Shopify processes subscription payments; we do not collect payment card details.

Products, inventory, and sales activity

Product and variant identifiers, titles, SKUs, barcodes, vendors, prices and costs, location names and identifiers, available, physical on-hand and incoming quantities, and order identifiers, dates, cancellation or test status, item quantities and quantities attributed to retail or fulfillment locations, including changes associated with refunds.

Information you enter or import

Supplier names and business contact details, notes, mapped catalog rows, filenames and column mappings, prices, availability, order minimums, case sizes, lead times, purchasing and location rules, cost-basis history and corrections, supplier invoices and credit notes, component recipes, transfer and shipment records, company logos, business and delivery addresses, saved plans, purchase orders, receipts, stocktake counts and differences, staff counter labels and assignments, imported purchasing history, import review records, and beta feedback. For optional Shopify inventory updates, we keep the reviewed quantities, count baselines, location, staff identifiers, timestamps, and Shopify adjustment reference so the inventory update can be checked and duplicate updates prevented.

Support and service operation

Your email address, name, messages and attachments when you contact us; diagnostic records such as internal store and request identifiers, timestamps, synchronization failures, and operator actions. Our servers and service providers also process connection information, such as IP addresses, when handling requests.

Our forecasting queries do not request customer names, email addresses, phone numbers, billing or shipping addresses, or payment card details. Order identifiers can still relate to an individual through the merchant's records; we do not treat all order data as anonymous.

Shopify webhook messages can contain customer details. We verify those messages and filter them to the identifiers needed for processing before saving them to our work queue. Please do not include unnecessary customer details, passwords, or payment information in supplier files, notes, feedback, or support messages.

03. How we use it

We use this information to connect your store, synchronize inventory and sales, estimate demand, compare supplier offers, calculate purchasing recommendations, and maintain your purchasing records. We also use it to answer support requests, investigate errors, protect access, and handle privacy or legal requests.

Recommendations concern stock and purchasing quantities. You review purchasing decisions; Replumi does not automatically send orders to suppliers. We do not sell personal information, share it for cross-context behavioral advertising, or use merchant data to train general-purpose AI models.

Where applicable law requires a legal basis for our own processing, we rely on providing the service you request, legitimate interests in operating and securing it, legal obligations, or consent where required. Information handled on a merchant's behalf is processed for that merchant's service purposes.

Optional inventory updates

If you enable the optional inventory permission, you can choose to add received units or correct physical on-hand counts at a selected Shopify location. We update stock only after you review and confirm the specific receipt or stocktake. Recording a receipt or count without updating Shopify remains available. If you separately enable transfer and shipment permissions, you can create, dispatch and receive transfers between your locations. Each step requires your confirmation in the app. We retain the locations, quantities, staff identifiers, Shopify references and original shipment costs to reconcile stock and avoid duplicate moves. Inventory-update audit records follow the retention rules for your purchasing records.

04. Sharing & service providers

Information is made available to authorized store users and to the operator as needed for support, maintenance, security, and privacy requests. We use these services:

• Amazon Web Services: hosting the website, application, and database. When you send a purchase order through Replumi, Amazon SES processes the recipient address, reply-to address, message, order details and PDF/CSV attachments to deliver it.
• Shopify: store authentication, authorized API access, and store or privacy notifications.
• Zoho Mail: receiving and storing correspondence sent to our Replumi email address.
• Resend: delivering optional merchant email alerts. It processes your chosen recipient address, store name, selected inventory and overdue-order summaries, confirmation and unsubscribe links, and delivery information. You choose the alert categories and confirm your email address before digests begin. Delivery, bounce and complaint feedback helps us stop unwanted or undeliverable alerts. We do not use these alerts for marketing campaigns.
• Discord: operational alerts containing internal reference identifiers, timestamps, and limited error summaries. Store connection, uninstall and trial-expiry notifications also use internal references and links to our private dashboard. Deployment notifications also include software release identifiers, deployment results, and links to workflow runs. The alert integration excludes store names and domains, catalogs, privacy-report contents, and access tokens.
• Google Fonts: delivering the fonts used by our website and application. Your browser contacts Google's servers to load them.

We may also disclose information where reasonably necessary to comply with a legal obligation, respond to a valid legal request, or protect the service and people's rights. If the business is incorporated, reorganized, or transferred, relevant information may transfer to the successor operator, subject to applicable privacy obligations and notice where required.

You choose the supplier recipient and review each purchase-order email before sending. Supplier replies go to the reply-to address you provide. We retain recipient, reply-to, subject, timestamps and sending status for up to 180 days, or until the store is erased. Queued message content is cleared after the send attempt finishes; the purchase order itself follows the store-data retention rules. Email providers and recipients may retain their own copies. Exported files and emails you send to suppliers are under your control. Shopify and other services also handle information under their own applicable terms and privacy notices.

05. Where data is processed

Our primary application hosting and database are on AWS in Northern Virginia, United States. Email, font delivery, and operational service providers may process information in other countries. Information can therefore be processed outside your province, country, or region, where laws and government access rules may differ.

Our merchant data terms describe processing on your behalf and are accepted inside the app. Contact us before onboarding if your business requires a particular data location or additional transfer terms. We do not currently offer a Canada-only or EU-only hosting option.

06. Safeguards

Our safeguards include HTTPS for public connections, an encrypted AWS storage volume for the production database and local backups, encrypted recovery copies in private AWS S3 storage, additional encryption of stored Shopify access and refresh tokens, checks that restrict application access to the relevant store, and restricted server access. Operational logging is designed to avoid recording credentials and full customer webhook messages.

Authorized administrators can access service data when needed for the purposes described here. These measures reduce risk, but no service can guarantee absolute security.

