Legal
Privacy Policy
Effective date: 4 August 2026 - Last updated: 4 August 2026
This policy covers two different things that are easy to confuse: the marketing website at primemoq.app, and the Prime MOQ & Order Limits app running inside a merchant's Shopify store. Our legal role is different in each, so section 2 sets that out before anything else.
1. Introduction and who we are
Aspedan Inc. ("Aspedan", "we", "us") publishes Prime MOQ & Order Limits and the website at primemoq.app. Our registered address is 325 Front St West, Suite 300, Toronto, ON M5V 2Y1, Canada.
For privacy questions, requests and complaints, write to support@primemoq.app. That address reaches a person, not a queue.
We have not appointed a Data Protection Officer. Article 37 of the GDPR does not require one for an organisation of our size and processing profile, and claiming a role we have not filled would be worse than saying so.
2. Scope and our two roles
The website. For anything you do on primemoq.app itself, including joining the waitlist, sending a support message and being counted in analytics, Aspedan decides why and how the data is processed. We are the controller and this policy is the notice for that processing.
The app. For data processed inside a merchant's Shopify store through the app, the merchant decides why and how. The merchant is the controller and Aspedan is a processor acting on their documented instructions under Article 28 of the GDPR. That relationship is governed by our Data Processing Agreement, which a merchant accepts by installing the app.
The practical consequence: if you are a shopper and you want your data removed from a store that uses Prime MOQ, the store is who you ask. They can instruct us, and Shopify's mandatory redaction webhooks give them a route to do it without asking us at all.
3. Website visitor data
Analytics
We use Google Analytics 4 (property G-PLL34CRS31) to count page views and see which pages answer a question and which waste a reader's time. It records a cookie identifier, the pages you viewed, the referring site, an approximate location derived from your IP address, and your device and browser type.
Nothing analytics related loads until you accept it. If you refuse, or simply have not chosen yet, the Google Analytics script is never requested. We do not run advertising, retargeting or personalisation tags on this site at all.
The waitlist form
The app is not on the Shopify App Store yet, so the install buttons collect an email address instead. We store exactly three things: the email address you typed, a short label for which page you signed up from, and the time you did it. No name, no IP address, no tracking pixel in the confirmation email. You get one message when the listing goes live. There is no newsletter to unsubscribe from because there is no newsletter.
The support form
The form at /contact stores your email address, the message you wrote and the time you sent it, and forwards the same to our support inbox so we can reply. Please do not put a customer's personal data in a support message. If you need to share an example, a Shopify order number or a product handle is enough.
Server logs
Our host processes standard request metadata (IP address, user agent, requested URL) in the course of serving the page. {{VERIFY: the log retention period Cloudflare applies to this account, and whether any request log is retained by us beyond the edge}}
4. Merchant and store data
When a merchant installs the app, Shopify asks them to grant a set of access scopes. The production app configuration requests the seventeen below. We list all of them, including the ones we do not currently exercise, because that is what a merchant is actually asked to approve.
| Scope | Why the app asks for it |
|---|---|
| read_products, write_products | Resolve which products, variants, collections, vendors and product types a rule applies to, and write the app's own metafields so the checkout function can read a rule without calling back to us. |
| read_validations, write_validations | Register and maintain the cart validation that enforces a rule at checkout. Without it a rule is only a message on a product page. |
| read_customers, write_customers | Read customer tags and segment membership so a rule can apply to wholesale customers only, and write those two facts back to an app-owned customer metafield. The checkout function is sandboxed and cannot query them itself. |
| read_markets | Apply a rule to selected countries only. |
| read_locales | Show the rule message in the languages the store publishes. |
| read_themes | Detect whether the theme app embed is enabled, so setup can tell a merchant what is left to do. |
| write_orders | Subscribe to the paid-order webhook, which is how repurchase limits and the blocked-order statistics work. |
| read_discounts, write_discounts, read_price_rules, write_price_rules, read_cart_transforms, write_cart_transforms, write_merchant_managed_fulfillment_orders | These are requested by the current app configuration but we found no Prime MOQ feature that uses them. They are almost certainly inherited from the codebase this app was built on. {{VERIFY: whether these seven scopes are being removed from shopify.app.toml before launch; if they are, delete this row, and if they are not, replace it with the real reason each one is needed}} |
What the app stores
Shop level configuration: your myshopify domain and public domain, shop name, country, timezone, currency, Shopify plan, primary locale and money format, the access token Shopify issued us, and every rule you create with its scope, schedule, message and design.
