Legal
Privacy Policy
Effective date: 4 August 2026 - Last updated: 5 August 2026
This policy covers two different things that are easy to confuse: the marketing website at primemoq.app, and the Prime MOQ & Order Limits app running inside a merchant's Shopify store. Our legal role is different in each, so section 2 sets that out before anything else.
1. Introduction and who we are
Aspedan Inc. ("Aspedan", "we", "us") publishes Prime MOQ & Order Limits and the website at primemoq.app. Our registered address is 325 Front St West, Suite 300, Toronto, ON M5V 2Y1, Canada.
For privacy questions, requests and complaints, write to support@primemoq.app. That address reaches a person, not a queue.
We have not appointed a Data Protection Officer. Article 37 of the GDPR does not require one for an organisation of our size and processing profile, and claiming a role we have not filled would be worse than saying so.
2. Scope and our two roles
The website. For anything you do on primemoq.app itself, including joining the waitlist, sending a support message and being counted in analytics, Aspedan decides why and how the data is processed. We are the controller and this policy is the notice for that processing.
The app. For data processed inside a merchant's Shopify store through the app, the merchant decides why and how. The merchant is the controller and Aspedan is a processor acting on their documented instructions under Article 28 of the GDPR. That relationship is governed by our Data Processing Agreement, which a merchant accepts by installing the app.
The practical consequence: if you are a shopper and you want your data removed from a store that uses Prime MOQ, the store is who you ask. They can instruct us, and Shopify's mandatory redaction webhooks give them a route to do it without asking us at all.
3. Website visitor data
Analytics
We use Google Analytics 4 to count page views and see which pages answer a question and which waste a reader's time. It records a cookie identifier, the pages you viewed, the referring site, an approximate location derived from your IP address, and your device and browser type.
Nothing analytics related loads until you accept it. If you refuse, or simply have not chosen yet, the Google Analytics script is never requested. We do not run advertising, retargeting or personalisation tags on this site at all.
The waitlist form
The app is not on the Shopify App Store yet, so the install buttons collect an email address instead. We store exactly three things: the email address you typed, a short label for which page you signed up from, and the time you did it. No name, no IP address, no tracking pixel in the confirmation email. You get one message when the listing goes live. There is no newsletter to unsubscribe from because there is no newsletter.
The support form
The form at /contact stores your email address, the message you wrote and the time you sent it, and forwards the same to our support inbox so we can reply. Please do not put a customer's personal data in a support message. If you need to share an example, a Shopify order number or a product handle is enough.
Server logs
Our host processes standard request metadata (IP address, user agent, requested URL) in the course of serving the page, and keeps it only briefly, for security and to diagnose a fault. We do not build any profile from it and we do not use it for analytics.
4. Merchant and store data
When a merchant installs the app, Shopify asks them to grant a set of access scopes. These are the ones the app requests, and what each is for. We ask for nothing the product does not use.
| Scope | Why the app asks for it |
|---|---|
| read_products, write_products | Resolve which products, variants, collections, vendors and product types a rule applies to, and write the app's own metafields so the checkout function can read a rule without calling back to us. |
| read_validations, write_validations | Register and maintain the cart validation that enforces a rule at checkout. Without it a rule is only a message on a product page. |
| read_customers, write_customers | Read customer tags and segment membership so a rule can apply to wholesale customers only, and write those two facts back to an app-owned customer metafield. The checkout function is sandboxed and cannot query them itself. |
| read_markets | Apply a rule to selected countries only. |
| read_locales | Show the rule message in the languages the store publishes. |
| read_themes | Detect whether the theme app embed is enabled, so setup can tell a merchant what is left to do. |
| write_orders | Subscribe to the paid-order webhook, which is how repurchase limits and the blocked-order statistics work. |
What the app stores
Shop level configuration: your myshopify domain and public domain, shop name, country, timezone, currency, Shopify plan, primary locale and money format, the access token Shopify issued us, and every rule you create with its scope, schedule, message and design.
Merchant contact details: the store owner's name, email address and phone number as Shopify reports them, plus any address you set for the weekly digest. We use these to email you about the app and to route a customer data request back to you.
