Privacy Policy
TopUp: AI Replenish · Last updated: 12 November 2026
This policy explains what TopUp: AI Replenish ("TopUp", "we") reads and keeps when a Shopify merchant installs it, why, and how it is deleted. It describes what the app actually does.
1. What TopUp reads and keeps
TopUp asks Shopify for read-only access: read_products, read_inventory,
read_orders and read_locations. It never changes your store.
| What is kept | Why |
|---|---|
Your shop's .myshopify.com address and a Shopify access token (stored encrypted) |
To read your catalogue, stock and sales for the reorder plan |
| Products and variants: titles, SKUs, sizes, colours, prices, unit costs, vendor, status and image link | To show what to reorder and work out cost and sales at risk |
| Stock per location, and one stock total per variant per day | To know what is in stock and which days an item was sold out (those days are left out of its sales rate) |
| Sales totals: units and revenue per variant, per day, per sales channel | To measure how fast each item sells |
| Suppliers you add: name, contact name, WhatsApp/phone number, email, lead time, minimums, pack size, language, currency and notes (contact details stored encrypted) | To group suggestions by supplier and prepare purchase orders for them |
| Purchase orders you create, your reorder settings and rules | To show and manage your orders to suppliers |
2. Customer data
TopUp reads the orders of the last 60 days (or longer only if Shopify grants the store's permission to read older orders) and immediately reduces them to the sales totals above. It does not read or keep customer names, email addresses, phone numbers, postal addresses or customer IDs, and it does not keep order numbers. It has no access to checkout or payment details.
3. Sending purchase orders
TopUp does not send messages itself. When you press a send button it opens WhatsApp, WhatsApp Web, your email app or Gmail with the order already written, and you send it yourself. The message contains your shop name, the order lines and the supplier's contact name. TopUp does not see or keep what happens after that.
4. Who we share data with
We do not sell or rent data, and we do not share it with advertisers. Data is stored on our own server (a virtual private server rented from Hostinger) and is only used to run TopUp for your store. Shopify provides the data through its API under its own policies. TopUp does not currently send your data to any AI service; if a future feature does, this policy will say exactly what is sent before the feature is switched on. We disclose data to authorities only when the law requires it.
5. How long we keep it, and deletion
- Daily sales totals and daily stock totals older than 400 days are deleted automatically.
- When you uninstall TopUp, its Shopify access token is deleted at once.
- About 48 hours after uninstalling, Shopify sends TopUp a
shop/redactrequest. TopUp then deletes everything it holds for your shop: products, stock, sales totals, suppliers, purchase orders, settings and rules, and the shop record itself. - Shopify's
customers/data_requestandcustomers/redactrequests are answered; there is no customer data to return or delete, because none is kept. - You can ask us to delete your data earlier using the contact below.
6. Security
All traffic uses HTTPS. Shopify access tokens and supplier contact details are encrypted in the database (Fernet: AES with an integrity check), with a key kept apart from the database. Each request from the app is checked against a token signed by Shopify, and every database query is limited to the shop that token belongs to, so one store can never see another store's data. No online service can promise perfect security, but we take reasonable steps to protect your data.
7. Your rights
Depending on where you live, you may have the right to access, correct, export or delete your data, or to object to some processing. Contact us and we will help.
8. Children
TopUp is a business tool for Shopify merchants and is not directed at children.
9. Changes
If we change this policy in a meaningful way, we will update the date above and, where the law requires, tell merchants who use TopUp.
10. Contact
Questions, or requests to access or delete data: shilparts@gmail.com.