sK Fulfillment Rules – Privacy Policy

Last updated: 24 September 2026

sK Fulfillment Rules lets you decide which of your locations may ship which products, and checks that a rule will not leave a product with no way to ship before you switch it on. This policy explains exactly what the app reads, what it keeps, and what it never touches.

What the app stores

• Your store domain (for example your-store.myshopify.com).
• The offline access token Shopify issues at install, so the app can read your locations and inventory when you ask it to run a safety check.
• The fulfillment rules you create: a rule name, the product tag it matches, the location IDs you allow, and whether the rule is enabled.

What the app reads but does not store

When you run a safety check, the app reads your product titles and tags, your location IDs and names, and the available quantity of each product at each location. This is read at that moment, used to produce the list of products a rule would strand, and then discarded. None of it is written to our database or sent anywhere else.

What the app never accesses

• No customer data of any kind: no names, addresses, emails or orders.
• No payment or financial data.
• No storefront visitor data. The app adds no script to your storefront.

The access scopes shown on the install screen are the complete list: fulfillment constraint rules, locations, products and inventory. There is no customer scope, so the app could not read customer data even if it tried.

What happens at checkout

Your rules run inside Shopify as a Shopify Function. The Function receives only the cart lines and your saved rules, and returns the list of locations allowed to fulfill those lines. It makes no network call of its own, and no data leaves Shopify at that point.

Shopify’s mandatory privacy webhooks

• customers/data_request — the app holds no customer data, so there is nothing to return.
• customers/redact — the app holds no customer data, so there is nothing to delete.
• shop/redact — your store record and your saved rules are deleted.

Where data is stored

Your store domain, access token and saved rules are held in a Postgres database hosted in the European Union (Frankfurt region). Data is transmitted over TLS.

How long data is kept

Your access token is deleted immediately when you uninstall the app. Your store record and your saved rules are deleted when Shopify sends the shop/redact request, which happens 48 hours after uninstall.

Sub-processors

Provider	Purpose	Location
Shopify	App platform	Global
Neon	Postgres database	EU (Frankfurt)
Vercel	Application hosting	EU

No other party receives any data.

Changes to this policy

If this policy changes in a way that affects what we store, we will update the date at the top of this page.

Contact

Questions about this policy: info@saitkatmerlikaya.com