07. Retention & deletion

• Order history: raw Shopify orders and their line items expire after 180 days. Cleanup runs hourly while the service is operating and resumes after outages. Late updates do not reimport expired history. Orders needed to prepare an outstanding privacy report may be held until that report is created; report copies follow the privacy-request process below.
• Connected workspaces: we retain other imported store records, supplier history, saved plans, and purchasing records while needed to provide the workspace, unless removed through an available feature or a verified request. Choosing a shorter forecasting period does not automatically delete older imported records.
• Merchant agreement: we record the accepted terms version, installation, Shopify user ID and acceptance time to establish the store's processing instructions. This record is removed with the workspace during store erasure.
• Uninstallation: processing an uninstall notification clears the stored Shopify credentials and stops further store synchronization. Store records are removed from the live database when Shopify's subsequent store-erasure notification is processed. Shopify normally sends that notification about 48 hours after uninstall; this is not a guarantee that every copy is deleted within 48 hours. If a store-erasure request arrives before uninstall is recorded, we retain it until that installation is uninstalled. An earlier installation's request cannot erase a newer active workspace. Reinstalling before erasure can preserve an active workspace.
• Automatic cleanup after uninstall: if the workspace remains uninstalled seven days after its uninstall notification is processed, we also remove it from the live database without waiting for Shopify's store-erasure notification. Cleanup checks run when the service starts and hourly while it is running. Outstanding access requests or undelivered access reports pause this cleanup so the requests can be fulfilled, and alert the operator for review. Outages, processing failures or these holds can delay removal; seven days is not a guarantee that every copy is deleted at that exact time. Backup copies follow the separate schedule below.
• Customer privacy requests: we use the order identifiers supplied by Shopify to identify relevant activity. Deletion handling removes matching order records and their activity from retained privacy reports, and keeps minimal order identifiers to prevent reimport. Access requests can create reports for an authorized operator to review and securely deliver to the verified store owner. Recording completed delivery erases the report held in the live database. We retain a limited record of the request, review, deletion or delivery method, and completion dates. Delivery and removal of temporary downloaded copies require operator action.
• Work queues and diagnostics: successfully processed webhook payloads are cleared. Failed jobs retain the limited identifiers needed for investigation and retry. Diagnostic and privacy records may remain while needed for service operation and handling the request.
• Store notifications: completed or cancelled delivery records are removed from our live database after 30 days. Pending messages remain for delivery, and store erasure removes all associated notification records. Messages already delivered to Discord have separate access and retention controls.
• Backups: deletion from the live database does not immediately remove existing backup copies. The current local backup process removes copies older than seven days during successful backup runs; a paused or failed backup process can delay cleanup. Encrypted off-server recovery copies in AWS S3 are scheduled to expire after seven days, with replaced versions retained for one additional day. Removal is asynchronous and may take longer. Restored data remains isolated until applicable deletion actions have been reapplied. Backup copies are also considered when reviewing a deletion request.
• Merchant email alerts: preferences, email confirmation and unsubscribe information remain with your store until erased. You can stop alerts in Settings or through the unsubscribe link. Sending and delivery records are retained for up to 90 days. Queued message content is removed after processing or expiry; unprocessed digests expire within 23 hours and email confirmations within one hour. Uninstalling stops further sends; reinstalling requires enabling and confirming alerts again. Resend and recipients may retain their own copies.
• Correspondence and legal records: support messages and request records are kept as needed to resolve the matter, document our response, and meet applicable legal obligations. Where we must retain information despite a deletion request, we explain the applicable reason.

Contact us if you need earlier deletion or a specific retention arrangement. Some requests require manual action; uninstalling does not itself delete emails you previously sent us or copies you exported.

08. Your choices & rights

You can ask what personal information we hold about you, request access or correction, or request deletion. Depending on applicable law, you may also have rights to portability, restriction, objection, or withdrawal of consent. Withdrawing required access can prevent us from providing the app.

Merchants: email andrew@replumi.com with your store domain and the nature of your request. You can also uninstall through Shopify to end the connection.

Store customers: contact the store where you shopped first so it can identify the relevant records and submit a request through Shopify. If you contact us directly, we may coordinate with that merchant.

We verify identity and authority before disclosing or changing data. We aim to complete requests within 30 days, or the applicable legal deadline, and will explain any permitted extension or exception. You may raise concerns with Andrew or with your local privacy regulator, including the Office of the Privacy Commissioner of Canada.

09. Cookies & browser requests

Our public website does not set advertising cookies or run advertising pixels or visitor analytics. The Replumi app uses Shopify authentication tokens rather than its own browser login cookies. We do not install storefront tracking scripts to follow your customers' browsing.

The homepage uses your browser’s time zone and regional setting to suggest a display currency. This calculation stays in your browser: it does not request precise location or send these settings to a geolocation service. If you choose a currency, we save only that preference in local browser storage. You can change it using the currency selector or remove it by clearing site data. It does not change your Shopify subscription’s billing currency.

Google Fonts requests transmit connection information, including your IP address and browser request headers, to Google. Shopify's own pages and authentication may use cookies under Shopify's privacy policy. Links to other websites are governed by those websites' practices.

10. Changes to this policy

We will update this page and its date when our practices or operator details change. For material changes, we will provide an appropriate notice through the website, app, or available contact channel, and obtain consent where required.

The September 15, 2026 incorporation update identifies 1001746566 ONTARIO INCORPORATED as Replumi’s operator. Andrew remains the privacy contact. Our data-processing purposes and safeguards are unchanged by this update. The updated merchant data terms identify the corporation and require acceptance inside the app.