Merchant contact details: the store owner's name, email address and phone number as Shopify reports them, plus any address you set for the weekly digest. We use these to email you about the app and to route a customer data request back to you.
Shopper data, which is the part that matters most and the part we will not soften. The app does store some. Specifically:
- The customer email address on each paid order, recorded when the paid-order webhook fires, so repurchase limits and order reporting work.
- The Shopify customer ID, first name and last name of any customer a merchant names directly when scoping a rule to specific people.
- The Shopify customer ID against a list of segment IDs, so the checkout function can tell whether a shopper is in a segment a rule targets.
- The Shopify customer ID of a signed-in shopper whose add-to-cart was blocked by a rule, or who clicked the "contact us" button, so the merchant's dashboard can count those events.
What the app never receives or stores: shopper addresses, phone numbers, payment details or card data. It builds no profile of a shopper, and it never combines data across the stores that use it. Every store's data is isolated to that store.
5. How we use data
| Purpose | Data | Lawful basis | Retention |
|---|---|---|---|
| Providing the app to a merchant | Shop configuration, rules, access token, merchant contact details | Contract (Art. 6(1)(b)). For shopper data inside the store, the merchant's own basis applies and we act as processor | {{VERIFY: the retention period for shop and rule data after uninstall, once the shop/redact handler is implemented}} |
| Telling a waitlist signup that the app has launched | Email address, signup source, timestamp | Consent (Art. 6(1)(a)), given by submitting the form for that stated purpose | Until launch plus 12 months, or until you ask us to delete it |
| Answering a support message | Email address, message contents, timestamp | Legitimate interests (Art. 6(1)(f)): answering someone who wrote to us asking for an answer | {{VERIFY: how long support messages are kept in Supabase and in the support inbox}} |
| Measuring how the website is used | Analytics cookie identifier, page views, referrer, approximate location, device | Consent (Art. 6(1)(a)), and nothing loads before it is given | Up to 24 months from the last visit, per the Google Analytics data retention setting |
| Sending an install, uninstall or plan-change notice to the team | Shop name, shop domain, Shopify plan, Prime MOQ plan | Legitimate interests (Art. 6(1)(f)): knowing the state of our own product. No shopper data is included | {{VERIFY: retention on the internal event pipeline}} |
| Keeping the service secure and abuse free | Request metadata, access tokens, session records | Legitimate interests (Art. 6(1)(f)) and legal obligation (Art. 6(1)(c)) where one applies | Sessions and access tokens are deleted when the app is uninstalled |
8. International transfers
Aspedan is Canadian and our processing is based in Canada. The European Commission's adequacy decision of 20 December 2001 covers transfers of personal data to Canadian organisations subject to PIPEDA, so a transfer from the EEA to us does not need a further safeguard.
Some of our service providers process data in the United States. For those, we rely on the European Commission's Standard Contractual Clauses (Decision 2021/914), and on the UK International Data Transfer Addendum for transfers out of the United Kingdom. We carry out a transfer risk assessment where the clauses require one.
Where a specific provider's processing location is still being confirmed, the sub-processor list says so on that row rather than leaving you to assume.
9. Retention and deletion
We keep data for as long as the purpose in section 5 requires, and no longer. Being precise about that requires periods we can actually honour, and several of ours depend on work that is not finished. Those rows say so.
| Data category | Retention |
|---|---|
| Waitlist email addresses | Until launch plus 12 months, or until you ask us to delete them, whichever is first |
| Support messages | {{VERIFY: how long support messages are kept}} |
| Analytics data | Up to 24 months from the last visit, set on the Google Analytics property |
| Shopify access tokens and sessions | Deleted when the app is uninstalled. The uninstall webhook removes every stored session for the shop, so a revoked token cannot be reused |
| Shop configuration and rules | {{VERIFY: the deletion window after uninstall. Today the uninstall webhook marks the shop as uninstalled but deletes no configuration, and the shop/redact handler that Shopify calls 48 hours later is not yet implemented. This row must not state a period until it does}} |
| Order records containing a shopper email address | {{VERIFY: the retention period for order records. A customer redaction request removes the email address from matching orders today, but there is no scheduled deletion}} |
| Shopper identifiers used for rule targeting and statistics | {{VERIFY: the retention period, and whether the customers/redact handler will be extended to cover rule customer records, segment sync records and the blocked-attempt event log. Today it only clears the order email address}} |
| Merchant contact details | {{VERIFY: the deletion window after uninstall, which depends on the same shop/redact work}} |
10. Your rights
Wherever you live, you can ask us for these things by writing to support@primemoq.app. We respond within 30 days, or sooner where local law requires it. We may ask you to confirm your identity, but only enough to be sure we are not handing your data to someone else. We do not charge for a request, and we do not treat you differently for making one.
