Privacy Policy

1. Who we are

Anvil is a Shopify app for inventory and purchase-order management. When you install Anvil, we process data from your store on your behalf to run the service. You (the merchant) control the data; Anvil processes it for you.

2. What we process

To track inventory and suggest reorders, Anvil reads and stores:

• Order and refund data — line items, quantities, prices, and the location each sale or return came from. We use this only to track stock movement and sales velocity.
• Product and inventory data — your catalog, variants, costs, and per-location stock levels, mirrored from Shopify.
• Location data — your store's locations, so stock and transfers map to the right place.
• Records you create in Anvil — purchase orders, suppliers, transfers, adjustments, and valuation history.

3. What we do NOT collect

Anvil does not collect or store protected customer information. We do not store customer names, emails, addresses, or phone numbers. We also don't store payment-card data (Shopify handles billing), and we don't use advertising or third-party tracking cookies.

4. How we use your data

We use your data only to operate Anvil: tracking inventory, computing reorder suggestions, generating and emailing purchase orders to your suppliers, and writing inventory counts and costs back to Shopify. We never sell, rent, or share your data, and we never use it for advertising.

5. Security and sub-processors

All data is encrypted in transit (TLS) and at rest. Shopify access tokens are encrypted with a key kept separate from the application code.

We rely on a few sub-processors to run the service — Vercel (hosting), Neon (database), Inngest (background jobs), Resend (supplier email), and Sentry (error monitoring) — each bound to process your data only on our instructions and never for their own purposes.

6. Retention and deletion

We keep your data only while Anvil is installed. When you uninstall, we stop processing immediately and permanently delete your data within 30 days — see our Retention Policy for details.

You can request a copy of your data, or earlier deletion, at any time by emailing hello@shieldkit.app.

7. Your rights

You and your customers have rights under GDPR and similar laws, including access and deletion. Because Anvil doesn't store protected customer information, most customer data requests don't apply to us. Anvil handles Shopify's data-request and data-erasure webhooks automatically, and honors deletion through the standard uninstall flow.

8. Contact

For any privacy question, data export, or deletion request, email hello@shieldkit.app.