Tenor
How it worksNet 120+PricingFAQ
Add to Shopify

Privacy Policy

Last updated: July 2026

Tenor: B2B Payment Terms ("the app", "we") is a near-backendless Shopify app — it has no general application server or database for your store's business data. This policy explains what data the app accesses and how it is handled.

Summary

  • The app has no application server or database for your store's business data (company, draft-order, order data). The only hosted component is a thin Cloudflare Worker that serves the app's embedded admin page (HTML/JS) and, as described below, holds a small server-side credential store used only to enforce billing. The Worker does not store, log, or transmit your store's business data.
  • All company/draft-order/order data is read and written directly between your browser/admin and Shopify's GraphQL Admin API (via App Bridge), and stored inside your own Shopify store as app-owned metafields. We do not copy it elsewhere.
  • Billing-entitlement credentials. To confirm your store has an active paid subscription before enabling or keeping enabled the checkout payment customization, the Worker stores a Shopify-issued offline access token and refresh token for your store, encrypted at rest (AES-GCM) in a Cloudflare D1 database. These tokens are app credentials used solely to call the Shopify Admin API on the app's own behalf for billing checks and to enable/disable/remove the payment customization — they are not customer data and are never used to read or export your customers' personal information. They are kept for the life of the install and deleted when the app is uninstalled or on a GDPR shop/redact request. We also keep your store's .myshopify.com domain as an install marker (implicit in that same D1 row) for an internal install/uninstall notification email to the app operator.

Data the app accesses (via Shopify APIs)

  • Companies — to read/write a company's default payment term (net days) and optional deposit percentage.
  • Draft orders — to read/write the payment term and a per-order term record, and to set native payment terms on the draft.
  • Orders — read-only: to display a payment-term record for audit/ERP. The app never writes to orders.
  • Payment terms & payment customizations — to apply terms at B2B checkout via a Shopify Function.

We record none of this business data. These values are read and written directly in your Shopify store; the app keeps no copy of any company, draft-order, or order data, and records, logs, or transmits nothing of it off-platform. (The one exception — the billing-entitlement token described above — is an app credential, not a copy of your store's business or customer data; see below.)

Protected customer data. The app requests theread_customers scope — required to read theDraftOrder.purchasingEntity field, which is how it resolves the B2B company on a draft order (the field is access-denied without it). Through that field the app reads only the B2B company and its metafields; it does notread customer PII fields (name, email, phone, or address) and does not store any customer data off-platform. Its Protected Customer Data footprint is therefore Level 1 (protected data accessed, no PII fields read or stored) — unchanged by the billing-entitlement token store, since that token is an app-to-Shopify service credential, not customer PII. The app does not request or store payment card data or order contents outside of Shopify.

Where data is stored

All B2B configuration and records (company payment terms, deposits, draft-order/order term records) are stored as metafields within your Shopify store. The app does not maintain its own copy of any of that data.

The one thing the app stores outside your store is the billing-entitlement credential described above: a Shopify offline access token + refresh token, encrypted at rest (AES-GCM) in a Cloudflare D1 database, used only to verify an active subscription and to enable/disable/remove the payment customization server-side. It is not a copy of any company, draft-order, order, or customer data.

Third parties

Shopify processes all data as part of your store. The Cloudflare Worker that serves the app page is hosted on Cloudflare; besides the encrypted billing-entitlement token described above, it does not receive or retain your store's business or customer data. We do not sell or share data with any other third party.

Data retention & deletion

Because your B2B configuration lives in your store's metafields, uninstalling the app and removing its metafields removes that data. The billing-entitlement token (offline access + refresh token, encrypted at rest in D1) is retained for the life of the install and is deleted on uninstall (app/uninstalled) and on a GDPR shop/redact request. The app honors Shopify's mandatory compliance webhooks (customers/data_request, customers/redact, shop/redact); the app stores no customer PII off-platform, so customers/data_request and customers/redact have no external customer data to return or erase, and shop/redact deletes the shop's D1 row (billing token + install marker) described above.

Contact

Questions: support@datun.dev