Privacy Policy - GhostShelf

Last updated: October 23, 2026

GhostShelf is an application for Shopify merchants, developed and managed by Oleksandr Bihansky (“the developer”), operating as StoreGears. It is built with a “Privacy by Design” approach: GhostShelf is strictly read-only, it requests only the access it needs, and it never changes your products, prices, inventory, or publications. This policy explains what data the app accesses, why, and how it is handled.

1. Data Controller

For the contact and support data described in this policy, the data controller is:

Oleksandr Bihansky (StoreGears)

Email: info@storegears.com
Website: https://storegears.com

For the store data that GhostShelf reads from your Shopify store, you (the merchant) are the data controller and the developer acts as a data processor, handling that data only to provide the service you have installed.

2. Information Collection

GhostShelf does not collect, store, or process personal information about your customers. It does not read customer names, email addresses, phone numbers, or shipping and billing addresses.

Store Data Accessed Through Shopify

When you install the app, you grant it the following access scopes:

• read_products: Used to read active products (title, handle, status, tags, collection membership, variants, SKUs, and prices) so the app can check whether each product can still be sold.
• read_inventory: Used to read stock levels and inventory locations, so the app can detect products that are out of stock or have no stock at a location that fulfills online orders.
• read_publications: Used to read the sales channels each product is published to, so the app can detect products that are not published to the Online Store.
• read_orders (optional): Requested only if you turn on the Alerts setting “only alert me if the product sold in the last 30 days.” The app reads only the product and quantity of line items from recent orders, in order to know which products have sold recently. It does not read customer information, and it does not store orders.

The app also reads basic store details: your shop domain, store email address, currency, and time zone. The store email is used to suggest a default alert address, and the time zone is used to apply your quiet hours.

Data You Provide in the App

• Alert destinations: One email address and up to three Slack incoming webhook URLs, which you choose, so the app knows where to send alerts.
• Settings: Your rule preferences, exclusions (products, tags, or collections you choose to skip), and quiet hours.

Data Generated by the App

• Product status and incidents: A record of which products currently fail a rule, when each problem was opened or resolved, and the reason.
• Alert log: The channel, delivery status, and time of each alert sent.
• Technical records: Authentication sessions (shop domain, access token, granted scopes) and background job records needed to run scans and deliver alerts.

Support & Feedback (Voluntary)

If you contact the developer by email, you may voluntarily provide your name, email address, and your shop domain. This information is used solely to respond to your request and resolve technical issues. It is not used for any other purpose.

Analytics, Advertising & Tracking

GhostShelf does not use analytics tools, advertising trackers, or profiling. It does not sell or share your data for marketing purposes.

3. How Alerts Are Delivered

Alerts are deliberately minimal. They contain only the number of active products that can no longer be sold and a prompt to open GhostShelf. They do not include product names, prices, or customer data.

• Email: Sent through Resend (resend.com), an email delivery provider. Your alert email address and the alert text are processed by Resend only to deliver the message. See the Resend Privacy Policy.
• Slack: Posted directly to the incoming webhook URL you provide. Slack processes the message according to its own Privacy Policy. Treat your webhook URL as a secret, since anyone who has it can post to that channel.

4. Third-Party Services

• Shopify: GhostShelf runs inside the Shopify admin and uses the Shopify Admin API. Shopify processes data according to its own Privacy Policy.
• Resend: Email alert delivery, as described above.
• Slack: Slack alert delivery, as described above (only if you configure it).
• Hosting and database providers: The app and its database are hosted with managed cloud infrastructure providers, which store data on the developer’s behalf under appropriate security and confidentiality obligations.

5. Data Storage, Security & Retention

App data is stored in a managed PostgreSQL database. Data is transmitted over encrypted connections (HTTPS), and access is limited to the developer.

• Active use: Data is kept for as long as the app is installed on your store, so that alerts and history keep working.
• Uninstall: When you uninstall GhostShelf, the app receives Shopify’s app/uninstalled notification and deletes the data it holds for your store: settings, exclusions, product state, incidents, alert destinations, alert logs, jobs, and sessions.
• Shopify compliance requests: The app handles Shopify’s mandatory privacy webhooks. On shop/redact, any remaining store data is deleted. Because GhostShelf stores no customer personal data, customers/data_request and customers/redact requests have no customer data to return or delete.
• Support emails: Kept only as long as needed to handle your request, and then deleted unless a longer period is required by law.

6. International Data Transfers

The developer and the service providers listed above may process data in countries outside your own, including outside the European Economic Area. Where this happens, appropriate safeguards (such as Standard Contractual Clauses) are applied as required by applicable law.

7. Compliance & Rights

In accordance with the GDPR, the UK GDPR, the CCPA/CPRA, and other applicable privacy laws, you have the right to access, correct, delete, restrict, or export your data, and to object to its processing. You can exercise these rights as follows:

• Delete data: Remove alert destinations and exclusions in the app at any time, or uninstall the app to delete all store data (see Section 5).
• Other requests: Contact the developer at the email address below. Requests are answered within 30 days.

GhostShelf does not sell or share personal information, and it does not make automated decisions that have legal or similarly significant effects on you. You also have the right to lodge a complaint with your local data protection authority.

8. Children’s Privacy

GhostShelf is a business tool for Shopify merchants and is not directed at children. The developer does not knowingly collect personal information from anyone under 16 years of age.

9. Changes to This Policy

This policy may be updated from time to time, for example when the app’s features change. The “Last updated” date at the top shows the latest revision. Significant changes will be communicated through the app or by email.

10. Contact Information

If you have any questions regarding your privacy, please contact the developer at:
info@storegears.com