Shopper data, which is the part that matters most and the part we will not soften. The app does store some. Specifically:
- The customer email address on each paid order, recorded when the paid-order webhook fires, so repurchase limits and order reporting work.
- The first name and last name of any customer a merchant names directly when scoping a rule to specific people.
- A Shopify customer identifier against the segments a shopper belongs to, so the app can tell whether a rule that targets a segment applies to them.
- A Shopify customer identifier for a signed-in shopper whose add-to-cart was blocked by a rule, or who clicked the "contact us" button, so the merchant's dashboard can count those events.
What the app never receives or stores: shopper addresses, phone numbers, payment details or card data. It builds no profile of a shopper, and it never combines data across the stores that use it. Every store's data is isolated to that store.
5. How we use data
| Purpose | Data | Lawful basis | Retention |
|---|---|---|---|
| Providing the app to a merchant | Shop configuration, rules, access token, merchant contact details | Contract (Art. 6(1)(b)). For shopper data inside the store, the merchant's own basis applies and we act as processor | Kept while the app is installed. On uninstall the access token and every session are deleted at once; the rest is deleted on request, as set out in section 9 |
| Telling a waitlist signup that the app has launched | Email address, signup source, timestamp | Consent (Art. 6(1)(a)), given by submitting the form for that stated purpose | Until launch plus 12 months, or until you ask us to delete it |
| Answering a support message | Email address, message contents, timestamp | Legitimate interests (Art. 6(1)(f)): answering someone who wrote to us asking for an answer | Kept as correspondence, so a thread can be picked up later. Ask us to delete yours and we will |
| Measuring how the website is used | Analytics cookie identifier, page views, referrer, approximate location, device | Consent (Art. 6(1)(a)), and nothing loads before it is given | Up to 24 months from the last visit, per the Google Analytics data retention setting |
| Knowing when a store installs, uninstalls or changes plan | Shop name, shop domain, Shopify plan, Prime MOQ plan | Legitimate interests (Art. 6(1)(f)): knowing the state of our own product. No shopper data is included | Kept as part of our own operating records for as long as the account exists |
| Keeping the service secure and abuse free | Request metadata, access tokens, session records | Legitimate interests (Art. 6(1)(f)) and legal obligation (Art. 6(1)(c)) where one applies | Sessions and access tokens are deleted when the app is uninstalled |
8. International transfers
Aspedan is a Canadian company. The European Commission's adequacy decision of 20 December 2001 covers transfers of personal data to Canadian organisations subject to PIPEDA, so a transfer from the EEA to us does not need a further safeguard.
The services we run on, including the hosting behind the app, process data in the United States. For those transfers we rely on the European Commission's Standard Contractual Clauses (Decision 2021/914), and on the UK International Data Transfer Addendum for transfers out of the United Kingdom. We carry out a transfer risk assessment where the clauses require one.
The country each provider processes in is named on its row in the sub-processor list, so you can check rather than assume.
9. Retention and deletion
We keep data for as long as the purpose in section 5 requires, and no longer. Where a row says data is deleted on request rather than on a timer, that is deliberate: we would rather commit to something we honour than publish a schedule that sounds better.
| Data category | Retention |
|---|---|
| Waitlist email addresses | Until launch plus 12 months, or until you ask us to delete them, whichever is first |
| Support messages | Kept as correspondence so a thread can be picked up later, and deleted when you ask us to |
| Analytics data | Up to 24 months from the last visit, set on the Google Analytics property |
| Shopify access tokens and sessions | Deleted when the app is uninstalled. The uninstall webhook removes every stored session for the shop, so a revoked token cannot be reused |
| Shop configuration and rules | Kept while the app is installed, and after uninstall so that reinstalling restores your setup. Deleted within 30 days of a request from the merchant |
| Order records containing a shopper email address | The email address is erased from the matching orders when the store sends us a customer redaction request. The records are otherwise deleted with the rest of the store's data, on request |
| Shopper identifiers used for rule targeting and statistics | Erased on a customer redaction request from the store, and otherwise deleted with the rest of the store's data, on request |
| Merchant contact details | Kept while the app is installed, and after uninstall until the merchant asks us to delete them |
10. Your rights
Wherever you live, you can ask us for these things by writing to support@primemoq.app. We respond within 30 days, or sooner where local law requires it. We may ask you to confirm your identity, but only enough to be sure we are not handing your data to someone else. We do not charge for a request, and we do not treat you differently for making one.
