Privacy

Quaybound is a Shopify app operated by RExelerate AB. This page describes what the app processes, why, and your rights. Last updated 2026-09-15.

Controller

RExelerate AB, org. no. 559596-2472, Kivra: 559596-2472, 106 31 Stockholm, Sweden. support@rexelerate.se

What we process and why

Your shop and settings — the myshopify domain, currency and the settings you choose. Legal basis: performance of our contract with you (GDPR Art. 6(1)(b)).
Data you enter — suppliers (including a contact email if you add one), supplier items, purchase orders, costs, exchange rates and receipts. Legal basis: Art. 6(1)(b).
Staff account — the name, email, Shopify user id and locale of the staff account that opens the app, as provided by the Shopify session. Used to authenticate you. Legal basis: Art. 6(1)(b).
Shopify identifiers — product, variant, inventory item and location ids, so the app can show your products and post receipts. Legal basis: Art. 6(1)(b).
Sales figures — order dates, variant ids and quantities are read from Shopify for reorder and purchase-budget calculations. They are used for the calculation shown to you and are not stored. Legal basis: Art. 6(1)(b).
Server logs — request logs with IP address, kept for security and troubleshooting for up to 30 days. Legal basis: legitimate interest (Art. 6(1)(f)).

What we do not process

No end-customer names, emails, addresses or payment details. The app has no access to customer accounts or checkout.

Inventory changes

The app never changes your stock in the background. Stock quantities change only when you explicitly post a receipt to Shopify, either while recording it or from the saved receipt. Each adjustment carries the reason “received” and a reference to the receipt, and is visible in Shopify's inventory history. If a product is not yet stocked at the receiving location, the app activates it there (at zero) before posting. Budget plans and reorder suggestions do not place orders or change inventory.

Where data lives

On servers in the European Union (Hetzner, Germany). Database backups are kept for 14 days on the same infrastructure. Shopify Inc. processes your store data under its own terms and may do so outside the EU.

Retention, uninstall and deletion

When you uninstall, your session is deleted and the app loses access to your store. Shopify sends a shop-redaction request 48 hours after uninstall; we then delete all data for your shop. You can request deletion earlier by emailing us.

Your rights

You have the right to access, rectify, erase, restrict and object to our processing of your personal data, and to data portability. Email support@rexelerate.se. You may lodge a complaint with the Swedish Authority for Privacy Protection (IMY), imy.se.

Sub-processors

Hetzner Online GmbH (hosting, Germany) · Shopify Inc. (platform, billing) · Cloudflare, Inc. (DNS).