Privacy policy

Last updated 13 November 2026

Box to Shelf is a Shopify app operated by BRAINWAVE S.R.L., Bucharest, Romania (CUI 47608048, Trade Register J40/2465/2023) (“we”). Box to Shelf reads supplier documents that a merchant uploads or emails to it and proposes stock and cost updates the merchant reviews and applies in their Shopify store.

1. Our role

For the content of the documents merchants send us and for the store data we read through Shopify (products, variants, SKUs, barcodes, costs, inventory levels, locations), we act as a processor on behalf of the merchant, who is the controller. We process it only to provide Box to Shelf and on the merchant's instructions. For the minimal account data needed to run and bill the service (shop domain, plan, usage counts) we act as an independent controller.

2. What we process

• Supplier documents: invoices, delivery notes and price lists (PDF, images, CSV/XLSX) and the line items read from them. These are business documents; they can contain supplier contact names, which we do not use for any other purpose.
• Store catalog data read via the Shopify Admin API with the scopes read_products, write_products, read_inventory, write_inventory, read_locations.
• Access tokens issued by Shopify, stored encrypted at rest.
• Email-in metadata: sender address and subject of messages sent to your Box to Shelf address, used to route and filter them.
• Technical logs: request paths, status codes and timings, kept for up to 30 days. We do not log document contents or tokens.

We do not request access to customers or orders and we hold no data about your customers. Requests under Shopify's customers/data_request and customers/redact webhooks are acknowledged and logged; there is nothing to export or delete.

3. No AI training

We do not use merchant documents or store data to train or fine-tune any AI model, and we do not allow our sub-processors to do so. Document reading uses Anthropic's commercial API, under terms that exclude using API inputs and outputs for model training.

4. Sub-processors

We will announce new sub-processors on this page at least 14 days before they start processing merchant data.

5. Retention and deletion

• Uploaded and emailed documents and the lines read from them are deleted 30 days after we receive them. A short history entry (supplier name, date, status, number of lines) stays until you uninstall.
• The record of changes you applied (used for undo and your history) is kept until you uninstall.
• When you uninstall, we delete your access tokens and all store data at once. When Shopify sends the shop/redact request (48 hours after uninstall) we confirm that everything is deleted. Backups roll over within [TO CONFIRM: 14] days.

6. Security

Traffic is encrypted with TLS. Access tokens and stored documents are encrypted at rest. Every request from Shopify is verified (session tokens and HMAC signatures). Access to production is limited to named staff.

7. Security incidents

If we become aware of a personal-data breach affecting your data, we will notify you without undue delay and in any case within 24 hours, by email to the store's contact address and in the app, with what happened, the data concerned, the likely consequences and what we are doing about it, so you can meet your own obligations (for example, the 72-hour GDPR deadline).

8. International transfers

Where data leaves the EEA or UK we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum) or an adequacy decision.

9. Your rights and contact

Merchants can export or delete their data at any time by contacting us or uninstalling the app. Individuals whose data appears in a merchant's documents should contact that merchant; we will assist them. Contact: [TO CONFIRM: privacy@ email], BRAINWAVE S.R.L., Bucharest, Romania. You may also complain to the Romanian supervisory authority (ANSPDCP) or your local authority.

Terms of service