Privacy policy
What Grab Product keeps, and why.
Grab Product turns a product listing into a Shopify product page. To do that it needs a small amount of your data and a connection to your store. This page lists exactly what is stored, where, for how long, and how to remove it.
Your account
When you sign up we store your email address, an optional display name, a salted password hash, and timestamps for sign-up, verification and last sign-in. Passwords are never stored in plain text. If you pay for the app through Stripe, we store the Stripe customer and session identifiers so we can recognise the payment; card details never reach our servers.
Your Shopify connection
When you install Grab Product on a store, Shopify issues an access token scoped to that store. We store the token, the store's .myshopify.com domain, and the permissions it was granted, inside your own workspace. The token is used only to create and update products, pages and theme sections you ask the app to publish, and to read the orders shown in the Orders tab.
| Permission | Used for |
|---|---|
| write_products, read_products | Creating and updating the products you publish |
| write_content, read_content | The landing pages the app builds for those products |
| write_themes, read_themes | Installing the store-theme sections you choose, and taking a backup of the theme before any change |
| read_orders | Listing recent orders so you can reorder from the supplier. Order data is shown live and is not stored. |
Your customers' data
Grab Product does not store any data about your customers. The Orders tab shows order numbers, line items, totals and status, fetched from Shopify when you open it and discarded when you leave. Customer names, emails, phone numbers and addresses are not requested from Shopify and never appear in the app.
Shopify's data-request and erasure webhooks are supported. Because nothing about your customers is stored, a data request returns nothing and an erasure request has nothing to remove; both are acknowledged within the required window.
Your catalogue
The product listings you grab — titles, descriptions, prices, images and creator videos — are stored in your workspace so you can edit and republish them. Downloaded media is copied to a content-delivery bucket so your published pages keep working after the original listing changes. This is your data; delete a product and its files are removed.
Where it lives
Everything above is stored on the server that runs your Grab Product install and its attached storage volume, with media on Cloudflare R2. Each account has its own workspace; no account can read another's catalogue or store connection.
Uninstalling and deletion
- Disconnecting a store (Settings → Disconnect) deletes the access token immediately. Products already published stay in your Shopify store.
- Uninstalling from Shopify revokes the token on Shopify's side; when Shopify tells us, we delete our copy and the store details. Forty-eight hours later Shopify sends a shop-erasure request and any remaining store data is removed.
- Deleting your account removes your workspace — catalogue, settings and media — in full.
Third parties
Shopify (store connection), Stripe (payment), Resend (transactional email) and Cloudflare R2 (media hosting). Each receives only what is needed for its job. We do not sell or share your data with anyone else, and there is no advertising or analytics tracking in the app.
Contact
Questions or deletion requests: info@puzzlebusinessgroup.com.