This policy explains what data PriceMaster collects and processes when a merchant installs the app on their Shopify store, for what purpose, who it is shared with, and what your rights are.
1. Data controller
PriceMaster is published by Novaline. For any question about this policy or your personal data, contact us at contact@novaline.agency.
2. Data we collect
On installation, PriceMaster receives from Shopify the information needed to operate: store name and domain, Shopify plan, merchant contact details, and an Admin API access token.
During use, the app reads and writes only the data required by the enabled features: products, variants, collections, customers and customer tags, draft orders, plus the price rules, quantity breaks, price lists and quotes created in PriceMaster.
Quote requests sent from the store contain the name, email, phone, company and products requested by the merchant's customer. PriceMaster processes this data on behalf of the merchant, who remains the data controller towards their own customers.
Server logs (IP address, timestamp, requests) are kept for security and diagnostic purposes.
PriceMaster never processes payment data (card numbers): the subscription is billed exclusively through Shopify Billing.
3. Purpose of processing
Data is used to provide the service (computing and displaying B2B prices, applying discounts at checkout, managing quotes and orders, generating invoices), manage the subscription through Shopify Billing, provide technical support and improve the reliability of the app.
Assisted installation and the support assistant rely on an AI model: only the information needed for the request (theme structure, merchant message) is sent to it.
It is never sold, rented, or used for advertising purposes.
4. Legal basis
Processing is based on the performance of the contract entered into with the merchant when installing the app, and, where applicable, on our legitimate interest in keeping the service secure and reliable.
5. Data sharing
Data is hosted and processed by the following providers, strictly for the purposes above: Shopify Inc. (e-commerce platform, authentication, Admin API, billing), Fly.io (app hosting, servers located in France, Paris region), Supabase (database) and Anthropic (AI model for assisted installation and support).
No data is transferred to third parties outside this technical scope necessary for the service to run.
6. Retention period
Store data is kept for as long as the app is installed. On uninstall, PriceMaster's access to the store is revoked immediately, then all store data (price rules, quotes, orders, settings) is permanently deleted 48 hours later, when Shopify sends its deletion webhook.
At the request of an end customer made to the merchant, that customer's identifying data (name, email, phone) in quotes and orders is anonymised. Requests relayed by Shopify are handled within 30 days.
7. Security
All communications are encrypted (HTTPS/TLS). Shopify webhooks are verified by HMAC signature before any processing. Shopify access tokens are stored server-side and never exposed to the browser. PriceMaster API keys are unique per store, revocable and stored hashed (SHA-256).
8. Your rights
Under GDPR, you have the right to access, rectify, erase, object to, and port your data. To exercise these rights, contact us at contact@novaline.agency.
9. Changes
This policy may be updated to reflect changes to the service or applicable regulations. The last-updated date is shown at the top of this page.
Questions about your data? Write to us at contact@novaline.agency.