Privacy Policy

Effective Date: March 31, 2026

Maven Inventory ("we", "our", or "us") is operated by Rain City Brands LLC. This Privacy Policy describes how we collect, use, store, and protect information when you use the Maven Inventory application ("App"), including our Shopify integration.

By installing or using the App, you agree to this Privacy Policy. If you do not agree, please uninstall the App.

1. Information We Collect

1.1 Information from Shopify APIs

When you connect your Shopify store to Maven Inventory, we access the following data through Shopify's APIs:

• Product data: Product names, descriptions, identifiers, variants, pricing, and inventory levels
• Order data: Order numbers, dates, line items, quantities, pricing, financial and fulfillment status, and shipping information
• Customer data associated with orders: Customer name, email address, phone number, and shipping address (used solely for order attribution and record-keeping)
• Inventory levels: Stock quantities across your Shopify locations
• Location data: Your Shopify store locations and their identifiers
• Fulfillment data: Fulfillment status, tracking information, and return/refund details

1.2 Information You Provide Directly

• Account information: Email address and name when you create a Maven Inventory account
• Workspace configuration: Workspace name, location names, vendor information, and sync settings

1.3 Information Collected Automatically

• Authentication tokens: Shopify OAuth access tokens and refresh tokens, stored in encrypted form
• Sync logs: Timestamps and metadata about data synchronization events between Shopify and Maven Inventory

1.4 Information We Do Not Collect

We do not place cookies on your customers' browsers, use tracking technologies on your storefront, collect payment card information, or access customer data beyond what is associated with orders.

2. How We Use Your Information

We use the information we collect solely to provide and improve the Maven Inventory service:

• Inventory management: Synchronizing inventory levels between Shopify and Maven Inventory across multiple locations
• Order processing: Importing and tracking sales orders for demand forecasting and FIFO cost of goods sold (COGS) calculations
• Product catalog sync: Keeping product information consistent between Shopify and Maven Inventory
• Fulfillment and returns: Tracking fulfillment status and processing returns
• Analytics and reporting: Generating inventory, sales, and profitability reports for your business
• Service improvement: Monitoring sync reliability and diagnosing technical issues

We do not sell, rent, or share your data with third parties for marketing purposes. We do not use your data for any purpose other than providing the Maven Inventory service.

3. How We Store and Protect Your Information

3.1 Data Storage

Your data is stored on secure, cloud-hosted infrastructure provided by Supabase (PostgreSQL databases hosted on Amazon Web Services). Data is stored in the United States (AWS US-West-2 region, Oregon).

3.2 Security Measures

• Encryption at rest: All data is encrypted at rest using AES-256 encryption
• Encryption in transit: All data transmission uses TLS 1.2 or higher
• Token encryption: Shopify access tokens and refresh tokens are encrypted using AES-256-GCM before storage
• Access control: Row-Level Security (RLS) policies enforce workspace-level data isolation, ensuring each merchant can only access their own data
• HMAC verification: All incoming Shopify webhooks are verified using HMAC-SHA256 signatures

3.3 Multi-Tenant Isolation

Maven Inventory is a multi-tenant application. Your data is logically isolated from other merchants' data through workspace-scoped access controls enforced at the database level. No merchant can access another merchant's data.

4. Data Retention

• Active accounts: We retain your data for as long as your account is active and the App is installed on your Shopify store.
• After uninstallation: When you uninstall the App from Shopify, your connection is deactivated. Your data remains in your Maven Inventory workspace until you delete your account or request data deletion.
• After account deletion: When you request account deletion, we delete all associated data within 30 days.
• GDPR shop/redact: When Shopify sends a shop data erasure request (48 hours after uninstall), we delete all channel connection data associated with your store.
• Sync logs: Webhook event logs and sync job records are retained for 90 days for troubleshooting, then automatically purged.

5. Data Sharing

We share your data only with the following parties, solely to provide the service:

• Supabase: Our database and authentication infrastructure provider (data processor)
• Vercel: Our application hosting provider
• Shopify: We send inventory updates, order status changes, and fulfillment data back to your Shopify store as part of the bidirectional sync

We do not share data with any other third parties. We do not sell personal data.

6. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of inaccurate personal data
• Deletion: Request deletion of your personal data
• Portability: Request your data in a portable format
• Restriction: Request that we limit how we process your data
• Objection: Object to our processing of your data

To exercise any of these rights, contact us at rob@raincitybrands.com. We will respond to your request within 30 days.

6.1 GDPR Compliance (European Economic Area)

If you are located in the EEA, we process your data under the lawful basis of contractual necessity (providing the service you requested). We comply with GDPR requirements including mandatory data erasure webhooks from Shopify. Your data is stored in the United States; we rely on Supabase's data processing agreements and standard contractual clauses for cross-border data transfers.

6.2 CCPA/CPRA Compliance (California)

If you are a California resident, you have the right to know what personal information we collect and how it is used, request deletion of your personal information, and opt out of the sale of personal information. We do not sell personal information.

7. Customer Data (Your Buyers)

Maven Inventory accesses limited customer data associated with orders (name, email, phone, shipping address) solely for order attribution and record-keeping within your inventory management workflow. We do not:

• Contact your customers directly
• Use customer data for marketing or advertising
• Share customer data with any third party
• Place cookies or tracking technologies on your storefront or your customers' devices

When a customer requests data erasure through Shopify, we anonymize their information in all associated order records in compliance with GDPR requirements.

8. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by updating the effective date at the top of this page. Your continued use of the App after changes are posted constitutes acceptance of the updated policy.

9. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us: