Loading page content
How Pick List & Low Stock uses store data
This page describes what the app does with data from your Shopify store, as built today. It adds detail to the HappifyApps privacy policy.
Version 0.1.0 · Reviewed against the app’s code on 2026-10-04
In short
Pick List & Low Stock reads your orders, products, inventory and locations to build the open-order board, pick list and stock flags. It writes to Shopify only when you tag or fulfil an order.
All Happify apps run on one platform and one Postgres database (Supabase), hosted with the apps on Vercel. Store data is kept once per store, not once per app: if you install two Happify apps, they read the same copy of your products, inventory and orders.
Permissions and why
| Shopify permission | Used for |
|---|---|
| read_orders | Import unfulfilled orders for the board, pick list and risk queue, and keep them current from order webhooks. |
| write_orders | Add or remove the workflow tags you choose on orders. |
| write_fulfillments | Create a fulfillment when you click Fulfil on a fully pickable order (Pro). |
| read_products | Product and variant names, SKUs and barcodes for the pick list and scan mode. |
| read_inventory | Available and committed stock for low-stock flags and shortfalls. |
| read_locations | Split the pick list and stock by location. |
What the app stores
- Orders with their line items, totals, statuses, tags, note, note attributes and Shopify’s risk recommendation, without the buyer’s contact details
- Products, variants (including barcodes), inventory levels and locations
- Internal notes you write on orders
- Your settings, including the digest email address and alert webhook URL
- An audit log of actions such as tagging, fulfilling and settings changes
When an app has order access, the import copies each order with its line items, totals, tax lines, discount codes, tags, note, note attributes and Shopify’s risk recommendation. Buyer details are kept only while an app on your store needs them: the buyer’s name, email, phone and shipping and billing addresses only while Local Delivery Sheet or Invoice & Packing Slip is installed, and the customer’s name and email (on the customer record) only while Reorder Predictions, Local Delivery Sheet or Invoice & Packing Slip is installed. Otherwise orders are stored without contact details and customers as a Shopify ID only, and the import does not ask Shopify for those fields. The stored copy of what Shopify sent never keeps the buyer’s contact, browser or device details.
Customer data
Pick List & Low Stock does not store or show buyer contact details. Its order import does not ask Shopify for the buyer’s name, email, phone or addresses, and the board, pick list, print view and CSV show order names, not customers. If another Happify app on your store needs those details they are kept for that app, but this app still does not show them. “Notify customer” on a risk-flagged order reads that order’s email from Shopify at the moment you click, sends the notice and keeps no copy. The app needs Shopify’s protected customer data approval for orders, and for the email field if you use Notify customer.
Changes the app makes in Shopify
- Order tags you apply, by hand or with tag rules
- Fulfillments you create with Fulfil (Pro)
Who else receives data
| Recipient | Purpose | Data |
|---|---|---|
| Resend | Email delivery | The digest (counts only) to the address you set. If you use “Notify customer” on a risk-flagged order, a short notice with the order name goes to the email on that order, read from Shopify when you click. The address is not stored, including in the audit log. |
| Your webhook endpoint | Alerts you configure (Pro) | Counts and your store domain, sent to the HTTPS URL you enter. |
Hosting is on Vercel and Supabase, listed on our Sub-processors page. We do not sell data or use it for advertising.
Storefront, checkout, POS and Sidekick
- The “Pending order status” theme block shows only the text you enter. It reads and sends no shopper data.
Uninstall and privacy webhooks
Shopify sends every app these mandatory webhooks. This is what the app does with each.
| Webhook | What happens |
|---|---|
| app/uninstalled | Marks the app as uninstalled and its subscription as cancelled, and stops syncing for it. Nothing is deleted at this point: Shopify sends the shop redaction request below 48 hours later, and any other Happify app on the store keeps working meanwhile. |
| customers/data_request | Logged on receipt. We prepare the customer’s data by hand and send it to you, the merchant, within 30 days. |
| customers/redact | Removes the customer’s name and email from the customer record; their name, email, phone and addresses from their orders; their contact details from Local Delivery Sheet run stops, along with any proof of delivery photo or signature for those stops; stored webhook records about them; and their email address wherever it was logged as an email recipient. Order lines and totals stay, so your sales history still adds up. |
| shop/redact | Deletes this app’s data for your store: its installation and encrypted access token, subscription record, settings, app-specific data (such as delivery runs and proof of delivery, zones, internal order notes), audit log entries and webhook records. The shared store data (products, inventory, orders, customers) is deleted too when no other Happify app is installed on the store. If one is, the shared data stays for that app, cut down to the customer details it needs. |
Retention
- This app’s data is deleted when Shopify sends its shop redaction request, 48 hours after the app is uninstalled. Shared store data is deleted then too, unless another Happify app is still installed on the store; in that case it is deleted with the last app’s redaction.
- There is no fixed expiry for synced data while an app is installed; inventory snapshots and order history build up over time because history is what the analysis uses.
- Webhook payloads are emptied as soon as they have been processed; a delivery that failed keeps its payload for troubleshooting. Webhook delivery records are deleted after 30 days.
- Audit log entries are deleted after one year, except saved settings and zone versions, which are kept while the app is installed so you can restore them. Audit entries do not record customers’ email addresses.
- Encrypted database backups are deleted 90 days after they are taken, so data deleted from the live database can remain in a backup for up to 90 days.
Security
- Shopify access tokens are encrypted at rest (AES-256-GCM). Database tables are reachable only from our servers; the browser never talks to the database.
- Inside Shopify admin the app identifies your store from Shopify’s signed session token on every request. It never trusts a store name passed in a URL.
Requests and questions
To ask for a copy of your store’s data, or to have data deleted sooner, use the support form with the topic “Data, privacy or deletion”, or email admin@happifyapps.com. Settings in the app also has a “Download account data” button.