If your data sits inside a merchant's store rather than on our website, we will tell you so and route the request to that merchant, who is the controller for it.
If the GDPR or the UK GDPR applies to you
- Access to your personal data and a copy of it (Article 15).
- Rectification of data that is wrong or incomplete (Article 16).
- Erasure, where one of the grounds in Article 17 applies.
- Restriction of processing (Article 18).
- Portability, in a structured, machine readable form (Article 20).
- Objection to processing based on legitimate interests, including profiling (Article 21).
- Not to be subject to a decision based solely on automated processing with a legal or similarly significant effect (Article 22). We make no such decisions.
- Withdrawal of consent at any time, without affecting processing done before you withdrew it.
- A complaint to your supervisory authority. In the UK that is the Information Commissioner's Office.
If you are in California
Under the CCPA as amended by the CPRA you have the right to know what we collect and why, to delete it, to correct it, to opt out of sale or sharing, to limit the use of sensitive personal information, and not to be discriminated against for exercising any of them. We do not sell or share personal information and we do not collect sensitive personal information as that term is defined, so the opt-out and limit rights have nothing to operate on, but the request costs you nothing and we will confirm that in writing.
If you are in Canada
Under PIPEDA you can access the personal information we hold about you, challenge its accuracy, and challenge our compliance with the Act. If our answer does not satisfy you, you can complain to the Office of the Privacy Commissioner of Canada.
If you are in Quebec
Under the Act respecting the protection of personal information in the private sector, as amended by Law 25, you additionally have the right to be informed when personal information is used to make a decision based exclusively on automated processing (we make none), the right to portability, and the right to cessation of dissemination or de-indexing where the conditions in the Act are met. Our privacy contact for Law 25 purposes is the address at the top of this section.
11. Children's privacy
Prime MOQ is a business tool. It is not directed at children and we do not knowingly collect personal data from anyone under 13, or under 16 in the EEA where the applicable member state has set the age at 16. If you believe a child has given us data, write to support@primemoq.app and we will delete it.
12. Security
These are the controls we can confirm are in place today:
- TLS in transit. The website, the app backend and every API call between them run over HTTPS.
- Least privilege on the client side. The website's browser code holds only a publishable key, and every write to our database goes through a server function. Row level security is enabled on the tables holding waitlist and support data, with no public policy, so an anonymous key can neither read nor write them.
- Access tokens are destroyed on uninstall. The uninstall webhook deletes every stored session for that shop, so a revoked Shopify token cannot be replayed.
- Storefront requests are signature verified. Anything reaching us from a theme is checked against Shopify's app proxy signature before we trust a single field on it, including the customer identifier.
- Cross site request forgery protection on every server function.
- Administrative access to our own systems is limited to two named accounts.
{{VERIFY: whether encryption at rest is enabled on the app's PostgreSQL, MongoDB and Redis instances, and whether multi-factor authentication is enforced on the hosting, registry and database accounts. Both are claimed by most policies and neither is visible in the code, so neither is claimed here until confirmed}}
Breach notification. Where we are the controller and a personal data breach is likely to result in a risk to your rights, we notify the competent supervisory authority without undue delay and within 72 hours of becoming aware of it, as Article 33 requires, and we notify affected individuals without undue delay where Article 34 applies. Where we are a processor for a merchant, we notify the merchant within 48 hours of becoming aware, as set out in the DPA.
No system is perfectly secure, and a policy that says otherwise is selling something. What we commit to is the list above, and to telling you promptly when something goes wrong.
13. Changes to this policy and contact
If we change this policy in a way that materially affects you, we will post the new version here with a new effective date and, where the change concerns the app, give merchants at least 30 days notice before it takes effect. Changes to the sub-processor list carry their own 14 day notice, described at /subprocessors.
Aspedan Inc.
325 Front St West, Suite 300, Toronto, ON M5V 2Y1, Canada
support@primemoq.app
Questions
A person reads every message, on any plan. If something on this page is unclear, or you want to exercise a right described in it, write to us and say so plainly.