Privacy Policy

Who we are

SpecMatrix (“we”, “us”) is a Shopify app that helps merchants publish matrix-driven product configurators from spreadsheet uploads. This policy describes data we process when you install or use SpecMatrix on a Shopify store.

Data we process

• Shop credentials. Offline access tokens and related OAuth metadata for the installing Shopify store, stored server-side so we can call the Shopify Admin API (for example Draft Orders and product reads). Tokens are never sent to browsers.
• Product and matrix data. Product links, selling mode, column mappings, and spreadsheet contents you upload (including prices, option values, and part numbers you choose to include). We parse uploads server-side and store the resulting matrix data in our database. We do not keep the original spreadsheet file.
• Order configuration snapshots. When a shopper completes Instant checkout through the cart, we store a signed price-token record (selected options, Layer 1 price, matrix version) and may link it to the Shopify order. Quote mode (and Instant fallback when checkout protection is not active) stores configuration snapshots with Shopify Draft Order identifiers so the merchant can reconcile.
• Quote requests. If a shopper requests a custom quote for a combination outside the matrix, we may store attempted options plus optional email and message.
• Compliance records. Exports created to fulfill Shopify GDPRcustomers/data_request webhooks.

How we use data

We use this data only to operate SpecMatrix: authenticate the shop, serve the configurator, protect Instant cart prices, create Quote Draft Orders, surface quote requests to merchants, link Instant cart checkouts to configuration snapshots for support and legal requests, and respond to Shopify mandatory webhooks (uninstall and GDPR).

We do not sell personal data. We do not use shopper data for advertising.

Processors

• Shopify: platform identity, Admin API, Draft Orders, and checkout.
• Supabase: Postgres database and private file storage (server-side Secret key only; no merchant or shopper login via Supabase Auth).
• Render (or successor host): application hosting (marketing site and API on one service).
• Cloudflare: DNS and reverse proxy / CDN in front of the production origin.

Retention and deletion

On app uninstall we clear stored access credentials. On Shopifyshop/redact, we delete the shop’s price-token snapshots and database rows (cascade). Oncustomers/redact, we clear customer email and message fields we store on quote requests for that customer, and delete price-token rows linked to any orders listed inorders_to_redact.

Shopper-facing widget

The storefront Theme App Extension loads matrix data through Shopify’s app proxy to our shop-scoped, rate-limited API. Configuration and price are always re-validated on our servers before any Draft Order is created. Client-supplied prices are ignored.

Contact

For privacy requests related to SpecMatrix, contact the merchant whose store uses the app (they own the customer relationship), or email the SpecMatrix support address listed on the Shopify App Store listing. Merchants can also use Shopify’s GDPR webhook flow, which we fulfill as described above.

Replace this paragraph’s support email with your production contact before App Store submission if it differs from the Partner listing.