If your data sits inside a merchant's store rather than on our website, we will tell you so and route the request to that merchant, who is the controller for it.
If the GDPR or the UK GDPR applies to you
- Access to your personal data and a copy of it (Article 15).
- Rectification of data that is wrong or incomplete (Article 16).
- Erasure, where one of the grounds in Article 17 applies.
- Restriction of processing (Article 18).
- Portability, in a structured, machine readable form (Article 20).
- Objection to processing based on legitimate interests, including profiling (Article 21).
- Not to be subject to a decision based solely on automated processing with a legal or similarly significant effect (Article 22). We make no such decisions.
- Withdrawal of consent at any time, without affecting processing done before you withdrew it.
- A complaint to your supervisory authority. In the UK that is the Information Commissioner's Office.
If you are in California
Under the CCPA as amended by the CPRA you have the right to know what we collect and why, to delete it, to correct it, to opt out of sale or sharing, to limit the use of sensitive personal information, and not to be discriminated against for exercising any of them. We do not sell or share personal information and we do not collect sensitive personal information as that term is defined, so the opt-out and limit rights have nothing to operate on, but the request costs you nothing and we will confirm that in writing.
If you are in Canada
Under PIPEDA you can access the personal information we hold about you, challenge its accuracy, and challenge our compliance with the Act. If our answer does not satisfy you, you can complain to the Office of the Privacy Commissioner of Canada.
If you are in Quebec
Under the Act respecting the protection of personal information in the private sector, as amended by Law 25, you additionally have the right to be informed when personal information is used to make a decision based exclusively on automated processing (we make none), the right to portability, and the right to cessation of dissemination or de-indexing where the conditions in the Act are met. Our privacy contact for Law 25 purposes is the address at the top of this section.
11. Children's privacy
Prime MOQ is a business tool. It is not directed at children and we do not knowingly collect personal data from anyone under 13, or under 16 in the EEA where the applicable member state has set the age at 16. If you believe a child has given us data, write to support@primemoq.app and we will delete it.
12. Security
These are the controls we can confirm are in place today:
- Encryption in transit. The website, the app backend and every call between them run over TLS.
- Encryption at rest, provided by the hosting and database services we run on.
- Least privilege. Browser code holds no privileged credential, and every write goes through a server we control.
- Access tokens are destroyed on uninstall, so a revoked Shopify token cannot be replayed.
- Requests reaching us from a storefront are signature verified before any field on them is trusted, including the customer identifier.
- Cross site request forgery protection on every server function.
- Administrative access to our own systems is restricted to named accounts, granted on a least privilege basis, and logged.
Breach notification. Where we are the controller and a personal data breach is likely to result in a risk to your rights, we notify the competent supervisory authority without undue delay and within 72 hours of becoming aware of it, as Article 33 requires, and we notify affected individuals without undue delay where Article 34 applies. Where we are a processor for a merchant, we notify the merchant within 48 hours of becoming aware, as set out in the DPA.
No system is perfectly secure, and a policy that says otherwise is selling something. What we commit to is the list above, and to telling you promptly when something goes wrong.
13. Changes to this policy and contact
If we change this policy in a way that materially affects you, we will post the new version here with a new effective date and, where the change concerns the app, give merchants at least 30 days notice before it takes effect. Changes to the sub-processor list carry their own 14 day notice, described at /subprocessors.
Aspedan Inc.
325 Front St West, Suite 300, Toronto, ON M5V 2Y1, Canada
support@primemoq.app
Questions
A person reads every message, on any plan. If something on this page is unclear, or you want to exercise a right described in it, write to us and say so plainly.