Privacy Policy
Updated 27 September 2026
This Privacy Policy explains how Vendkit (“we”, “us”) handles data when a Shopify merchant uses Warrantly (the “App”), an app that gives a store a product registration page and manages warranty claims.
1. Who we are and our role
The App is operated by Vendkit. When a merchant installs Warrantly, the merchant is the data controller and Vendkit acts as a data processor: we process data only to provide the App's features to that merchant, on their instructions. Our processing terms are set out in the Data Processing Addendum in our Terms of Service.
Shoppers who have questions about their personal data should contact the store they registered with.
2. Data we access in your store
Warrantly asks Shopify only for the permissions it needs:
| Shopify data | Permission | Why we need it |
|---|---|---|
| Orders | read_orders | When a shopper registers, check that the order number and email they enter belong to a real order, and read which products were in it and when it was bought. We only look up the one order the shopper names. |
| Products | read_products | Show your products so you can set warranty lengths, and let shoppers pick the product they bought. |
| Files | write_files | Save claim photos and receipts that shoppers upload into your store's own Shopify Files. |
3. Data we store
| What | Details | Kept for |
|---|---|---|
| Registrations | The shopper's name and email; the product, serial number, order number, purchase date and cover end date; a link to their receipt if they uploaded one. | Until 12 months after the warranty ends, then deleted automatically. |
| Claims | What's wrong, the shopper's description, links to their photos, your replies and status changes. | Deleted with the registration they belong to. |
| Photos and receipts | Stored in the merchant's Shopify Files, not on our servers. We keep only their file ids. | Until the merchant deletes them in Shopify, or the registration is deleted in the App. |
| Store settings | Warranty lengths, email settings, plan and setup-guide progress. | Until you uninstall. |
| Session details | The access token Shopify gives the App to act on your store. | Until you uninstall. |
Warrantly does not store shoppers' postal addresses, phone numbers or payment details.
4. Why we process it (legal basis)
| Purpose | Legal basis |
|---|---|
| Registering products and sending the warranty card the shopper asked for | Performance of our contract with the merchant (and the merchant's warranty with the shopper) |
| Handling claims and emailing the shopper each update | Performance of contract |
| “Warranty ends soon” reminder emails (Pro plan) | The merchant's legitimate interest in servicing the warranty the shopper registered |
| Keeping the App secure and fixing errors | Our legitimate interest in running a reliable service |
| Billing your plan through Shopify | Performance of contract |
5. Who we share data with
We never sell or rent data. We use these providers (sub-processors) to run the App:
| Provider | What they do | Location |
|---|---|---|
| Shopify | The platform the App runs on; source of order and product data; stores uploaded files; billing. | Canada / global |
| Railway | Hosts the App's servers. | United States (East) |
| Supabase | Database, encrypted at rest. | Canada (Montréal) |
| Resend | Sends warranty cards, claim updates and reminder emails. | United States |
| Sentry | Error monitoring. Personal data is removed from error reports before they are sent. | United States |
6. International data transfers
Data may be processed in Canada and the United States. Where data from the European Economic Area, the United Kingdom or Switzerland is transferred, we rely on the safeguards offered by our providers, such as the European Commission's Standard Contractual Clauses and Canada's adequacy decision.
7. Retention and deletion
- Registrations and their claims are deleted automatically 12 months after the warranty ends.
- Merchants can delete any registration in the App at any time; its photos and receipt are removed from their Shopify Files too.
- When you uninstall, Shopify asks us about 48 hours later to delete your store's data. We then permanently delete everything we hold for your store.
- We act on all of Shopify's mandatory privacy requests: customer data request, customer redact (we delete every registration made with that customer's email) and shop redact.
8. Cookies and your storefront
Warrantly sets no cookies and uses no tracking or analytics on your storefront. The registration page only sends what the shopper types or uploads, when they press a button.
9. Emails
Warrantly sends only service emails the shopper asked for by registering: their warranty card, claim updates and, on the Pro plan, one reminder before their warranty ends. Emails are sent in the store's name, and replies go to the store.
10. Your rights
Depending on where you live, laws such as the GDPR and CCPA give you rights to access, correct, delete, restrict or port your personal data, and to object to processing. Merchants can exercise these rights by contacting us or by uninstalling the App; shoppers should contact the store they registered with, which can ask us for help. You may also complain to your local data-protection authority.
11. Security
All data is sent over HTTPS and stored in encrypted databases. Every request from Shopify — including each registration and claim sent through the store — is verified with its signature before we act on it. Order lookups need both the order number and the checkout email, and are rate-limited. Access to production systems is limited to the App's operator, and we keep daily database backups.
12. Children
The App is a business tool for Shopify merchants and is not directed at children. We do not knowingly process children's data.
13. Changes to this policy
We may update this policy as the App changes. The “Updated” date at the top shows when it last changed; for significant changes we will notify merchants in the App.
14. Contact us
Vendkit — vendkit.support@gmail.com. We reply within one business day.