Privacy policy

Draft · last updated 18 October 2026

Who we are

MostStack ("we", "us") provides the MostStack app for Shopify, which reads supplier files and keeps a store's inventory and products up to date. Contact: privacy@moststack.com.

What the app reads from your store

When you install the app, Shopify grants it these permissions and nothing more:

• Products (read): titles, variants, SKUs, barcodes, prices and cost, to match supplier rows to your products.
• Inventory (read and write): quantities per location, to send stock changes.
• Locations (read): to let you pick the location a supplier stocks.
• Products (write): only if you choose to create products from a supplier file. Asked for separately, at that moment.

The app never requests access to orders, customers, or any personal data about your customers. It does not read or store customer data.

What we store

• Your store's domain and the access token Shopify issues to the app. Tokens are encrypted at rest with a key held in Google Cloud KMS.
• The supplier files you connect, the rows read from them, and a history of what changed between imports.
• A copy of your store's products, variants and inventory levels, refreshed before each sync.
• Logins for your own supplier connections (FTP/SFTP servers, Google Drive files you pick), encrypted at rest and usable only for your store.
• The email address and name of each person you invite, and an activity log of what they did in the app.
• Usage numbers (imports, rows, changes) for billing.

Where it is stored and processed

Data is stored and processed on Google Cloud in the European Union (europe-west1, Belgium). Supplier files that contain no personal data are kept so an import can be reviewed later. If you connect an email inbox, only the attachments and the sender, subject and file name of matched messages are kept.

Sub-processors

• Google Cloud: hosting, database, file storage, key management, email delivery.
• Anthropic: reading PDF price lists and recognising columns in spreadsheets, only when you use those features. The rows sent are product data from the file, never customer data.
• Shopify: billing and the store connection itself.

When you uninstall

Uninstalling the app revokes its access token immediately and pauses your workspace. Shopify sends us a shop/redact request 48 hours later, after which your store's data is deleted. You can ask us to delete it sooner at any time.

GDPR requests from Shopify

The app answers Shopify's mandatory customers/data_request, customers/redact and shop/redact webhooks. Because the app holds no customer data, the first two are acknowledged with nothing to return or erase; the third deletes the store's data as described above.

Your rights

You can ask to see, correct, export or delete the data we hold about you or your store. Write to privacy@moststack.com. If you are in the EU/EEA you may also complain to your local data protection authority.

Changes

We will post changes to this policy on this page and update the date at the top. Material changes are announced in the app.