Privacy Policy
AIOM ("we", "us") provides financial analytics for Shopify merchants. This policy explains what data we access, why, and how we protect it. We are a data processor acting on behalf of the merchant (the data controller).
What we access
- Store & order data — orders, line items, refunds, payouts, and product costs, used to calculate profit, margin, and reconciliation.
- Limited customer fields — we store a customer email on an order only to support reconciliation and retention metrics. We do not build customer marketing profiles.
- Account data — your authenticated account identifier and the Shopify shop domain you connect.
- Advertising metrics — aggregate ad spend from platforms you choose to connect (e.g. Meta, Google).
What we do NOT do
- We do not sell personal data.
- We do not use your data to train third-party AI models.
- We do not access payment card numbers — payment processing stays with Shopify.
How we protect it
- Access tokens are encrypted at rest.
- Every API request is scoped to the owning shop — one merchant can never read another merchant's data.
- Money is stored as integer cents to avoid rounding errors; sensitive values are redacted from application logs.
Data retention & deletion
We retain data while your app is installed. On app/uninstalled,
we immediately deactivate the shop, stop syncing and clear integration credentials.
Merchant records are temporarily retained so reinstalling before redaction can restore
your history. Shopify normally sends shop/redact about 48 hours after
uninstall if the app has not been reinstalled. We hard-delete the shop's operational
records and credentials on receipt, and in all cases within 30 days of that request.
Metadata-only personal-data access logs follow the separate retention period below
in our data retention policy. You may also
request deletion any time at support@aiomprofitguard.com.
Your rights
Depending on your jurisdiction (GDPR/CCPA), you may request access, correction, or erasure of personal data we process. Contact us and we will respond within the legally required window.