1. Who we are
ShipLedger is a Shopify embedded app operated by Shenzhen Yunqi Era Technology Co., Ltd., registered at Room 505, Building B, Guoren Building, No. 5 Keji Middle 3rd Road, Maling Community, Yuehai Subdistrict, Nanshan District, Shenzhen, Guangdong 518057, China ("we", "us"). It reconciles your 3PL's invoices against your Shopify order facts and your own invoice history, and shows you the lines worth a second look. This policy explains what data we process on your behalf as a merchant, why, and how long we keep it.
2. What we process
From you: the 3PL invoices (CSV / Excel) you upload, the parameters you set in Settings (including how many items your 3PL picks for one unit of a SKU, if you tell us), and — only when you mark a billing question as denied for an "Other" reason — the short note you type about it. Email drafts are generated on the page and not stored.
From your Shopify store (Protected Customer Data, Level 1): order-level facts only — order id, created and fulfilled timestamps, line SKUs and quantities, shipment and item counts, cancellations, and the shipping destination's province / state, city and country; plus store-level inventory snapshots (quantity per SKU, not tied to any customer or order).
Your shop owner email address: read from Shopify at the moment we send you an email (invoice ready, monthly report), held in memory for that send and passed to Resend; it is not written to our database.
What we do not read or store: your customers' names, email addresses, phone numbers, street addresses, postal / zip codes, or the device and activity data Shopify attaches to an order (such as the browser IP address or user agent). We do not request these fields from Shopify. You can repeat this sentence to your customers.
If you use the order CSV import (before Shopify's app review unlocks the Orders API for your store), the same rule applies: the file is parsed in a stream, only the columns listed above are kept, and the original file is not stored.
3. Why we process it
- To reconstruct each invoice into a readable view and match billed quantities against your actual shipments and returns.
- To track how each fee code's unit price moves month over month.
- To send you the monthly report and the operational emails described in the app (invoice ready, renewal reminders).
We do not use your data for other purposes, do not sell it, and do not share it with your 3PL. Findings are suggestions for you to confirm; we do not write to your store and do not send anything to your 3PL on your behalf.
4. Who else touches it
- Web app: Vercel (vercel.com). The app's server functions run in Vercel's Portland, Oregon (United States) region. Vercel holds no database; it keeps request and runtime logs for 1 day.
- Database: Supabase (supabase.com), region West US (Oregon), United States — the PostgreSQL database that holds your invoices, order facts and findings. Encrypted at rest with AES-256 and in transit with TLS; daily backups are kept for 7 days; deleting the project removes all data including backups.
- Background jobs: Trigger.dev (trigger.dev) runs the email, monthly-report, compliance and health-check jobs. It stores each job's input (your store domain, invoice ids and, for a compliance request, the customer and order ids Shopify sends — never names, emails or invoice contents) and the run logs for 7 days, encrypted at rest with AES-256, in AWS us-east-1 (United States).
- Invoice column recognition: DeepSeek (API). The first time we see an invoice layout from your 3PL (no stored column map for it yet), we send the column headers, up to the first 20 lines of that invoice as a sample (free-text cells cut to 80 characters) and the descriptions of the lines our rules could not classify; the rest of the invoice stays on our servers. No Shopify order facts are sent. DeepSeek's terms allow it to use de-identified inputs and outputs to a minimal extent to improve its services; its privacy policy keeps input data for as long as the account exists and gives no API-specific retention period.
- Email (sending): Resend. We hand it the recipient address and the email body; we do not receive email through it.
- Shopify: we receive order facts through the Admin API and the mandatory compliance webhooks.
5. How long we keep it, and how to delete it
- While the app is installed, your invoices and order facts stay so that history, back-fill and renewal summaries keep working.
- Delete everything, any time: Settings → Delete all data. Your invoices, order facts, findings and billing questions are hard-deleted.
- Uninstall: access tokens and sessions are revoked immediately; your data is hard-deleted after Shopify sends the
shop/redactrequest (48 hours after uninstall), within 7 days of that request (Shopify allows up to 30 days). - Your customers' requests: when a customer asks your store for their data or for erasure, Shopify forwards the request to us; we export or delete the order-level facts we hold for the listed orders within 30 days.
- Compliance log: for each compliance request (uninstall,
shop/redact, a customer's data or erasure request, or your own Delete all data) we keep one record of what was done and whether it succeeded (a compliance audit entry). It names your store but holds no invoice, order or contract data — it exists so that you and Shopify can check that the request was honoured. - What remains after deletion: aggregate, de-identified knowledge about 3PL fee codes (for example, that a given fee code at a given 3PL is a surcharge, and how many merchants classified it that way) and about 3PL replies (how many merchants had a billing question declined by a given 3PL for a given listed reason — never your "Other" note). It carries no merchant identifier and cannot be traced back to you.
6. Security
Access is limited to what the app needs (the Shopify access scopes shown on the app listing). Webhook requests are HMAC-verified and rejected with 401 when the signature does not match. Data at rest — the database and its backups — is encrypted with AES-256 by our database provider. Backups are daily snapshots that roll off within 7 days, so deleted data leaves the backups no later than 7 days after it leaves the live database.
7. Contact and changes
Questions or requests: write to hello@maxshipledger.com. Changes are posted on this page.